Hostile ^100% Download

Owari.mips

Mirai botnet malware

MIPS pinned-host C2 with TCP inspectionStatic MIPS watchdog bot with an encoded Source-query flood payload

SHA-2569ffeff5b87ce795e6e6ce828a2d9535a78ebc14565fc7f7973fc97f9dee3d9d1

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McTe)O₄(CIAsLa)H₄(F₇Po₃Cm₄Os)Md₃(Bi₃BkHe)

Evidence

MIPS machine field in ELF header 0x0–0x2f0

0x07f454c46010201000000000000000000.ELF............
0x1000020008000000010040026000000034.........@.`...4
0x200001154c000010070034002000030028...L.....4. ...(
⋯45 more rows

Big-endian MIPS direct system-call instruction 0xcbb4–0xcde4

⋯7 more rows
0xcc248fbc00101000000b0000000024020fd7............$...
0xcc340000000c8f99813810e0000600408021.......8.....@.!
0xcc440320f809000000008fbc0010ac500000. ...........P..
⋯15 more rows
0xcd44279cc4600399e02127bdffe0afbf001c'..`...!'.......
0xcd54afb00018afbc001024020fa20000000c........$.......
0xcd648f99813810e00006004080210320f809...8.....@.!. ..
0xcd74000000008fbc0010ac5000002402ffff.........P..$...
⋯7 more rows

Big-endian MIPS direct connect syscall 0xdbec–0xdcbc

⋯3 more rows
0xdc1c27bdffe0afbf001cafb00018afbc0010'...............
0xdc2c2402104a0000000c8f99813810e00006$..J.......8....
0xdc3c004080210320f809000000008fbc0010.@.!. ..........
0xdc4cac5000002402ffff8fbf001c8fb00018.P..$...........
⋯7 more rows

Big-endian MIPS direct socket syscall 0xdfcc–0xe09c

⋯3 more rows
0xdffc27bdffe0afbf001cafb00018afbc0010'...............
0xe00c240210570000000c8f99813810e00006$..W.......8....
0xe01c004080210320f809000000008fbc0010.@.!. ..........
0xe02cac5000002402ffff8fbf001c8fb00018.P..$...........
⋯7 more rows

Alternate watchdog device path 0x105c7–0x108b7

⋯5 more rows
0x1061710000000008fbf001c0000000003e000................
0x106270827bd0020000000002f000000783939.'.. ..../...x99
0x10637782e6475636b646e732e6f7267000000x.duckdns.org...
0x106470039342e32362e3130362e3332000000.94.26.106.32...
0x10657000a0000000000000000000001000000................
⋯4 more rows
0x106a790fffb1390fffb1604fffb1590fffa1f................
0x106b700500018fff0000000fffb1f002c6d6d.P...........,mm
0x106c72c7a3021373f303a277a3b2633540000,z0!7?0:'z;&3T..
0x106d700539b0000445200001b0315061d646d.S...DR.......dm
0x106e76566673d306d3d6566672c306d656654efg=0m=efg,0mefT
0x106f700273c313838540000313a3536383154.'<188T..1:5681T
0x1070700272d272031395400273c54007b363d.'-' 19T.'<T.{6=
0x107173a7b3621272d363b2c741b0315061d54:{6!'-6;,t.....T
0x10727001b0315061d6e74352424383120743a......nt5$$81 t:
0x107373b2074323b213a3054000000003a373b; t2;!:0T....:7;
0x107472626313720540000007b363d3a7b3621&&17 T...{6=:{6!
0x10757272d363b2c74242754000000007b363d'-6;,t$'T....{6=
0x107673a7b3621272d363b2c743f3d38387479:{6!'-6;,t?=88ty
0x107776d745400007b24263b377b54007b312cmtT..{$&;7{T.{1,
0x1078731540000007b323054000000007b39351T...{20T....{95
0x1079724275400007b24263b377b3a31207b20$'T..{$&;7{:1 { 
0x107a737245400007b272035202127540000007$T..{' 5 !'T...
0x107b7007a353a3d393154007b24263b377b3a.z5:=91T.{$&;7{:
0x107c731207b263b21203154000000003527271 {&;! 1T....5''
0x107d7233b263054000000007b3120377b2631#;&0T....{1 7{&1
0x107e7273b38227a373b3a32540000003a3539';8"z7;:2T...:59
0x107f7312731262231267454000000007b30311'1&"1&tT....{01
0x10807227b233520373c303b335400007b3031"{#5 7<0;3T..{01
0x10817227b393d27377b233520373c303b3354"{9='7{#5 7<0;3T
0x1082700243636322a372145000000003b333d.$662*7!E....;3=
0x108373a54000000313a2031265400006d2165:T...1: 1&T..m!e
0x10847666760606c2165666035216c65603060fg``l!ef`5!le`0`
0x108572c656454000000000000073b21263731,edT.......;!&71
0x1086774113a333d3a3174052131262d540000t.:3=:1t.!1&-T..
0x10877000000000000000000fffb47acfffb47...........G...G
0x10887bcfffb4734fffb4748fffb475cfffb47...G4..GH..G\..G
0x1089770fffb4784fffb47982f6465762f6e75p..G...G./dev/nu
0x108a76c6c0000000000000000000000000000ll..............
0x108b700000000000000000000000000000000................