Hostile ^100% Download

aarch64.pre-persist

DDoS bot with ransomware

Go attack worker function nameLinux artifact defines restarting systemd unit

SHA-25687c7e46f2ff5671ec5e4ebc98c1bd44c46477fb45bb1079385f63d77be881a2f

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(Am₂Mc₂)O₇(As₂I₆P₄CCaEr₂La)H₆(Cm₂₂Cr₇Db₅F₅Os₇Po₃)Md₃(BiPt)

Evidence

Cron entry uses @reboot directive 0x262a33–0x262bb3

⋯6 more rows
0x262a936674702f7573722f62696e2f6178656cftp/usr/bin/axel
0x262aa32f7573722f62696e2f73667470786d72/usr/bin/sftpxmr
0x262ab369672d616172636836342f70726f632fig-aarch64/proc/
0x262ac36d656d696e666f737461636b6f766572meminfostackover
0x262ad3666c6f77677a69702c206465666c6174flowgzip, deflat
0x262ae36568747470733a2f2f742e636f2f4072ehttps://t.co/@r
0x262af365626f6f7420726f6f74207379737465eboot root syste
0x262b036d2d7570646174652f6574632f72632em-update/etc/rc.
0x262b136c6f63616c6c616d6520726566657272locallame referr
0x262b23616c2f6574632f736572766963657341al/etc/servicesA
⋯9 more rows

References a systemd unit path under /etc 0x26ede0–0x26ef80

⋯11 more rows
0x26ee9072726f723a206c6566746f7665722062rror: leftover b
0x26eea0797465732f6574632f73797374656d64ytes/etc/systemd
0x26eeb02f73797374656d2f626f742d75706461/system/bot-upda
0x26eec074652e73657276696365687474703a20te.servicehttp: 
0x26eed0636f6e63757272656e74207265616420concurrent read 
⋯11 more rows

Systemd service restart policy is always 0x2773a7–0x277577

⋯3 more rows
0x2773d7206164646974696f6e616c2064617461 additional data
0x2773e74d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x2773f7646f7773204e5420362e313b20574f57dows NT 6.1; WOW
0x27740736343b2054726964656e742f372e303b64; Trident/7.0;
0x2774172072763a31312e3029206c696b652047 rv:11.0) like G
0x27742765636b6f4d6f7a696c6c612f352e3020eckoMozilla/5.0 
0x277437285831313b204c696e75782069363836(X11; Linux i686
0x2774473b2072763a3130392e3029204765636b; rv:109.0) Geck
0x2774576f2f3230313030313031204669726566o/20100101 Firef
0x2774676f782f3131352e304d6f7a696c6c612fox/115.0Mozilla/
0x277477352e302028416e64726f69642031343b5.0 (Android 14;
0x277487204d6f62696c653b2072763a3132312e Mobile; rv:121.
0x2774973029204765636b6f2f3132312e3020460) Gecko/121.0 F
0x2774a7697265666f782f3132312e300a526573irefox/121.0.Res
0x2774b7746172743d616c776179730a52657374tart=always.Rest
0x2774c76172745365633d31300a0a5b496e7374artSec=10..[Inst
0x2774d7616c6c5d0a57616e74656442793d6d75all].WantedBy=mu
0x2774e76c74692d757365722e7461726765740alti-user.target.
0x2774f7687474703a206d657373616765206361http: message ca
⋯8 more rows

Pinned external IPv4 host literal in binary 0x27fedf–0x27ffff

⋯4 more rows
0x27ff1f00f8884f000000000000005400000000...O.......T....
0x27ff2f00676f312e32372e3100000000000000.go1.27.1.......
0x27ff3f003137362e36352e3133392e31363000.176.65.139.160.
0x27ff4f0073ba27000000000020000000000000.s.'..... ......
⋯11 more rows

Go attack worker function name 0x2cca72–0x2ccb92

⋯5 more rows
0x2ccac2006d61696e2e73746f704d696e657200.main.stopMiner.
0x2ccad26d61696e2e737461727441747461636bmain.startAttack
0x2ccae2006d61696e2e7265736f6c7665446f6d.main.resolveDom
⋯11 more rows