Hostile ^100% Download

b0b22e31d35e495e59d79f4fcfc2ae1c614336799f38c8195956fdddff3fb23a

Prometei botnet configuration

Encrypted parent-relay bot configurationPrometei packed Linux bot

SHA-256b0b22e31d35e495e59d79f4fcfc2ae1c614336799f38c8195956fdddff3fb23a

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₃(As₂CAl)H₃(Cm₂FOs)Md₃(Bi₄BkHe)Th

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e000100000050b65e0100000000..>.....P.^.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe0100000000000000056fc093955505821........V..9UPX!
0xf0fc0a0e1600000000b0a9130051041000............Q...
0x10070020000be00000008000000bbfb20ffp............. .
⋯15 more rows

Contains a /tmp/ or /var/tmp/ path 0x5af0f–0x5af9f

0x5af0fffbe90eb6c50a4f7a3f95ff50ffcbef2....lP...._.....
0x5af1f7871c61ecccf6a0072de4861736850ffxq....j.r.HashP.
0x5af2f7fd1ff6f77657250726f6a6563c06100...owerProjec.a.
0x5af3f2f746d702f64656275672e74786fdf9a/tmp/debug.txo..
0x5af4f6d200d0a4e26703c632f7374611e252am ..N&p<c/sta.%*
⋯5 more rows

ELF embeds a cleartext http:// URL 0x6c75e–0x6c96e

⋯3 more rows
0x6c78e89395b5dc3681e0000005ae81e000000.9[].h....Z.....
0x6c79e50524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x6c7ae52495445206661696c65642e0a005e6aRITE failed...^j
0x6c7be025f6a01580f056a7f5f6a3c580f050a._j.X..j._j<X...
0x6c7ce0024496e666f3a20546869732066696c.$Info: This fil
0x6c7de65206973207061636b65642077697468e is packed with
0x6c7ee20746865205550582065786563757461 the UPX executa
0x6c7fe626c65207061636b657220687474703able packer http:
0x6c80e2f2f7570782e73662e6e657420240a00//upx.sf.net $..
0x6c81e2449643a2055505820342e323420436f$Id: UPX 4.24 Co
0x6c82e70797269676874202843292031393936pyright (C) 1996
⋯6 more rows
0x6c89e514d29c94183c8ff6a22415a525e6a03QM).A...j"AZR^j.
0x6c8ae5a29ff6a09580f054889442410505a53Z).j.X..H.D$.PZS
0x6c8be5ead504889e14989d5ad50ad41904889^.PH..I...P.A.H.
0x6c8cef75effd559488b742418488b7c24106a.^..YH.t$.H.|$.j
0x6c8de055a6a0a580f0541ffe55de87effffff.Zj.X..A..].~...
0x6c8ee2f70726f632f73656c662f6578650000/proc/self/exe..
0x6c8fe0100002d0c00003008000008000000ff...-...0........
⋯7 more rows

Prometei Linux bot configuration 0x6d871–0x6da31

⋯7 more rows
0x6d8e1d80600b0a91300492a004cf40000007b.......I*.L....{
0x6d8f122636f6e666967223a312c226964223a"config":1,"id":
0x6d90122533730464644333670454441344246"S70FFD36pEDA4BF
0x6d91166222c22656e636b6579223a22672b49f","enckey":"g+I
0x6d92137423971785254434b2f3672757456597B9qxRTCK/6rutVY
0x6d9317778684a506b766275524d516348784dwxhJPkvbuRMQcHxM
0x6d94142496f304456564b32686b6d345a3158BIo0DVVK2hkm4Z1X
0x6d9515a436f694b396d517372366765593257ZCoiK9mQsr6geY2W
0x6d961477651735a5472513367515468474674GvQsZTrQ3gQThGFt
0x6d9715937504d4d554149347158366f647544Y7PMMUAI4qX6oduD
⋯3 more rows
0x6d9b14559686f7a6732696e68454941553975EYhozg2inhEIAU9u
0x6d9c16e6c51536f5042453d222c2250617265nlQSoPBE=","Pare
0x6d9d16e744964223a223851344d574b305931ntId":"8Q4MWK0Y1
0x6d9e1373239343548324856222c226970223a72945H2HV","ip":
0x6d9f12234352e35352e3132312e313731222c"45.55.121.171",
0x6da0122506172656e744970223a22372e372e"ParentIp":"7.7.
0x6da11372e313431222c22506172656e74486f7.141","ParentHo
0x6da2173746e616d65223a2246494e4b414f4bstname":"FINKAOK
0x6da31554c227d2c                      UL"},           