Suspicious ^80% Download

bot-linux-mipsle

Apex2 botnet malware

IoT bot DDoS vector setGo attack worker function name

SHA-25683ddd635e9a3931f4f98b00354db353a0a63b044e1aff955a95a333a9235d29e

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₅(As₂Ca₂I₂CDy)H₆(Cm₁₈Cr₅Db₆F₃Os₆Po₂)Md₃(Bi₂Pt)

Evidence

Little-endian MIPS syscall instruction 0xf48–0x10a8

0xf4800000000000000000000000000000000................
0xf5800000000000000000000200101010003.......... .....
0xf6800000000000000000000000000000000................
0xf78040000005300000004000000476f0000....S.......Go..
0xf88713846544674306d7030366b4c483077q8FTFt0mp06kLH0w
⋯7 more rows
0x10080800e003000000000800c18f2b083d00............+.=.
0x1018060020140000000025181f00b5cb020c.. .....%.......
0x102800000000f8ff001000000000f4ffbfaf................
0x1038f4ffbd270000bfaf1000a3936a00173c...'........j..<
⋯7 more rows

Native Chromium Login Data path 0x42ffb8–0x430158

⋯5 more rows
0x430008687474703a207265717565737420636fhttp: request co
0x4300186d706c6574656444415441206672616dmpletedDATA fram
0x4300286520776974682073747265616d204944e with stream ID
0x43003820306672616d655f7273747374726561 0frame_rststrea
0x4300486d5f7a65726f5f73747265616d667261m_zero_streamfra
0x4300586d655f7075736870726f6d6973655f70me_pushpromise_p
0x43006861645f73686f72746163636573732d63ad_shortaccess-c
0x4300786f6e74726f6c2d616c6c6f772d6f7269ontrol-allow-ori
0x43008867696e6e65742f687474703a20696e76ginnet/http: inv
0x430098616c6964206d6574686f642025716e65alid method %qne
0x4300a8742f687474703a20696e76616c696420t/http: invalid 
⋯11 more rows

References the Brave browser name 0x43a945–0x43aab5

⋯3 more rows
0x43a9756f726f7574696e652e636f6e6669672foroutine.config/
0x43a9854272617665536f6674776172652f4272BraveSoftware/Br
0x43a9956176652d42726f777365722f44656661ave-Browser/Defa
0x43a9a5756c742f486973746f7279687474703ault/Historyhttp:
0x43a9b52f2f3136392e3235342e3136392e3235//169.254.169.25
0x43a9c5342f6c61746573742f6d6574612d64614/latest/meta-da
0x43a9d574612f696e7374616e63652d69646874ta/instance-idht
0x43a9e574703a2f2f3130302e3130302e313030tp://100.100.100
0x43a9f52e3230302f6c61746573742f6d657461.200/latest/meta
0x43aa052d646174612f696e7374616e63652d69-data/instance-i
⋯11 more rows

Go attack worker function name 0x4f71ca–0x4f72ea

⋯5 more rows
0x4f721a6c6541747461636b436f6d6d616e6400leAttackCommand.
0x4f722a6d61696e2e737461727441747461636bmain.startAttack
0x4f723a006d61696e2e61747461636b4b657900.main.attackKey.
⋯11 more rows

Source Engine query payload 0x650c50–0x650ea0

⋯5 more rows
0x650ca000000000000000000000000000000000................
0x650cb0505249202a20485454502f322e300d0aPRI * HTTP/2.0..
0x650cc00d0a534d0d0a0d0a0000000000000000..SM............
⋯15 more rows
0x650dc002000000010000000000000000000000................
0x650dd0ffffffff54536f7572636520456e6769....TSource Engi
0x650de06e652051756572790000000000000000ne Query........
0x650df0ffffffff54536f7572636520456e6769....TSource Engi
⋯11 more rows