Hostile ^100% Download

violet.ppc

C2, persistence, hidden files

Cron with hidden file pathsNameless static ELF pins an external address

SHA-2568cb2b137d919deaf1f19f290dc0291136364ba8af65a14d3d9419e1ee39200f9

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(AsEr₃PDy)H₄(Cm₂DbF₃Os)Md₃(Bi₃BkHe)

Evidence

.text section exceeds 75% of binary size 0x78–0x308

⋯3 more rows
0xa880010024382100207c0803a64e800020...$8!. |...N.. 
0xb89421fff07c0802a693c100083fc01002.!..|.......?...
0xc890010014881eb3ac93e1000c2f800000............/...
⋯36 more rows

PowerPC socketcall connect operation wrapper 0x6710–0x6870

⋯3 more rows
0x67404e8000209421ffe07c0802a690610008N.. .!..|....a..
0x6750386000039081000c38810008900100248`......8......$
0x676090a10010480017e58001002438210020....H......$8!. 
⋯7 more rows
0x67e07c0803a64e8000209421ffe07c0802a6|...N.. .!..|...
0x67f0906100083860000a9081000c38810008.a..8`......8...
0x68009001002490a1001090c100144800173d...$........H..=
⋯7 more rows

PowerPC socketcall socket operation wrapper 0x68a0–0x6960

⋯3 more rows
0x68d04e8000209421ffe07c0802a690610008N.. .!..|....a..
0x68e0386000019081000c38810008900100248`......8......$
0x68f090a10010480016558001002438210020....H..U...$8!. 
⋯7 more rows

PowerPC Linux socketcall syscall wrapper 0x7f18–0x7fe8

⋯3 more rows
0x7f487c0802a69421fff093e1000c90010014|....!..........
0x7f5838000066440000027c000026740910008..fD...|..&t...
0x7f687c7f1b7841a200104bffcda593e30000|..xA...K.......
0x7f783860ffff8001001483e1000c382100108`..........8!..
⋯7 more rows

Pinned external IPv4 host literal in binary 0x9b50–0x9e00

⋯5 more rows
0x9ba0382100207c0803a64e800020000000008!. |...N.. ....
0x9bb02f746d702f2e76696f6c657400000000/tmp/.violet....
0x9bc02f70726f632f25642f65786500000000/proc/%d/exe....
0x9bd02863726f6e746162202d6c20323e2f64(crontab -l 2>/d
0x9be065762f6e756c6c3b206563686f202740ev/null; echo '@
0x9bf07265626f6f742025732025732729207creboot %s %s') |
0x9c002063726f6e746162202d20323e2f6465 crontab - 2>/de
0x9c10762f6e756c6c000025640a003137322ev/null..%d..172.
0x9c203234352e3130362e31343400436f6e6e245.106.144.Conn
0x9c30656374656420546f20434e430d0a0000ected To CNC....
0x9c4074656c6e657464002f00000076696f6ctelnetd./...viol
0x9c50657400002f7661722f72756e2f2e7669et../var/run/.vi
0x9c606f6c6574000000002f6d6e742f2e7669olet..../mnt/.vi
0x9c706f6c6574000000002f726f6f742f2e76olet..../root/.v
0x9c80696f6c65740000002f746d702f2e7669iolet.../tmp/.vi
0x9c906f6c65742e706964000000002f746d70olet.pid..../tmp
0x9ca02f2e76696f6c65742e7764002f746d70/.violet.wd./tmp
0x9cb02f2e76696f6c65742e63726f6e000000/.violet.cron...
0x9cc00f002f096c6f63616c686f737463dd01../.localhostc..
⋯5 more rows
0x9d206c2900002b002d002000307800305800l)..+.-. .0x.0X.
0x9d30101010080a0a0a00686c4c6a7a74715a........hlLjztqZ
0x9d400002040808000008000001081f000005................
0x9d500f000807000200040001000310000005................
0x9d600000000700020004000100030001070f................
0x9d7010111213150000006e7078586f756469........npxXoudi
0x9d8066466545674761414353637300000000fFeEgGaACScs....
0x9d90202b302d232749000008000500030004 +0-#'I.........
⋯7 more rows