Hostile ^100% Download

ac66d94b43a1c5ac2c60064b07f42f27470b5fc42955e147cac90c566fabc3be

C2, persistence, obfuscation, botnet

BusyBox invoked with bot marker nameMalformed ELF header or section headers:

SHA-256ac66d94b43a1c5ac2c60064b07f42f27470b5fc42955e147cac90c566fabc3be

URLhttps://tria.ge/api/v0/samples/261001-hvdgfavxgv/sample

MaleculeO₅(As₂C₄I₂LaP₃)H₆(Cm₁₄Db₃F₈Os₂Po₂U₄)Md₃(ArBi₂)Th

Evidence

ARM architecture from ELF header bytes 0x0–0x180

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x2050b00400020000043400200005002800P.......4. ...(.
⋯7 more rows
0xa004100500000000000800000004000000................
0xb00400000051e574640000000000000000....Q.td........
0xc000000000000000000000000007000000................
0xd0040000000dc0a0e1f0df2de904b04ce2..........-...L.
⋯11 more rows

Native S-number init script 0x35408–0x35688

⋯3 more rows
0x354382e736800257325732573257300000000.sh.%s%s%s%s....
0x3544823212f62696e2f73680000002f6d6e74#!/bin/sh.../mnt
0x354582f6a666673322f776966692e73680000/jffs2/wifi.sh..
⋯4 more rows
0x354a800000000727700002f6465762f000000....rw../dev/...
0x354b86d74640077620000726200002f62696emtd.wb..rb../bin
0x354c82f7368002f62696e2f62617368000000/sh./bin/bash...
0x354d82f6574632f72632e642f00002f657463/etc/rc.d/../etc
0x354e82f7263532e642f002573257325732573/rcS.d/.%s%s%s%s
0x354f825730000232100002f6574632f696e69%s..#!../etc/ini
0x35508742e642f533935626162792e73680000t.d/S95baby.sh..
0x3551869707461626c6573202d4920494e5055iptables -I INPU
⋯12 more rows
0x355e8524f50002f7573722f6c6f63616c2f63ROP./usr/local/c
0x355f874000000726d202f686f6d652f687474t...rm /home/htt
0x3560870642f7765625f7368656c6c5f636d64pd/web_shell_cmd
0x356182e676368000000006563686f2033203e.gch....echo 3 >
⋯7 more rows

External IPv4 endpoint string in ELF 0x35d18–0x35fc8

0x35d186174202d7020756470202d2d73706f72at -p udp --spor
0x35d2874202564202d6a204143434550540000t %d -j ACCEPT..
0x35d38302e302e302e30005b6964705d0000000.0.0.0.[idp]...
0x35d4854686973206e6f646520646f65736e27This node doesn'
0x35d58742061636365707420616e6e6f756e63t accept announc
⋯6 more rows
0x35dc861636b65722e64656269616e2e6f7267acker.debian.org
0x35dd83a363838310000003231322e3132392e:6881...212.129.
0x35de833332e35393a36383831000038322e3233.59:6881..82.2
0x35df832312e3130332e3234343a363838310021.103.244:6881.
0x35e083133302e3233392e31382e3135393a36130.239.18.159:6
0x35e183838310038372e39382e3136322e3838881.87.98.162.88
0x35e283a36383831004e665a8f80c8ac238dac:6881.NfZ....#..
0x35e384706d54f6f7e4d6ec63bf08c8faa85e7G..Oo~Mn.;......
⋯11 more rows
0x35ef866756e6374696f6e2054696d656f7574function Timeout
0x35f082829207b20646f63756d656e742e6c6f() { document.lo
0x35f18636174696f6e2e68726566203d20646fcation.href = do
0x35f2863756d656e742e55524c202b20287e64cument.URL + (~d
⋯10 more rows

