Hostile ^100% Download

manji.arm7

persistence, evasion, network, obfuscation

ARM host-profiled shell implantNative ARM implant authors a self-respawning systemd unit

SHA-2566c94095aa71962747cf66b48443a48c7a7fc0fbe1d643ba49aa12f48ea893e20

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(CP₄AlDy)H₆(Cm₂CrDb₂F₉Os₇Po₄)Md₅(ArBi₃BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x2f0

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x2040b50100020000043400200005002800@.......4. ...(.
⋯45 more rows

ChaCha20/Salsa20 cipher constant 0x4b98–0x4d18

⋯7 more rows
0x4c08020080e0332200eb1040bde81eff2fe1....3"...@..../.
0x4c18657870616e642033322d62797465206bexpand 32-byte k
0x4c28f04f2de9000053e367df4de200318de5.O-...S.g.M..1..
⋯15 more rows

ARM EABI direct execve(2) wrapper 0x126d4–0x12864

⋯3 more rows
0x127048040bde81eff2fe12cfb000080402de9.@..../.,....@-.
0x127143f70a0e3000000ef010a70e30020a0e1?p........p.. ..
0x127240000a0910500009a18309fe5e2ffffeb.........0......
0x1273403309fe7002062e2032080e70000e0e3.0... b.. ......
0x127448040bde81eff2fe1ecfa000080402de9.@..../......@-.
0x127540b70a0e3000000ef010a70e30020a0e1.p........p.. ..
0x127640000a0910500009a18309fe5d2ffffeb.........0......
0x1277403309fe7002062e2032080e70000e0e3.0... b.. ......
⋯15 more rows

References a systemd ExecStart directive 0x188a4–0x18b94

⋯3 more rows
0x188d46d6e6f707172737475767778797a0000mnopqrstuvwxyz..
0x188e42f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x188f4000000002f70726f632f256400000000..../proc/%d....
0x189042f70726f632f73656c66000064697675/proc/self..divu
0x18914732d6368656174732e636f6d00000000s-cheats.com....
0x189242f70726f632f73656c662f6578650000/proc/self/exe..
0x189342f70726f632f637075696e666f000000/proc/cpuinfo...
0x1894463707520636f72657300000000000003cpu cores.......
0x1895400000000000102030405060708090a0b................
⋯8 more rows
0x189e42f7573722f6c6f63616c2f002f6f7074/usr/local/./opt
0x189f42f0000002f70726f632f6d6f756e7473/.../proc/mounts
0x18a0400000000252a73202532353573202536....%*s %255s %6
0x18a1433730000746d70667300000072616d663s..tmpfs...ramf
0x18a247300000025732f25730000002f657463s...%s/%s.../etc
0x18a34000000002f6574632f73797374656d64..../etc/systemd
0x18a442f73797374656d002f6574632f737973/system./etc/sys
0x18a5474656d642f73797374656d2f25732e73temd/system/%s.s
0x18a646572766963650000770000005b556e69ervice..w...[Uni
⋯4 more rows
0x18ab45d0a0000547970653d73696d706c650a]...Type=simple.
0x18ac4000000004578656353746172743d2573....ExecStart=%s
0x18ad40a000000526573746172743d616c7761....Restart=alwa
0x18ae479730a00526573746172745365633d31ys..RestartSec=1
0x18af4300a0a005b496e7374616c6c5d0a00000...[Install]...
0x18b0457616e74656442793d6d756c74692d75WantedBy=multi-u
0x18b147365722e7461726765740a0073797374ser.target..syst
0x18b24656d63746c20656e61626c652025732eemctl enable %s.
0x18b3473657276696365203e2f6465762f6e75service >/dev/nu
0x18b446c6c20323e2631207c7c207472756500ll 2>&1 || true.
0x18b54610000000a23204175746f2d61646465a....# Auto-adde
0x18b646420736572766963650a000025732026d service...%s &
0x18b740a00000063726f6e746162202d6c2032....crontab -l 2
0x18b843e2f6465762f6e756c6c00002863726f>/dev/null..(cro
0x18b946e746162202d6c20323e2f6465762f6entab -l 2>/dev/n

References the /bin/sh shell path 0x18f18–0x190f8

⋯7 more rows
0x18f886e6f6469726174696d6500002c000000nodiratime..,...
0x18f980000000000000000000000002f62696e............/bin
0x18fa82f7368002d6300000000000000000000/sh.-c..........
0x18fb800000000000000000000000000000000................
0x18fc800000000000000000000000000000000................
0x18fd80000000000000000286e696c29000000........(nil)...
0x18fe8286e756c6c2900002b002d0020003078(null)..+.-. .0x
0x18ff800305800101010080a0a0a00686c4c6a.0X.........hlLj
0x190087a74715a000204080800000800000108ztqZ............
0x19018001f0500000f07080200040001000300................
⋯3 more rows
0x1905807080001010104020101010101010000................
0x190686e7078586f7564696646654567476141npxXoudifFeEgGaA
0x190784353637300000000202b302d23274900CScs.... +0-#'I.
0x19088000000000000000000000000556e6b6e............Unkn
⋯7 more rows