Hostile ^100% Download

a0e7e5b25346340da9e58ac4fe8691409f8dbc99d1e2aa3f496c3f9b10016d8c

Mirai botnet malware

C2-tasked UDP plain-flood botNative binary embeds a download, chmod, and execute chain

SHA-256a0e7e5b25346340da9e58ac4fe8691409f8dbc99d1e2aa3f496c3f9b10016d8c

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₆(I₃AsC₂Dy₂ErP₂)H₅(Cm₁₆DbF₁₂Os₂Po₇)Md₄(Bi₂BkHe)

Evidence

Linux ARM64 direct SVC syscall instruction 0x73ec–0x74ac

⋯3 more rows
0x741c600c80125e000014007c4093280780d2`...^....|@.(...
0x742c010000d41f0440b1e90000540100a0d2[email protected]....
0x743c010380f242d03bd5e003004b406821b8....B.;....K@h!.
⋯7 more rows

Sends a process/thread signal via direct syscall 0x75b0–0x76e0

⋯10 more rows
0x7650f30b40f9fd7bc3a8c0035fd6007c4093..@..{...._..|@.
0x7660217c4093281080d2010000d41f0440b1!|@.(.........@.
0x7670e90000540100a0d2010380f242d03bd5...T........B.;.
⋯7 more rows

Connects socket to remote host 0xeb18–0xedc8

⋯3 more rows
0xeb48f51300f940020035e00313aa481980d2[email protected]...
0xeb58010000d41f0440b1e90000540100a0d2[email protected]....
0xeb68010380f242d03bd5e003004b406821b8....B.;....K@h!.
⋯6 more rows
0xebd8f303002ae003032ae80b0094e7ffff17...*...*........
0xebe8007c4093e203022a081980d2010000d4.|@....*........
0xebf81f0440b1e90000540100a0d2010380f2[email protected]........
0xec0842d03bd5e003004b406821b800008092B.;....K@h!.....
0xec18c0035fd6fd7bbda9fd030091f35301a9.._..{.......S..
0xec28147c4093a0090090001849b9f303022a.|@.......I....*
0xec38f51300f960020035e00314aae20313aa....`..5........
0xec48681980d2010000d41f0440b1e9000054[email protected]
0xec580100a0d2010380f242d03bd5e003004b........B.;....K
⋯13 more rows
0xed3800008092c0035fd6007c4093217c4093......_..|@.!|@.
0xed48281980d2010000d41f0440b1e9000054([email protected]
0xed580100a0d2010380f242d03bd5e003004b........B.;....K
⋯7 more rows

Creates network socket (Linux) 0xef80–0xf1b0

⋯7 more rows
0xeff0007c4093637c4093e503052ac81980d2.|@.c|@....*....
0xf000010000d41f0440b1e90000540100a0d2[email protected]....
0xf010010380f242d03bd5e003004b406821b8....B.;....K@h!.
⋯15 more rows
0xf110406821b800008092c0035fd6007c4093@h!......._..|@.
0xf120217c4093427c4093c81880d2010000d4!|@.B|@.........
0xf1301f0440b1e90000540100a0d2010380f2[email protected]........
0xf14042d03bd5e003004b406821b800008092B.;....K@h!.....
⋯7 more rows

Native binary embeds download then chmod 0x28e38–0x29128

⋯5 more rows
0x28e88c0035fd6000000002f70726f63000000.._...../proc...
0x28e982f70726f632f25732f636f6d6d000000/proc/%s/comm...
0x28ea82d736800000000002f6574632f696e69-sh...../etc/ini
0x28eb8742e6400000000007700000000000000t.d.....w.......
0x28ec82f6574632f696e69742e642f78732e6d/etc/init.d/xs.m
0x28ed861696e000000000023212f62696e2f73ain.....#!/bin/s
0x28ee8680a25732025730a0000000000000000h.%s %s.........
0x28ef82f6574632f72632e6c6f63616c000000/etc/rc.local...
0x28f08610000000000000025732025730a0000a.......%s %s...
0x28f184d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x28f28646f7773204e542031302e303b205769dows NT 10.0; Wi
0x28f386e36343b2078363429204170706c6557n64; x64) AppleW
0x28f4865624b69742f3533372e333620284b48ebKit/537.36 (KH
0x28f58544d4c2c206c696b65204765636b6f29TML, like Gecko)
0x28f68204368726f6d652f35382e302e333032 Chrome/58.0.302
0x28f78392e313130000000474554202f2048549.110...GET / HT
0x28f8854502f312e310d0a486f73743a202573TP/1.1..Host: %s
0x28f980d0a557365722d4167656e743a202573..User-Agent: %s
0x28fa80d0a436f6e6e656374696f6e3a206b65..Connection: ke
0x28fb865702d616c6976650d0a0d0a00000000ep-alive........
0x28fc8504f5354202f20485454502f312e310dPOST / HTTP/1.1.
0x28fd80a486f73743a2025730d0a557365722d.Host: %s..User-
0x28fe84167656e743a2025730d0a436f6e6e65Agent: %s..Conne
0x28ff86374696f6e3a206b6565702d616c6976ction: keep-aliv
0x29008650d0a436f6e74656e742d547970653ae..Content-Type:
0x29018206170706c69636174696f6e2f782d77 application/x-w
0x2902877772d666f726d2d75726c656e636f64ww-form-urlencod
0x2903865640d0a436f6e74656e742d4c656e67ed..Content-Leng
0x2904874683a2031360d0a0d0a646174613d72th: 16....data=r
0x29058616e646f6d5f646174610d0a00000000andom_data......
0x2906848454144202f20485454502f312e310dHEAD / HTTP/1.1.
0x290780a486f73743a2025730d0a557365722d.Host: %s..User-
0x290884167656e743a2025730d0a436f6e6e65Agent: %s..Conne
0x290986374696f6e3a206b6565702d616c6976ction: keep-aliv
0x290a8650d0a0d0a0000007767657400000000e.......wget....
0x290b82f70726f632f25732f636d646c696e65/proc/%s/cmdline
0x290c8000000000000000073362d7375706572........s6-super
0x290d876697365000000002f62696e2f000000vise..../bin/...
0x290e82f70726f632f25642f73746174000000/proc/%d/stat...
0x290f87200000000000000252a6420252a7320r.......%*d %*s 
0x29108252a6320256400002f70726f632f2573%*c %d../proc/%s
0x291182f73746174000000252a6420252a7320/stat...%*d %*s 
0x2912825630000000000002f70726f632f2573%c....../proc/%s