Hostile ^100% Download

mirai.mips32

Mirai botnet malware

Static MIPS credential-equipped Source-query botStatic MIPS watchdog DDoS bot profile

SHA-256611a61a51054d62e492841c89459770e1ef9dde8eb9d967536d336c4fb8df93b

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(Mc₃LiTe)O₅(CIErLa₂Dy)H₅(Cm₅F₄MgOsPo)Md₄(Bi₃BkHe)Th

Evidence

MIPS machine field in ELF header 0x0–0x110

0x07f454c46010201000000000000000000.ELF............
0x10000200080000000100400cd000000034[email protected]
0x2000025a30500010070034002000050028..Z0P....4. ...(
⋯15 more rows

Big-endian MIPS direct system-call instruction 0xd600–0xd780

⋯7 more rows
0xd6702c42000310400005000000002402107c,B...@......$..|
0xd6800000000c100000030000000024020fd7............$...
0xd6900000000c10e00007000000007c03e83b............|..;
⋯15 more rows

Big-endian MIPS O32 direct kill syscall 0xd96c–0xda7c

⋯3 more rows
0xd99c000000003c1c0003279cfa100399e021....<...'......!
0xd9ac24020fc50000000c10e0000700000000$...............
0xd9bc7c03e83b006020258f8385d400641821|..;.` %.....d.!
0xd9ccac6200002402ffff03e0000800000000.b..$...........
0xd9dc000000003c1c0003279cf9d00399e021....<...'......!
0xd9ec24020fa50000000c10e0000700000000$...............
0xd9fc7c03e83b006020258f8385d400641821|..;.` %.....d.!
0xda0cac6200002402ffff03e0000800000000.b..$...........
⋯7 more rows

Source Engine query-family payload marker 0x1e348–0x1e638

⋯3 more rows
0x1e37827bd002000000000474554002f000000'.. ....GET./...
0x1e38820485454502f312e310d0a557365722d HTTP/1.1..User-
0x1e3984167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯3 more rows
0x1e3d800000000504f53540000000027000000....POST....'...
0x1e3e83d000000504f5354202f63646e2d6367=...POST /cdn-cg
0x1e3f8692f0000300d0a002f6465762f776174i/..0.../dev/wat
0x1e4086368646f670000002f6465762f6d6973chdog.../dev/mis
0x1e418632f7761746368646f67000000000000c/watchdog......
0x1e42800000000000000000000000100000000................
0x1e4382f2e007664004872006c650065700000/..vd.Hr.le.ep..
0x1e44872000000000000006162636465666768r.......abcdefgh
0x1e458696a6b6c6d6e6f707172737475767730ijklmnopqrstuvw0
0x1e4683132333435363738000000005a41111712345678....ZA..
0x1e47813130000504d4d5600000000544b585a....PMMV....TKXZ
0x1e4885400000043464f4b4c0000001a1a1a1aT...CFOKL.......
0x1e4981a1a00005a4f4a464b52410046474443....ZOJFKRA.FGDC
0x1e4a8574e56004857434c5647414a00000000WNV.HWCLVGAJ....
0x1e4b813101116171400001716111013000000................
⋯7 more rows
0x1e5384c4b51565043564d5000000051475054LKQVPCVMP...QGPT
0x1e5484b4147005157524750544b514d500000KAG.QWRGPTKQMP..
0x1e558455747515600000043464f4b4c130000EWGQV...CFOKL...
0x1e56843464f4b4c4b51565043564d50000000CFOKLKQVPCVMP...
0x1e57857404c5600000000494e541310111600[email protected].....
0x1e58878564717101300004a4b1117131a0000xVG.....JK......
0x1e5984854405846000000434c494d00000000[email protected]....
0x1e5a8584e5a5a0c0000001557486f494d1254XNZZ.....WHoIM.T
0x1e5b84b585a54000000001557486f494d1243KXZT.....WHoIM.C
0x1e5c8464f4b4c00000000515b5156474f0000FOKL....Q[QVGO..
0x1e5d84b49554000000000465047434f404d5a[email protected]@MZ
⋯6 more rows

XOR-decoded macOS Safari User-Agent 0x1e967–0x1ec57

⋯3 more rows
0x1e9975447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0x1e9a74c454b4c5a220000006f4d584b4e4e43LEKLZ"...oMXKNNC
0x1e9b70d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1e9c70213120c121902756d7514160b026352.......umu....cR
0x1e9d7524e47754740694b560d1711150c1114RNGuG@iKV.......
0x1e9e7020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x1e9f741494d0b02614a504d4f470d17130c12AIM..aJPMOG.....
0x1ea070c101512160c1312110271434443504b..........qCDCPK
0x1ea170d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0x1ea270d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1ea370213120c121902756d7514160b026352.......umu....cR
0x1ea47524e47754740694b560d1711150c1114RNGuG@iKV.......
0x1ea57020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x1ea6741494d0b02614a504d4f470d17100c12AIM..aJPMOG.....
0x1ea770c101516110c1313140271434443504b..........qCDCPK
0x1ea870d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0x1ea970d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1eaa702140c131902756d7514160b02635252......umu....cRR
0x1eab74e47754740694b560d1711150c111402NGuG@iKV........
0x1eac70a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0x1ead7494d0b02614a504d4f470d17130c120cIM..aJPMOG......
0x1eae7101512160c1312110271434443504b0d.........qCDCPK.
0x1eaf71711150c11142200006f4d584b4e4e43......"..oMXKNNC
0x1eb070d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1eb1702140c131902756d7514160b02635252......umu....cRR
0x1eb274e47754740694b560d1711150c111402NGuG@iKV........
0x1eb370a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0x1eb47494d0b02614a504d4f470d17100c120cIM..aJPMOG......
0x1eb57101516110c1313140271434443504b0d.........qCDCPK.
0x1eb671711150c11142200006f4d584b4e4e43......"..oMXKNNC
0x1eb770d170c12020a6f43414b4c564d514a19......oCAKLVMQJ.
0x1eb87026b4c56474e026f4341026d71027a02.kLVGN.oCA.mq.z.
0x1eb9713127d13137d140b026352524e477547..}..}...cRRNGuG
0x1eba740694b560d1412130c150c15020a696a@iKV..........ij
0x1ebb7766f6e0e024e4b494702654741494d0bvon..NKIG.eGAIM.
0x1ebc702744750514b4d4c0d1b0c130c100271.tGPQKML.......q
0x1ebd7434443504b0d1412130c150c15220000CDCPK........"..
0x1ebe7000000000000000000fffd1808fffd17................
0x1ebf780fffd1794fffd17a8fffd17bcfffd17................
0x1ec07d0fffd17e4000000002f70726f632f73........./proc/s
0x1ec1774617400002f70726f632f637075696etat../proc/cpuin
0x1ec27666f00000070726f636573736f720000fo...processor..
0x1ec37002f7379732f646576696365732f7379./sys/devices/sy
0x1ec477374656d2f63707500003a0900fffd42stem/cpu..:....B
0x1ec57a0fffd4788fffd427cfffd42d0fffd42...G...B|..B...B