Hostile ^100% Download

violet.m68k

C2, persistence, hidden files

Cron with hidden file pathsNameless static ELF pins an external address

SHA-2566b86692d14bce986a7e35929ab9616c672e2dc7642c42d7db729bdf428a0d707

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(As₂Er₃PDy)H₅(Cm₂DbF₃OsPo₃)Md₄(ArBi₃BkHe)

Evidence

Motorola 68000 machine field in ELF header 0x0–0x2f0

0x07f454c46010201000000000000000000.ELF............
0x1000020004000000018000014400000034...........D...4
0x200000be38000000000034002000030028...8.....4. ...(
⋯6 more rows
0x90000000044e56000061ff0000006461ff....NV..a....da.
0xa00000a86c4e5e4e754e5600004a398000...lN^NuNV..J9..
0xb0ddf8663e22798000dab820514a886716..f>"y.... QJ.g.
⋯36 more rows

ARM supervisor-call syscall instruction 0x3a02–0x3ac2

⋯3 more rows
0x3a320008226e000c262e001024092208203c.."n..&...$.". <
0x3a42000000ef4e402d40fff8202efff87282....N@-@.. ...r.
0x3a52b280641a202efff844802d40fffc61ff..d. [email protected].
⋯7 more rows

Direct m68k fork syscall wrapper 0x3c70–0x3dd0

⋯3 more rows
0x3ca02f2e000c2f2e000861a6508f4e5e4e75/.../...a.P.N^Nu
0x3cb04e56fff870024e402d40fff8202efff8NV..p.N@-@.. ...
0x3cc07282b280641a202efff844802d40fffcr...d. ...D.-@..
0x3cd061ff000003e220aefffc72ff2d41fff8a..... ...r.-A..
0x3ce0202efff84e5e4e754e56fff870144e40 ...N^NuNV..p.N@
0x3cf02d40fff8202efff87282b280641a202e-@.. ...r...d. .
0x3d00fff844802d40fffc61ff000003aa20ae[email protected]..... .
0x3d10fffc72ff2d41fff8202efff84e5e4e75..r.-A.. ...N^Nu
0x3d204e56fff82f02206e0008242e000c2208NV../. n..$...".
0x3d3070254e402d40fff8202efff87282b280p%N@-@.. ...r...
0x3d40641a202efff844802d40fffc61ff0000d. [email protected]...
0x3d50036620aefffc72ff2d41fff8202efff8.f ...r.-A.. ...
0x3d60242efff44e5e4e754e5600002f2e000c$...N^NuNV../...
⋯7 more rows

Motorola 68000 Linux socketcall syscall wrapper 0x83f4–0x84f4

⋯3 more rows
0x8424448020798000fe64208070ff4ed14e75D. y...d .p.N.Nu
0x84344e56fff82f02206e000c226e00082408NV../. n.."n..$.
0x8444220970664e402d40fff8202efff87282".pfN@-@.. ...r.
0x8454b280641a202efff844802d40fffc61ff..d. [email protected].
0x8464ffffbc5020aefffc72ff2d41fff8202e...P ...r.-A.. .
0x8474fff8242efff44e5e4e754e754e56fff8..$...N^NuNuNV..
0x848448e73020246e0008226e000c206e0010H.0 $n.."n.. n..
⋯7 more rows

Pinned external IPv4 host literal in binary 0xa8e6–0xab76

⋯5 more rows
0xa9364e5600004e5e4e754e56000061ffffffNV..N^NuNV..a...
0xa94657644e5e4e752f746d702f2e76696f6cWdN^Nu/tmp/.viol
0xa9566574002f70726f632f25642f65786500et./proc/%d/exe.
0xa9662863726f6e746162202d6c20323e2f64(crontab -l 2>/d
0xa97665762f6e756c6c3b206563686f202740ev/null; echo '@
0xa9867265626f6f742025732025732729207creboot %s %s') |
0xa9962063726f6e746162202d20323e2f6465 crontab - 2>/de
0xa9a6762f6e756c6c0025640a003137322e32v/null.%d..172.2
0xa9b634352e3130362e31343400436f6e6e6545.106.144.Conne
0xa9c66374656420546f20434e430d0a007465cted To CNC...te
0xa9d66c6e657464002f002f7661722f72756elnetd././var/run
0xa9e62f2e76696f6c6574002f6d6e742f2e76/.violet./mnt/.v
0xa9f6696f6c6574002f726f6f742f2e76696fiolet./root/.vio
0xaa066c6574002f746d702f2e76696f6c6574let./tmp/.violet
0xaa162e706964002f746d702f2e76696f6c65.pid./tmp/.viole
0xaa26742e7764002f746d702f2e76696f6c65t.wd./tmp/.viole
0xaa36742e63726f6e000f002f096c6f63616ct.cron.../.local
0xaa46686f737463dd01008000a94c8000a9dehostc......L....
⋯4 more rows
0xaa96002b002d002000307800305800101010.+.-. .0x.0X....
0xaaa6080a0a0a686c4c6a7a74715a00020408....hlLjztqZ....
0xaab608000008000001081f0000050f000807................
0xaac600020004000100031000000500000007................
0xaad600020004000100030001070f10111213................
0xaae6156e7078586f75646966466545674761.npxXoudifFeEgGa
0xaaf6414353637300202b302d232749000008ACScs. +0-#'I...
0xab0600050003000400010200000004000800................
⋯7 more rows