Hostile ^100% Download

9fa5154073d4ce91fd659d8477b26a5f85c1259f18d950e4f3a4efa6e3452d5d

Prometei botnet configuration

Encrypted parent-relay bot configurationPrometei packed Linux bot

SHA-2569fa5154073d4ce91fd659d8477b26a5f85c1259f18d950e4f3a4efa6e3452d5d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₃(As₂CAl)H₃(Cm₂FOs)Md₃(Bi₄BkHe)Th

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e000100000050b65e0100000000..>.....P.^.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe0100000000000000056fc093955505821........V..9UPX!
0xf0fc0a0e1600000000b0a9130051041000............Q...
0x10070020000be00000008000000bbfb20ffp............. .
⋯15 more rows

Contains a /tmp/ or /var/tmp/ path 0x5af0f–0x5af9f

0x5af0fffbe90eb6c50a4f7a3f95ff50ffcbef2....lP...._.....
0x5af1f7871c61ecccf6a0072de4861736850ffxq....j.r.HashP.
0x5af2f7fd1ff6f77657250726f6a6563c06100...owerProjec.a.
0x5af3f2f746d702f64656275672e74786fdf9a/tmp/debug.txo..
0x5af4f6d200d0a4e26703c632f7374611e252am ..N&p<c/sta.%*
⋯5 more rows

ELF embeds a cleartext http:// URL 0x6c75e–0x6c96e

⋯3 more rows
0x6c78e89395b5dc3681e0000005ae81e000000.9[].h....Z.....
0x6c79e50524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x6c7ae52495445206661696c65642e0a005e6aRITE failed...^j
0x6c7be025f6a01580f056a7f5f6a3c580f050a._j.X..j._j<X...
0x6c7ce0024496e666f3a20546869732066696c.$Info: This fil
0x6c7de65206973207061636b65642077697468e is packed with
0x6c7ee20746865205550582065786563757461 the UPX executa
0x6c7fe626c65207061636b657220687474703able packer http:
0x6c80e2f2f7570782e73662e6e657420240a00//upx.sf.net $..
0x6c81e2449643a2055505820342e323420436f$Id: UPX 4.24 Co
0x6c82e70797269676874202843292031393936pyright (C) 1996
⋯6 more rows
0x6c89e514d29c94183c8ff6a22415a525e6a03QM).A...j"AZR^j.
0x6c8ae5a29ff6a09580f054889442410505a53Z).j.X..H.D$.PZS
0x6c8be5ead504889e14989d5ad50ad41904889^.PH..I...P.A.H.
0x6c8cef75effd559488b742418488b7c24106a.^..YH.t$.H.|$.j
0x6c8de055a6a0a580f0541ffe55de87effffff.Zj.X..A..].~...
0x6c8ee2f70726f632f73656c662f6578650000/proc/self/exe..
0x6c8fe0100002d0c00003008000008000000ff...-...0........
⋯7 more rows

Prometei Linux bot configuration 0x6d871–0x6da31

⋯7 more rows
0x6d8e1d80600b0a91300492a004cf40000007b.......I*.L....{
0x6d8f122636f6e666967223a312c226964223a"config":1,"id":
0x6d9012276373034366e44634f6f36484b3936"v7046nDcOo6HK96
0x6d91178222c22656e636b6579223a224d5751x","enckey":"MWQ
0x6d921664b4276344f6a4b6b48626c68463364fKBv4OjKkHblhF3d
0x6d931544b524a2f47343746326b55524d4556TKRJ/G47F2kURMEV
0x6d94155514734766868776731614f64304a57UQG4vhhwg1aOd0JW
0x6d95165396267336f66754e55504b47433074e9bg3ofuNUPKGC0t
0x6d9614646534166626b6c736762377855754bFFSAfbklsgb7xUuK
0x6d971455a396b5465564d3853555454424844EZ9kTeVM8SUTTBHD
⋯3 more rows
0x6d9b1637a7a486e486d5051676b6378573532czzHnHmPQgkcxW52
0x6d9c1664668386c4341383d222c2250617265fFh8lCA8=","Pare
0x6d9d16e744964223a22463737595743513931ntId":"F77YWCQ91
0x6d9e14c3742384a36394856222c226970223aL7B8J69HV","ip":
0x6d9f1223135372e3233302e3233362e313933"157.230.236.193
0x6da01222c22506172656e744970223a223139","ParentIp":"19
0x6da11322e3136382e312e33222c22506172652.168.1.3","Pare
0x6da216e74486f73746e616d65223a2257494entHostname":"WIN
0x6da312d344143394838344b363734227d2c  -4AC9H84K674"}, 