Suspicious ^86% Download

89b64bd45478e53299f9c422cbba40fac3ac0712b551b85185e38203f7f984c6

UPX packed, stripped, sectionless

Hostile sectionless MIPS UPX profileBinary contains a UPX packing marker

SHA-25689b64bd45478e53299f9c422cbba40fac3ac0712b551b85185e38203f7f984c6

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e0001000000a8babd0300000000..>.............
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe008000000000000008dbfcbb955505821............UPX!
0xf008140e1600000000a2602501007a9500.........`%..z..
0x10090010000800000000e0000001a03003f...............?
⋯15 more rows

ELF embeds a cleartext http:// URL 0x536513–0x536723

⋯3 more rows
0x5365435ae81e00000050524f545f455845437cZ.....PROT_EXEC|
0x53655350524f545f5752495445206661696c65PROT_WRITE faile
0x536563642e0a005e6a025f6a01580f056a7f5fd...^j._j.X..j._
0x5365736a3c580f050a0024496e666f3a205468j<X....$Info: Th
0x53658369732066696c65206973207061636b65is file is packe
0x53659364207769746820746865205550582065d with the UPX e
0x5365a3786563757461626c65207061636b6572xecutable packer
0x5365b320687474703a2f2f7570782e73662e6e http://upx.sf.n
0x5365c3657420240a002449643a205550582034et $..$Id: UPX 4
0x5365d32e323220436f70797269676874202843.22 Copyright (C
⋯6 more rows
0x5366434901ce5f525057514d29c94183c8ff6aI.._RPWQM).A...j
0x53665322415a525e6a035a29ff6a09580f0548"AZR^j.Z).j.X..H
0x53666389442410505a535ead504889e14989d5.D$.PZS^.PH..I..
0x536673ad50ad41904889f75effd559488b7424.P.A.H..^..YH.t$
0x53668318488b7c24106a055a6a0a580f0541ff.H.|$.j.Zj.X..A.
0x536693e55de87effffff2f70726f632f73656c.].~.../proc/sel
0x5366a3662f6578650000010000150c0000ea07f/exe...........
0x5366b300000e0000001a030074127c1a08360a.........t.|..6.
⋯7 more rows

Canonical trailing UPX PackHeader magic 0x536f1c–0x536f7c

⋯3 more rows
0x536f4c56000000000055505821000000000000V.....UPX!......
0x536f5c555058210e160e0a681fb7df639a05e4UPX!....h...c...
0x536f6ca26025015c6f5300a2602501000000d0.`%.\oS..`%.....
0x536f7cf4000000                        ....            