Hostile ^100% Download

7b02ceb41d8c2fec1a892d6d49cfe76b9a789e7afb6711bd19b4d5e2fd201c3d.elf

Botnet DDoS and ransomware symbols

Go network-device bot extracts credentials and exploits discovered devicesGo binary exposes multiple flood methods

SHA-2567b02ceb41d8c2fec1a892d6d49cfe76b9a789e7afb6711bd19b4d5e2fd201c3d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(LaAs₂I₄PCa)H₅(Cm₁₁Cr₅Db₅MgOs₃)Md₂(BiPt)

Evidence

Big-endian MIPS direct system-call instruction 0x133d–0x13fd

⋯3 more rows
0x136da0001c8fbf000027bd000c03e0000800.......'........
0x137d0000000c02b74000000000000000008f......@.........
0x138dc10008003d082b142000060000000000....=.+. .......
⋯7 more rows

Pinned external IPv4 host literal in binary 0x399bcb–0x399ceb

⋯5 more rows
0x399c1b61747461636b206f6e20687474703a2fattack on http:/
0x399c2b2f3138352e3231332e3234302e36342f/185.213.240.64/
0x399c3b62696e732e73680d0a557365722d4167bins.sh..User-Ag
⋯11 more rows

References Go net/http Client.Do 0x43f953–0x43fae3

⋯7 more rows
0x43f9c3687474702e4e65775265717565737400http.NewRequest.
0x43f9d36e65742f687474702e282a436c69656enet/http.(*Clien
0x43f9e374292e446f006e65742f687474702e61t).Do.net/http.a
0x43f9f36c7761797346616c7365006e65742f68lwaysFalse.net/h
⋯15 more rows

Go binary exposes multiple flood methods 0x44787c–0x447b3c

⋯5 more rows
0x4478cc65742f4d6574686f64732e696e697400et/Methods.init.
0x4478dc426f746e65742f4d6574686f64732e46Botnet/Methods.F
0x4478ec6f727441747461636b00426f746e6574ortAttack.Botnet
0x4478fc2f4d6574686f64732e466f7274417474/Methods.FortAtt
⋯8 more rows
0x44798c41747461636b2e66756e63312e646566Attack.func1.def
0x44799c6572777261703100426f746e65742f4derwrap1.Botnet/M
0x4479ac6574686f64732e47616d65466c6f6f64ethods.GameFlood
0x4479bc00666d742e5072696e74660072756e74.fmt.Printf.runt
⋯8 more rows
0x447a4c732e47616d65466c6f6f642e66756e63s.GameFlood.func
0x447a5c312e6465666572777261703100426f741.deferwrap1.Bot
0x447a6c6e65742f4d6574686f64732e48657846net/Methods.HexF
0x447a7c6c6f6f6400426f746e65742f4d657468lood.Botnet/Meth
0x447a8c6f64732e486f6d65486f6c6400426f74ods.HomeHold.Bot
⋯11 more rows

Go device credential-leak handler set 0x44824d–0x44853d

⋯5 more rows
0x44829d696e2e6d61696e2e676f777261703100in.main.gowrap1.
0x4482ad6d61696e2e4175746f5374617274006fmain.AutoStart.o
0x4482bd732e45786563757461626c65006f732es.Executable.os.
0x4482cd437265617465006f732e282a46696c65Create.os.(*File
0x4482dd292e43686d6f6400696f2f696f757469).Chmod.io/iouti
0x4482ed6c2e5265616446696c65006d61696e2el.ReadFile.main.
0x4482fd4765745374617473006d61696e2e6765GetStats.main.ge
⋯11 more rows
0x4483bd636f6e66436865636b2e646566657277confCheck.deferw
0x4483cd72617031006d61696e2e676574437265rap1.main.getCre
0x4483dd644c65616b006e65742f687474702e47dLeak.net/http.G
0x4483ed6574006d61696e2e66696e6442797465et.main.findByte
0x4483fd456e64006d61696e2e67657443726564End.main.getCred
0x44840d4c65616b2e6465666572777261703100Leak.deferwrap1.
0x44841d6d61696e2e67657441646d696e437265main.getAdminCre
0x44842d644c65616b006d61696e2e6765744164dLeak.main.getAd
0x44843d6d696e437265644c65616b2e64656665minCredLeak.defe
0x44844d727772617031006d61696e2e66696e64rwrap1.main.find
0x44845d446576696365006d61696e2e66696e64Device.main.find
0x44846d4465766963652e646566657277726170Device.deferwrap
⋯8 more rows
0x4484fd6365436170746368612e646566657277ceCaptcha.deferw
0x44850d72617031006d61696e2e6c6f67696e44rap1.main.loginD
0x44851d6576696365006d61696e2e6c6f67696eevice.main.login
0x44852d4465766963652e646566657277726170Device.deferwrap
0x44853d31006d61696e2e737973636d6450696e1.main.syscmdPin