Hostile ^100% Download

mirai.arm8

Mirai botnet malware

Detects Mirai Botnet MalwareBusyBox invoked with bot marker name

SHA-2565ced88fd4a63c5b4dc041dc53d478f72f7cbbf3b575a234cee1dd9747bb4867c

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(Mc₃LiTe)O₄(ErILa₂Dy)H₅(Cm₅F₄MgOsPo₃)Md₄(Bi₂BkHe)Th

Evidence

Linux ARM64 direct SVC syscall instruction 0xb898–0xb958

⋯3 more rows
0xb8c8c0035fd6007c4093217c4093280380d2.._..|@.!|@.(...
0xb8d8010000d41f0440b1e900005441d03bd5[email protected].;.
0xb8e8220100f0425040f9e003004b206822b8"[email protected] h".
⋯7 more rows

Invokes chdir/fchdir to change directory 0xb978–0xba48

⋯3 more rows
0xb9a8f35341a9fd7bcfa8c0035fd6280680d2.SA..{...._.(...
0xb9b8010000d41f0440b1e900005441d03bd5[email protected].;.
0xb9c8220100f0425040f9e003004b206822b8"[email protected] h".
⋯8 more rows

Sends a process/thread signal via direct syscall 0xbb48–0xbc08

⋯3 more rows
0xbb78c0035fd6007c4093217c4093281080d2.._..|@.!|@.(...
0xbb88010000d41f0440b1e900005441d03bd5[email protected].;.
0xbb98220100f0425040f9e003004b206822b8"[email protected] h".
⋯7 more rows

Busybox probe via non-existent applet 0x1afa0–0x1b290

⋯3 more rows
0x1afd02f000000000000002000000000000000/....... .......
0x1afe020485454502f312e310d0a557365722d HTTP/1.1..User-
0x1aff04167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯5 more rows
0x1b05027000000000000003d00000000000000'.......=.......
0x1b060504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x1b070300d0a00000000002f2e0076640048720......./..vd.Hr
⋯5 more rows
0x1b0d098754000000000000000000100000000.u@.............
0x1b0e02f6465762f7761746368646f67000000/dev/watchdog...
0x1b0f02f6465762f6d6973632f776174636864/dev/misc/watchd
0x1b1006f670000000000000a00000000000000og..............
0x1b1106162636465666768696a6b6c6d6e6f70abcdefghijklmnop
0x1b12071727374757677303132333435363738qrstuvw012345678
0x1b13000000000da00b4009000560074003a00..........V.t.:.
⋯3 more rows
0x1b170544b585a5400000043464f4b4c000000TKXZT...CFOKL...
0x1b1801a1a1a1a1a1a00005a4f4a464b524100........ZOJFKRA.
0x1b19046474443574e56004857434c5647414aFGDCWNV.HWCLVGAJ
0x1b1a000000000000000001310111617140000................
⋯8 more rows
0x1b23063464f4b4c4b51565043564d50000000cFOKLKQVPCVMP...
0x1b240514750544b4147005157524750544b51QGPTKAG.QWRGPTKQ
0x1b2504d500000000000004557475156000000MP......EWGQV...
0x1b26043464f4b4c13000043464f4b4c4b5156CFOKL...CFOKLKQV
0x1b2705043564d5000000057404c5600000000PCVMP...W@LV....
0x1b280494e5413101116007856471710130000INT.....xVG.....
0x1b2904a4b1117131a00004854405846000000JK......HT@XF...

XOR-decoded macOS Safari User-Agent 0x1b6a3–0x1b993

⋯3 more rows
0x1b6d35447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0x1b6e34c454b4c5a22000000000000006f4d58LEKLZ".......oMX
0x1b6f34b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1b70351026c760213120c121902756d751416Q.lv.......umu..
0x1b7130b026352524e47754740694b560d1711..cRRNGuG@iKV...
0x1b723150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0x1b7334702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0x1b74317130c120c101512160c131211027143..............qC
0x1b7534443504b0d1711150c111422006f4d58DCPK.......".oMX
0x1b7634b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1b77351026c760213120c121902756d751416Q.lv.......umu..
0x1b7830b026352524e47754740694b560d1711..cRRNGuG@iKV...
0x1b793150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0x1b7a34702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0x1b7b317100c120c101516110c131314027143..............qC
0x1b7c34443504b0d1711150c111422006f4d58DCPK.......".oMX
0x1b7d34b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1b7e351026c7602140c131902756d7514160bQ.lv......umu...
0x1b7f3026352524e47754740694b560d171115.cRRNGuG@iKV....
0x1b8030c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0x1b81302654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0x1b823130c120c101512160c13121102714344.............qCD
0x1b83343504b0d1711150c11142200006f4d58CPK......."..oMX
0x1b8434b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1b85351026c7602140c131902756d7514160bQ.lv......umu...
0x1b863026352524e47754740694b560d171115.cRRNGuG@iKV....
0x1b8730c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0x1b88302654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0x1b893100c120c101516110c13131402714344.............qCD
0x1b8a343504b0d1711150c11142200006f4d58CPK......."..oMX
0x1b8b34b4e4e430d170c12020a6f43414b4c56KNNC......oCAKLV
0x1b8c34d514a19026b4c56474e026f4341026dMQJ..kLVGN.oCA.m
0x1b8d371027a0213127d13137d140b02635252q.z...}..}...cRR
0x1b8e34e47754740694b560d1412130c150c15NGuG@iKV........
0x1b8f3020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x1b90341494d0b02744750514b4d4c0d1b0c13AIM..tGPQKML....
0x1b9130c100271434443504b0d1412130c150c...qCDCPK.......
0x1b92315220000002200050a0f141900090011."..."..........
0x1b9330100001400160019001b001d001f0021...............!
⋯6 more rows