Hostile ^100% Download

manji.arm6

persistence, evasion, network, obfuscation

ARM host-profiled shell implantNative ARM implant authors a self-respawning systemd unit

SHA-25656f831a271e245dea5f00386cd3169ee81b8e69a3df32e547092775d92f07d58

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(CP₄AlDy)H₆(Cm₂CrDb₂F₉Os₇Po₄)Md₅(ArBi₃BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x2f0

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000005481000034000000..(.....T...4...
0x2008780100020000043400200003002800.x......4. ...(.
⋯45 more rows

ChaCha20/Salsa20 cipher constant 0x4b58–0x4cd8

⋯7 more rows
0x4bc8020080e0631f00eb1040bde81eff2fe1....c....@..../.
0x4bd8657870616e642033322d62797465206bexpand 32-byte k
0x4be8f04f2de9000053e367df4de200318de5.O-...S.g.M..1..
⋯15 more rows

ARM EABI direct execve(2) wrapper 0x1065c–0x107ec

⋯3 more rows
0x1068c003067e2003080e50070e0e30700a0e1.0g..0...p......
0x1069c8040bde81eff2fe180402de93f70a0e3.@..../..@-.?p..
0x106ac000000ef010a70e30070a0e10000a091......p..p......
0x106bc0300009a4ae6ffeb003067e2003080e5....J....0g..0..
0x106cc0000e0e38040bde81eff2fe180402de9.....@..../..@-.
0x106dc0b70a0e3000000ef010a70e30070a0e1.p........p..p..
0x106ec0000a0910300009a3de6ffeb003067e2........=....0g.
0x106fc003080e50000e0e38040bde81eff2fe1.0.......@..../.
⋯15 more rows

References a systemd ExecStart directive 0x14d2c–0x1501c

⋯3 more rows
0x14d5c6d6e6f707172737475767778797a0000mnopqrstuvwxyz..
0x14d6c2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x14d7c000000002f70726f632f256400000000..../proc/%d....
0x14d8c2f70726f632f73656c66000064697675/proc/self..divu
0x14d9c732d6368656174732e636f6d00000000s-cheats.com....
0x14dac2f70726f632f73656c662f6578650000/proc/self/exe..
0x14dbc2f70726f632f637075696e666f000000/proc/cpuinfo...
0x14dcc63707520636f72657300000000000003cpu cores.......
0x14ddc00000000000102030405060708090a0b................
⋯8 more rows
0x14e6c2f7573722f6c6f63616c2f002f6f7074/usr/local/./opt
0x14e7c2f0000002f70726f632f6d6f756e7473/.../proc/mounts
0x14e8c00000000252a73202532353573202536....%*s %255s %6
0x14e9c33730000746d70667300000072616d663s..tmpfs...ramf
0x14eac7300000025732f25730000002f657463s...%s/%s.../etc
0x14ebc000000002f6574632f73797374656d64..../etc/systemd
0x14ecc2f73797374656d002f6574632f737973/system./etc/sys
0x14edc74656d642f73797374656d2f25732e73temd/system/%s.s
0x14eec6572766963650000770000005b556e69ervice..w...[Uni
⋯4 more rows
0x14f3c5d0a0000547970653d73696d706c650a]...Type=simple.
0x14f4c000000004578656353746172743d2573....ExecStart=%s
0x14f5c0a000000526573746172743d616c7761....Restart=alwa
0x14f6c79730a00526573746172745365633d31ys..RestartSec=1
0x14f7c300a0a005b496e7374616c6c5d0a00000...[Install]...
0x14f8c57616e74656442793d6d756c74692d75WantedBy=multi-u
0x14f9c7365722e7461726765740a0073797374ser.target..syst
0x14fac656d63746c20656e61626c652025732eemctl enable %s.
0x14fbc73657276696365203e2f6465762f6e75service >/dev/nu
0x14fcc6c6c20323e2631207c7c207472756500ll 2>&1 || true.
0x14fdc610000000a23204175746f2d61646465a....# Auto-adde
0x14fec6420736572766963650a000025732026d service...%s &
0x14ffc0a00000063726f6e746162202d6c2032....crontab -l 2
0x1500c3e2f6465762f6e756c6c00002863726f>/dev/null..(cro
0x1501c6e746162202d6c20323e2f6465762f6entab -l 2>/dev/n

References the /bin/sh shell path 0x153a0–0x15550

⋯7 more rows
0x154106e6f6469726174696d6500002c000000nodiratime..,...
0x154202f62696e2f7368002d63000000000000/bin/sh.-c......
0x1543000000000000000000100000000000000................
0x1544000000000286e696c29000000286e756c....(nil)...(nul
0x154506c2900002b002d002000307800305800l)..+.-. .0x.0X.
0x15460101010080a0a0a00686c4c6a7a74715a........hlLjztqZ
0x15470000204080800000800000108001f0500................
⋯3 more rows
0x154b000020000000400080200070007080001................
0x154c00101040201010101010100006e707858............npxX
0x154d06f756469664665456747614143536373oudifFeEgGaACScs
0x154e000000000202b302d23274900556e6b6e.... +0-#'I.Unkn
⋯7 more rows