Suspicious ^80% Download

manji.m68k

Persistence, evasion, network, obfuscation

Unix ELF TracerPid debugger checkMotorola 68000 machine field in ELF header

SHA-2569fac920ecdd87beb16bcacb5836f7f91adbb2c5325467037ce3c5692cc7f1be4

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(AlAsDyP₄)H₅(Cm₂Db₂F₈Os₆Po₄)Md₃(ArBi₂He)

Evidence

Motorola 68000 machine field in ELF header 0x0–0x2f0

0x07f454c46010201000000000000000000.ELF............
0x1000020004000000018000014400000034...........D...4
0x2000018358000000000034002000030028...X.....4. ...(
⋯45 more rows

ARM supervisor-call syscall instruction 0x7bae–0x7c6e

⋯3 more rows
0x7bde0008226e000c262e001024092208203c.."n..&...$.". <
0x7bee000000ef4e402d40fff8202efff87282....N@-@.. ...r.
0x7bfeb280641a202efff844802d40fffc61ff..d. [email protected].
⋯7 more rows

Direct m68k fork syscall wrapper 0x7d6c–0x7e4c

⋯3 more rows
0x7d9cfffc72ff2d41fff8202efff84e5e4e75..r.-A.. ...N^Nu
0x7dac4e56fff870024e402d40fff8202efff8NV..p.N@-@.. ...
0x7dbc7282b280641a202efff844802d40fffcr...d. ...D.-@..
0x7dcc61ff00000b3620aefffc72ff2d41fff8a....6 ...r.-A..
0x7ddc202efff84e5e4e754e56fff870144e40 ...N^NuNV..p.N@
⋯7 more rows

Direct m68k kill syscall wrapper 0x7efc–0x7fdc

⋯3 more rows
0x7f2cfff8202efff84e5e4e754e754e56fff8.. ...N^NuNuNV..
0x7f3c2f02206e0008242e000c220870254e40/. n..$...".p%N@
0x7f4c2d40fff8202efff87282b280641a202e-@.. ...r...d. .
0x7f5cfff844802d40fffc61ff0000099e20ae[email protected]..... .
0x7f6cfffc72ff2d41fff8202efff8242efff4..r.-A.. ...$...
⋯7 more rows

References own process status procfs path 0x155d7–0x158c7

⋯3 more rows
0x156076c6d6e6f707172737475767778797a00lmnopqrstuvwxyz.
0x156172f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x15627002f70726f632f2564002f70726f632f./proc/%d./proc/
0x1563773656c660064697675732d6368656174self.divus-cheat
0x15647732e636f6d002f70726f632f73656c66s.com./proc/self
0x156572f657865002f70726f632f637075696e/exe./proc/cpuin
0x15667666f0063707520636f72657300000000fo.cpu cores....
0x156770300000102030405060708090a0b0c0d................
⋯8 more rows
0x1570773722f7362696e002f7573722f6c6962sr/sbin./usr/lib
0x15717002f70726f632f6d6f756e747300252a./proc/mounts.%*
0x1572773202532353573202536337300746d70s %255s %63s.tmp
0x1573766730072616d66730025732f2573002ffs.ramfs.%s/%s./
0x15747657463002f6574632f73797374656d64etc./etc/systemd
0x157572f73797374656d002f6574632f737973/system./etc/sys
0x1576774656d642f73797374656d2f25732e73temd/system/%s.s
0x157776572766963650077005b556e69745d0aervice.w.[Unit].
⋯3 more rows
0x157b7740a0a005b536572766963655d0a0054t...[Service]..T
0x157c77970653d73696d706c650a0045786563ype=simple..Exec
0x157d753746172743d25730a00526573746172Start=%s..Restar
0x157e7743d616c776179730a00526573746172t=always..Restar
0x157f7745365633d31300a0a005b496e737461tSec=10...[Insta
0x158076c6c5d0a0057616e74656442793d6d75ll]..WantedBy=mu
0x158176c74692d757365722e7461726765740alti-user.target.
0x158270073797374656d63746c20656e61626c.systemctl enabl
0x15837652025732e73657276696365203e2f64e %s.service >/d
0x1584765762f6e756c6c20323e2631207c7c20ev/null 2>&1 || 
0x1585774727565000a23204175746f2d616464true..# Auto-add
0x15867656420736572766963650a0025732026ed service..%s &
0x158770a0063726f6e746162202d6c20323e2f..crontab -l 2>/
0x158876465762f6e756c6c002863726f6e7461dev/null.(cronta
0x1589762202d6c20323e2f6465762f6e756c6cb -l 2>/dev/null
0x158a73b206563686f2027407265626f6f7420; echo '@reboot 
0x158b7257320262729207c2063726f6e746162%s &') | crontab
0x158c7202d002f6574632f696e69742e64002f -./etc/init.d./