Hostile ^100% Download

Space.spc

Mirai botnet binary

Mirai LZRD HTTP bot with static uClibcExotic-arch SSDP and Source-query flood bot

SHA-2568a287d808ee098002248f03563da082e0939f9532d211c569c1937de62ef2cb9

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(Mc₆LiTe)O₆(I₂As₂ErCDyP)H₂(F₆Cm₈)Md₅(ArBiBkHe)Th₂

Evidence

SPARC machine field in ELF header 0x0–0x2f0

0x07f454c46010201000000000000000000.ELF............
0x100002000200000001000101a400000034...............4
0x20000138f8000000000034002000030028..8......4. ...(
⋯45 more rows

HTTP header field delimiter 0x10c53–0x10de3

⋯3 more rows
0x10c83442f7839412f7833382f78464a2f7839D/x9A/x38/xFJ/x9
0x10c93332f7849442f78394100000000534e513/xID/x9A....SNQ
0x10ca3554552593a203132372e302e302e313aUERY: 127.0.0.1:
0x10cb34141414141413a787376720000020000AAAAAA:xsvr.....
0x10cc300000000004d2d534541524348202a20.....M-SEARCH * 
0x10cd3485454502f312e310d0a484f53543a20HTTP/1.1..HOST: 
0x10ce33235352e3235352e3235352e3235353a255.255.255.255:
0x10cf3313930300d0a4d414e3a2022737364701900..MAN: "ssdp
0x10d033a646973636f766572220d0a4d583a20:discover"..MX: 
0x10d13310d0a53543a2075726e3a6469616c2d1..ST: urn:dial-
0x10d236d756c746973637265656e2d6f72673amultiscreen-org:
0x10d33736572766963653a6469616c3a310d0aservice:dial:1..
0x10d43555345522d4147454e543a20476f6f67USER-AGENT: Goog
0x10d536c65204368726f6d652f36302e302e33le Chrome/60.0.3
0x10d633131322e39302057696e646f77730d0a112.90 Windows..
0x10d730d0a0000000000ffff00000000010000................
⋯7 more rows

BusyBox binary path reference 0x110f8–0x11328

⋯7 more rows
0x11168b09cc2ba89b41b17a2b6000000000000................
0x111782f70726f632f6e65742f746370000000/proc/net/tcp...
0x111882f70726f630000002f70726f632f2564/proc.../proc/%d
0x111982f657865000000002f70726f632f2573/exe..../proc/%s
0x111a82f737461747573007200000000000000/status.r.......
0x111b84e616d653a0000002573000000000000Name:...%s......
0x111c82f62696e2f62757379626f7800000000/bin/busybox....
0x111d82f62696e2f73797374656d6400000000/bin/systemd....
0x111e82f7573722f62696e0000000000000000/usr/bin........
0x111f874657374000000002f746d702f636f6etest..../tmp/con
0x1120864690000000000002f746d702f7a7863di....../tmp/zxc
0x1121872393939390000002f746d702f636f6er9999.../tmp/con
0x1122864696e6574776f726b00000000000000dinetwork.......
0x112382f7661722f636f6e6469626f74000000/var/condibot...
0x112482f7661722f7a78637239393939000000/var/zxcr9999...
0x112582f7661722f436f6e6469426f74000000/var/CondiBot...
0x112682f7661722f636f6e64696e6574000000/var/condinet...
0x112782f62696e2f7761746368646f67000000/bin/watchdog...
⋯11 more rows

