Hostile ^100% Download

zsvc

Prometei botnet configuration

UPX markers present but image is not packedEncrypted parent-relay bot configuration

SHA-25671aca864c28eda352580e3f5cbb09bc29e1de1bc91d0407aeb14e69c5767bd79

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₃(As₂CAl)H₃(Cm₂FOs)Md₃(Bi₄BkHe)Th

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e000100000050b65e0100000000..>.....P.^.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe0100000000000000056fc093955505821........V..9UPX!
0xf0fc0a0e1600000000b0a9130051041000............Q...
0x10070020000be00000008000000bbfb20ffp............. .
⋯15 more rows

Contains a /tmp/ or /var/tmp/ path 0x5af0f–0x5af9f

0x5af0fffbe90eb6c50a4f7a3f95ff50ffcbef2....lP...._.....
0x5af1f7871c61ecccf6a0072de4861736850ffxq....j.r.HashP.
0x5af2f7fd1ff6f77657250726f6a6563c06100...owerProjec.a.
0x5af3f2f746d702f64656275672e74786fdf9a/tmp/debug.txo..
0x5af4f6d200d0a4e26703c632f7374611e252am ..N&p<c/sta.%*
⋯5 more rows

ELF embeds a cleartext http:// URL 0x6c75e–0x6c96e

⋯3 more rows
0x6c78e89395b5dc3681e0000005ae81e000000.9[].h....Z.....
0x6c79e50524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x6c7ae52495445206661696c65642e0a005e6aRITE failed...^j
0x6c7be025f6a01580f056a7f5f6a3c580f050a._j.X..j._j<X...
0x6c7ce0024496e666f3a20546869732066696c.$Info: This fil
0x6c7de65206973207061636b65642077697468e is packed with
0x6c7ee20746865205550582065786563757461 the UPX executa
0x6c7fe626c65207061636b657220687474703able packer http:
0x6c80e2f2f7570782e73662e6e657420240a00//upx.sf.net $..
0x6c81e2449643a2055505820342e323420436f$Id: UPX 4.24 Co
0x6c82e70797269676874202843292031393936pyright (C) 1996
⋯6 more rows
0x6c89e514d29c94183c8ff6a22415a525e6a03QM).A...j"AZR^j.
0x6c8ae5a29ff6a09580f054889442410505a53Z).j.X..H.D$.PZS
0x6c8be5ead504889e14989d5ad50ad41904889^.PH..I...P.A.H.
0x6c8cef75effd559488b742418488b7c24106a.^..YH.t$.H.|$.j
0x6c8de055a6a0a580f0541ffe55de87effffff.Zj.X..A..].~...
0x6c8ee2f70726f632f73656c662f6578650000/proc/self/exe..
0x6c8fe0100002d0c00003008000008000000ff...-...0........
⋯7 more rows

Prometei Linux bot configuration 0x6d871–0x6da31

⋯7 more rows
0x6d8e1d80600b0a91300492a004cf40000007b.......I*.L....{
0x6d8f122636f6e666967223a312c226964223a"config":1,"id":
0x6d90122306739504b58323578426b30615962"0g9PKX25xBk0aYb
0x6d91170222c22656e636b6579223a22574730p","enckey":"WG0
0x6d921722b385170394a5062526c39346d4571r+8Qp9JPbRl94mEq
0x6d9317133477553575332764c395577412b34q3GuSWS2vL9UwA+4
0x6d941487848484b642b78695031414a305550HxHHKd+xiP1AJ0UP
0x6d9517a4c794e6b6e376970706d4f54657670zLyNkn7ippmOTevp
0x6d961684542584541704e4e51322f6b557971hEBXEApNNQ2/kUyq
0x6d971392b544a4a795943436c4865783158309+TJJyYCClHex1X0
⋯3 more rows
0x6d9b16e7158354533455852734b6873495a78nqX5E3EXRsKhsIZx
0x6d9c169446b6e737456493d222c2250617265iDknstVI=","Pare
0x6d9d16e744964223a22505a43595938324630ntId":"PZCYY82F0
0x6d9e13037313432504a4856222c226970223a07142PJHV","ip":
0x6d9f1223136372e3137322e3136382e31222c"167.172.168.1",
0x6da0122506172656e744970223a223138312e"ParentIp":"181.
0x6da113130342e3131362e3634222c22506172104.116.64","Par
0x6da21656e74486f73746e616d65223a225365entHostname":"Se
0x6da317276657248504e7952227d2c        rverHPNyR"},    