Hostile ^100% Download

58c3aec165018cd5e0543a9678403bdc25d1d8415c46ff8dc8c5510ee4e45a64

C2, persistence, firewall evasion

Malformed ELF header or section headers: Malformed ARM ELF with executable stack request

SHA-25658c3aec165018cd5e0543a9678403bdc25d1d8415c46ff8dc8c5510ee4e45a64

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(AsP₃C)H₅(Cm₁₀DbF₃Os₂Po)Md₂(ArBi₂)

Evidence

ARM architecture from ELF header bytes 0x0–0x180

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x2050b00400020000043400200005002800P.......4. ...(.
⋯7 more rows
0xa004100500000000000800000004000000................
0xb00400000051e574640000000000000000....Q.td........
0xc000000000000000000000000007000000................
0xd0040000000dc0a0e1f0df2de904b04ce2..........-...L.
⋯11 more rows

HTTP protocol version strings 0x34b68–0x34c38

⋯3 more rows
0x34b98504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x34ba820485454502f312e310d0a557365722d HTTP/1.1..User-
0x34bb84167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯8 more rows

HTTP GET method 0x34c50–0x34d10

⋯3 more rows
0x34c806669670025642e25642e25642e256400fig.%d.%d.%d.%d.
0x34c90474554202f6320485454502f312e300dGET /c HTTP/1.0.
0x34ca00a000000486f73743a2025730d0a0000....Host: %s....
⋯7 more rows

Native S-number init script 0x35408–0x35688

⋯3 more rows
0x354382e736800257325732573257300000000.sh.%s%s%s%s....
0x3544823212f62696e2f73680000002f6d6e74#!/bin/sh.../mnt
0x354582f6a666673322f776966692e73680000/jffs2/wifi.sh..
⋯4 more rows
0x354a800000000727700002f6465762f000000....rw../dev/...
0x354b86d74640077620000726200002f62696emtd.wb..rb../bin
0x354c82f7368002f62696e2f62617368000000/sh./bin/bash...
0x354d82f6574632f72632e642f00002f657463/etc/rc.d/../etc
0x354e82f7263532e642f002573257325732573/rcS.d/.%s%s%s%s
0x354f825730000232100002f6574632f696e69%s..#!../etc/ini
0x35508742e642f533935626162792e73680000t.d/S95baby.sh..
0x3551869707461626c6573202d4920494e5055iptables -I INPU
⋯12 more rows
0x355e8524f50002f7573722f6c6f63616c2f63ROP./usr/local/c
0x355f874000000726d202f686f6d652f687474t...rm /home/htt
0x3560870642f7765625f7368656c6c5f636d64pd/web_shell_cmd
0x356182e676368000000006563686f2033203e.gch....echo 3 >
⋯7 more rows

OpenWrt overlay upper filesystem path 0x357ac–0x3593c

⋯7 more rows
0x3581c2c7277202f6f7665726c6179202f0000,rw /overlay /..
0x3582c2f6f7665726c61792f75707065720000/overlay/upper..
0x3583c2f6f7665726c61792f75707065722f75/overlay/upper/u
0x3584c737200002f6f7665726c61792f757070sr../overlay/upp
0x3585c65722f65746300002f6f7665726c6179er/etc../overlay
0x3586c2f75707065722f6574632f72632e6400/upper/etc/rc.d.
0x3587c2f6f7665726c61792f75707065722f65/overlay/upper/e
0x3588c74632f696e69742e640000002f6f7665tc/init.d.../ove
⋯11 more rows