Hostile ^100% Download

m-p.s-l.SNOOPY

Gafgyt botnet malware

Hardcoded-endpoint C2 DDoS command botNative multi-vector attack function cluster

SHA-256b7a91c8f10e64ce50ed08bacb03930d1e21af876463f005ec4b11f3ed5f59adf

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(Mc₂Li)O₃(CI₂Dy)H₄(Cm₆DbF₄Os)Md₂(Bi₂Bk)

Evidence

External IPv4 endpoint string in ELF 0x11cf0–0x11fe0

⋯6 more rows
0x11d50000000001000bc8f000000001c00bf8f................
0x11d60000000000800e0032000bd2700000000........ ..'....
0x11d703137362e36352e3133392e3135313a38176.65.139.151:8
0x11d80333900004d6f7a696c6c612f352e302039..Mozilla/5.0 
0x11d902857696e646f7773204e542031302e30(Windows NT 10.0
0x11da03b2057696e36343b2078363429204170; Win64; x64) Ap
0x11db0706c655765624b69742f3533372e3336pleWebKit/537.36
0x11dc020284b48544d4c2c206c696b65204765 (KHTML, like Ge
0x11dd0636b6f29204368726f6d652f36302e30cko) Chrome/60.0
0x11de02e333131322e31313320536166617269.3112.113 Safari
0x11df02f3533372e3336004d6f7a696c6c612f/537.36.Mozilla/
0x11e00352e30202857696e646f7773204e54205.0 (Windows NT 
0x11e10362e313b2057696e36343b20783634296.1; Win64; x64)
0x11e20204170706c655765624b69742f353337 AppleWebKit/537
0x11e302e333620284b48544d4c2c206c696b65.36 (KHTML, like
0x11e40204765636b6f29204368726f6d652f36 Gecko) Chrome/6
0x11e50302e302e333131322e393020536166610.0.3112.90 Safa
0x11e6072692f3533372e33360000004d6f7a69ri/537.36...Mozi
0x11e706c6c612f352e3020285831313b204c69lla/5.0 (X11; Li
0x11e806e7578207838365f363429204170706cnux x86_64) Appl
0x11e90655765624b69742f3533372e33362028eWebKit/537.36 (
0x11ea04b48544d4c2c206c696b65204765636bKHTML, like Geck
0x11eb06f29204368726f6d652f34342e302e32o) Chrome/44.0.2
0x11ec03430332e313537205361666172692f35403.157 Safari/5
0x11ed033372e33360000004d6f7a696c6c612f37.36...Mozilla/
0x11ee0352e30202857696e646f7773204e54205.0 (Windows NT 
0x11ef0352e3129204170706c655765624b69745.1) AppleWebKit
0x11f002f3533372e333620284b48544d4c2c20/537.36 (KHTML, 
0x11f106c696b65204765636b6f29204368726flike Gecko) Chro
0x11f206d652f34362e302e323439302e373120me/46.0.2490.71 
0x11f305361666172692f3533372e3336000000Safari/537.36...
0x11f404d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x11f50646f7773204e542031302e303b205769dows NT 10.0; Wi
0x11f606e36343b2078363429204170706c6557n64; x64) AppleW
0x11f7065624b69742f3533372e333620284b48ebKit/537.36 (KH
0x11f80544d4c2c206c696b65204765636b6f29TML, like Gecko)
0x11f90204368726f6d652f36392e302e333439 Chrome/69.0.349
0x11fa0372e313030205361666172692f3533377.100 Safari/537
0x11fb02e3336004d6f7a696c6c612f352e3020.36.Mozilla/5.0 
0x11fc02857696e646f7773204e542031302e30(Windows NT 10.0
0x11fd03b2057696e36343b2078363429204170; Win64; x64) Ap
0x11fe0706c655765624b69742f3533372e3336pleWebKit/537.36

Cloudflare chk_captcha bypass URI 0x1236a–0x1256a

⋯3 more rows
0x1239a8f989c8f98ea00000000257320257320..........%s %s 
0x123aa485454502f312e310d0a486f73743a20HTTP/1.1..Host: 
0x123ba25730d0a557365722d4167656e743a20%s..User-Agent: 
0x123ca25730d0a436f6e6e656374696f6e3a20%s..Connection: 
0x123da636c6f73650d0a0d0a002573202f6364close.....%s /cd
0x123ea6e2d6367692f6c2f63686b5f63617074n-cgi/l/chk_capt
0x123fa63686120485454502f312e310d0a486fcha HTTP/1.1..Ho
0x1240a73743a2025730d0a557365722d416765st: %s..User-Age
⋯7 more rows
0x1248a0000556e6b6e6f776e20506f72740000..Unknown Port..
0x1249a00005443500055445000485454505354..TCP.UDP.HTTPST
0x124aa4f4d5000000056534500535444484558OMP...VSE.STDHEX
0x124ba000053544f500000000073746f700000..STOP....stop..
⋯11 more rows

initConnection network setup function name 0x1a965–0x1aae5

⋯7 more rows
0x1a9d5726561645f6d757465785f6c6f636b00read_mutex_lock.
0x1a9e5696e6974436f6e6e656374696f6e005finitConnection._
0x1a9f55f73696764656c736574005f5f75436c_sigdelset.__uCl
⋯15 more rows

Valve Source Engine attack function name 0x1ab3a–0x1ac5a

⋯5 more rows
0x1ab8a53656e645544500066636e746c363400SendUDP.fcntl64.
0x1ab9a76736561747461636b006d656d637079vseattack.memcpy
0x1abaa006d616b6552616e646f6d5374720067.makeRandomStr.g
⋯11 more rows

SendSTDHEX function name in ELF symbols 0x1afee–0x1b10e

⋯5 more rows
0x1b03e6b6f7074006273645f7369676e616c00kopt.bsd_signal.
0x1b04e53656e6453544448455800667365656bSendSTDHEX.fseek
0x1b05e005f5f47495f6d656d6d6f7665007365.__GI_memmove.se
⋯11 more rows