Hostile ^100% Download

7875d573ef014091135caa1f194cd5cf2fda027fe99ae51a51674845d059576d.elf

SNOWLIGHT C2, evasion, hardcoded IP

Detects Linux.Generic.ThreatReferences /tmp/log_de.log killswitch path

SHA-2567875d573ef014091135caa1f194cd5cf2fda027fe99ae51a51674845d059576d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(AlEr₃)H₄(FCm₈OsPo)Md₂(BkHe)Th₂

Evidence

Repeated 0x07 byte constant 0x1d0–0x340

⋯8 more rows
0x25015000000060000001000000000000000................
0x2600e00000007000000130000000c000000................
0x27005000000000000000000000012000000................
⋯13 more rows

Parse IP with inet_addr 0x4aa–0x62a

⋯4 more rows
0x4ea0000000000000000000000000000006c...............l
0x4fa6962632e736f2e3600736f636b657400ibc.so.6.socket.
0x50a6578697400636f6e6e6563740073656eexit.connect.sen
0x51a64006665786563766500726563760069d.fexecve.recv.i
0x52a6e65745f6164647200736574736f636bnet_addr.setsock
0x53a6f7074007265616c7061746800676574opt.realpath.get
0x54a686f737462796e616d6500636c6f7365hostbyname.close
0x55a00736c6565700073797363616c6c0061.sleep.syscall.a
0x56a6363657373005f5f6c6962635f737461ccess.__libc_sta
0x57a72745f6d61696e00736574656e760077rt_main.setenv.w
0x58a72697465005f5f656e7669726f6e005frite.__environ._
⋯10 more rows

SNOWLIGHT 0xa5d–0xb7d

⋯5 more rows
0xaad7ffdffff85c04889c289c17e214889e8......H....~!H..
0xabd80309948ffc089c629ee39ce7cf24863.0.H....).9.|.Hc
0xacdd24889ee4489e7e887fdffffebc531c0.H..D.........1.
⋯11 more rows

References /tmp/log_de.log killswitch path 0xc54–0xdf4

⋯7 more rows
0xcc44883ec084883c408c300000001000200H...H...........
0xcd42f746d702f6c6f675f64652e6c6f6700/tmp/log_de.log.
0xce46c3634202020006100435744005b6b77l64   .a.CWD.[kw
0xcf46f726b65722f303a325d000038392e33orker/0:2]..89.3
0xd04342e3232372e393600000000000000004.227.96........
0xd1400000000000000000000000000000000................
⋯14 more rows