Reference to /etc/default/watchdog 0x36b48–0x36d78

⋯3 more rows
0x36b7874202564202d6a204143434550540000t %d -j ACCEPT..
0x36b882f70726f632f25642f73746174757300/proc/%d/status.
0x36b98252a7320257300002f6465762f776174%*s %s../dev/wat
0x36ba86368646f670000002f6465762f776174chdog.../dev/wat
0x36bb86368646f673000002f6465762f6d6973chdog0../dev/mis
0x36bc8632f7761746368646f6700002f657463c/watchdog../etc
0x36bd82f7761746368646f670000002f646576/watchdog.../dev
0x36be82f46545744543130315f776174636864/FTWDT101_watchd
0x36bf86f6700002f6465762f46545744543130og../dev/FTWDT10
0x36c08315c207761746368646f67002f6465761\ watchdog./dev
0x36c182f46545744543130312f776174636864/FTWDT101/watchd
0x36c286f6700002f7362696e2f776174636864og../sbin/watchd
0x36c386f6700002f62696e2f7761746368646fog../bin/watchdo
0x36c48670000002f6574632f64656661756c74g.../etc/default
0x36c582f7761746368646f670000002f70726f/watchdog.../pro
0x36c68632f6e65742f7261770000002f70726fc/net/raw.../pro
0x36c78632f6e65742f7463700000002f666400c/net/tcp.../fd.
0x36c8862696e2f00000000696e697400000000bin/....init....
0x36c982e690000737368640000000052756e6e.i..sshd....Runn
0x36ca80000000064726f706265617200000000....dropbear....
0x36cb86b696c6c616c6c202d39202573000000killall -9 %s...
0x36cc82e697073000000002025643a2025783a.ips.... %d: %x:
⋯5 more rows
0x36d287020746370202d2d64657374696e6174p tcp --destinat
0x36d38696f6e2d706f7274203232202d6a2044ion-port 22 -j D
0x36d48524f500069707461626c6573202d4920ROP.iptables -I 
⋯3 more rows

BusyBox invoked with bot marker name 0x370c0–0x37370

⋯5 more rows
0x37110faffbe90eb6c50a4f7a3f9bef27871c6.....lP......xq.
0x37120414c410c414a434c45474f470c414d4fALA.AJCLEGOG.AMO
0x3713022000000223500005047524d50560c41"..."5..PGRMPV.A
0x371404a434c45474f470c414d4f2200000000JCLEGOG.AMO"....
0x3715099c700004e4b5156474c4b4c45025657....NKQVGLKLE.VW
0x371604c1222004a56565251180d0d5b4d5756L.".JVVRQ...[MWV
0x37170570c40470d46735516551b75457a4173[email protected]
0x37180220000000d52504d410d22000d475a47"....RPMA."..GZG
⋯4 more rows
0x371d0646e6d6d662200006e6d6e6c6d657664dnmmf"..nmnlmevd
0x371e06d2200007e5a171a7e5a16667e5a1667m"..~Z..~Z.f~Z.g
0x371f07e5a16677e5a16117e5a17127e5a1614~Z.g~Z..~Z..~Z..
0x372007e5a101022000000584d4e4e43504622~Z.."...XMNNCPF"
0x37210000000006567766e6d61636e6b722200....egvnmacnkr".
0x37220514a474e4e220000474c43404e472200QJGNN"..GLC@NG".
0x37230515b5156474f2200514a22000d404b4cQ[QVGO".QJ"..@KL
0x372400d4057515b404d5a026f6b70636b2200.@WQ[@MZ.okpck".
0x372506f6b70636b18024352524e4756024c4dokpck..CRRNGV.LM
0x372605602444d574c4622000000004c414d50V.DMWLF"....LAMP
0x3727050474156220000000d404b4c0d405751PGAV"....@KL.@WQ
0x372805b404d5a02525122000000000d404b4c[@MZ.RQ".....@KL
0x372900d4057515b404d5a02494b4e4e020f1b.@WQ[@MZ.IKNN...
0x372a00222000076714d5750414702674c454b."..vqMWPAG.gLEK
0x372b04c4702735747505b220000000d475641LG.sWGP["....GVA
0x372c00d5047514d4e540c414d4c4422000000.PGQMNT.AMLD"...
0x372d04c434f47514750544750022200000000LCOGQGPTGP."....
0x372e0614d4c4c4741564b4d4c180249474752aMLLGAVKML..IGGR
⋯9 more rows