XOR-0x22 LZRD brand string table 0x11377–0x11667

⋯5 more rows
0x113c700000000000000000000000000000000................
0x113d70039332e3131332e3138302e31343900.93.113.180.149.
0x113e7000a0000000000000000000001000000................
0x113f7002ce000000000000007710000000000.,........q.....
0x11407004e58504602414d4149024447515622.NXPF.AMAI.DGQV"
0x11417000d52504d410d22000d475a47220000..RPMA."..GZG"..
0x11427000d444622000000000d4f4352512200..DF".....OCRQ".
0x11437000d5156435657512200000000000000..QVCVWQ".......
0x11447000d52504d410d4c47560d5641522200..RPMA.LGV.VAR".
0x11457000d414f464e4b4c4722000000000000..AOFNKLG"......
0x11467004654506a474e524750220000000000.FTPjGNRGP".....
0x11477006c4b65654770141b5a462200000000.lKeeGp..ZF"....
0x114870013111115714d50436e6d6366677022.....qMPCnmcfgp"
0x11497006c4b6565477046124c495113111115.lKeeGpF.LIQ....
0x114a72200000000000000007a131b6b10111b"........z..k...
0x114b7131016776b772200006b577b45574847...wkw"..kW{EWHG
0x114c76b534c22000000000013166443220000kSL".......dC"..
0x114d70041416366220000000d52504d410d4c.AAcf"....RPMA.L
0x114e747560d504d5756472200000000000000GV.PMWVG".......
0x114f7000d52504d410d4152574b4c444d2200..RPMA.ARWKLDM".
0x1150700606d656d6f6b727122000000000000.`memokrq"......
0x11517000d4756410d50410c460d50410c4e4d..GVA.PA.F.PA.NM
0x1152741434e22000000000045134340411646ACN"[email protected]
0x115374f4d11174a4c52104e4b471249484422OM..JLR.NKG.IHD"
0x11547000d4647540d554356414a464d452200..FGT.UCVAJFME".
0x11557000d4647540d4f4b51410d554356414a..FGT.OKQA.UCVAJ
0x11567464d452200000000000d4647540d6476FME"......FGT.dv
0x115777566761312137d554356414a464d4522ufv...}UCVAJFME"
0x11587000d4647540d4c4756514e4b4c490d22..FGT.LGVQNKLI."
0x115970072706b746f71652200000000000000.rpktoqe".......
0x115a7006567766e6d61636e6b722200000000.egvnmacnkr"....
0x115b700696b6e6e6376766922000000000000.iknncvvi"......
0x115c700674356511a22000054791254220000.gCVQ."..Ty.T"..
0x115d7001b116d44486a781058220000000000...mDHjx.X".....
0x115e700654a4d51567557586a475047141414.eJMQVuWXjGPG...
0x115f722000000000000000075516563166264"........uQec.bd
0x1160714642200000000000063616660220000.d"......caf`"..
0x116170063406346220000004b436554220000.c@cF"...KCeT"..
⋯5 more rows

Source Engine query payload 0x117f0–0x119c0

⋯3 more rows
0x118205b404d5a026e78706622000000000000[@MZ.nxpf"......
0x118306e78706618024352524e4756024c4d56nxpf..CRRNGV.LMV
0x1184002444d574c4622004c414d5050474156.DMWLF".LAMPPGAV
0x118502200000000000000435151554d504622".......CQQUMPF"
0x118600000000000000000474c564750220000........GLVGP"..
0x1187040434a22000000005156435056220000@CJ"....QVCPV"..
0x1188076714d5750414702674c454b4c470273vqMWPAG.gLEKLG.s
0x118905747505b220000000d4756410d504751WGP["....GVA.PGQ
0x118a04d4e540c414d4c442200000000000000MNT.AMLD".......
0x118b04c434f47514750544750022200000000LCOGQGPTGP."....
0x118c00d51404b4c0d554356414a464d452200[email protected]".
0x118d00d404b4c0d554356414a464d45220000[email protected]"..
0x118e00d4647540d64767566761312130d5543.FGT.dvufv....UC
0x118f056414a464d4522000d4647540d554356VAJFME"..FGT.UCV
0x11900414a464d451222000d4756410d464744AJFME."..GVA.FGD
0x1191043574e560d554356414a464d45220000CWNV.UCVAJFME"..
0x119200d4756410d554356414a464d45220000.GVA.UCVAJFME"..
⋯10 more rows