Hostile ^100% Download

net.arm

Persistence, evasion, network C2

Native ARM implant authors a self-respawning systemd unitNative ARM implant combines systemd persistence with shell staging

SHA-256b8c25f4cb6f3319e0c6e80ae637eb1a84529a2267e308a7d1f7aa5f608d95ae6

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(AmLi)O₇(AsP₄CEr₃IDyLa)H₅(Db₂Cm₉F₈Os₅Po₄)Md₅(ArBi₃BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x2f0

0x07f454c46010101610000000000000000.ELF...a........
0x1002002800010000009081000034000000..(.........4...
0x201cf50200020200003400200003002800........4. ...(.
⋯45 more rows

Binary HTTP GET path fragment 0x280c0–0x283b0

⋯7 more rows
0x281302f0000006e65742e61726d0061000000/...net.arm.a...
0x281402f70726f632f73656c662f6578650000/proc/self/exe..
0x281503100584f520a4080ff0000201072ffff1.XOR.@.... .r..
⋯8 more rows
0x281e0eb18cb2b19004b021500401fb8220000...+..K...@.."..
0x281f0474554202f20485454502f312e310d0aGET / HTTP/1.1..
0x28200486f73743a206c6f63616c686f73740dHost: localhost.
0x282100a557365722d4167656e743a204d6f7a.User-Agent: Moz
0x28220696c6c612f352e300d0a416363657074illa/5.0..Accept
0x282303a202a2f2a0d0a436f6e6e656374696f: */*..Connectio
0x282406e3a206b6565702d616c6976650d0a0dn: keep-alive...
0x282500a000000504f5354202f617069204854....POST /api HT
0x2826054502f312e310d0a486f73743a206c6fTP/1.1..Host: lo
0x2827063616c686f73740d0a436f6e74656e74calhost..Content
0x282802d547970653a206170706c6963617469-Type: applicati
0x282906f6e2f6a736f6e0d0a436f6e74656e74on/json..Content
0x282a02d4c656e6774683a20320d0a0d0a7b7d-Length: 2....{}
0x282b000000000474554202f7365617263683f....GET /search?
0x282c0713d7465737420485454502f312e310dq=test HTTP/1.1.
0x282d00a486f73743a206c6f63616c686f7374.Host: localhost
0x282e00d0a436f6e6e656374696f6e3a206b65..Connection: ke
0x282f065702d616c6976650d0a0d0a00000000ep-alive........
0x2830048454144202f20485454502f312e310dHEAD / HTTP/1.1.
0x283100a486f73743a206c6f63616c686f7374.Host: localhost
⋯6 more rows
0x283805345540d0a24330d0a6b65790d0a2435SET..$3..key..$5
0x283900d0a76616c75650d0a0000005353482d..value.....SSH-
0x283a0322e302d4f70656e5353485f382e32702.0-OpenSSH_8.2p
0x283b031205562756e74752d347562756e74751 Ubuntu-4ubuntu

Source Engine query payload 0x2846c–0x2875c

⋯3 more rows
0x2849c000000006b657900c8030300dc030300....key.........
0x284ac2f70726f632f637075696e666f000000/proc/cpuinfo...
0x284bc70726f636573736f7200000030000000processor...0...
⋯5 more rows
0x2851c6f726400736f757263656c6974657632ord.sourcelitev2
0x2852c00ffffffff54536f7572636520456e67.....TSource Eng
0x2853c696e65205175657279000000db050300ine Query.......
0x2854c0f000000a8750000ea05030041000000.....u......A...
⋯20 more rows
0x2869c30000000202864656c657465642900000... (deleted)..
0x286ac2f7661722f746d702f2e000023212f62/var/tmp/...#!/b
0x286bc696e2f73680a00007768696c65207472in/sh...while tr
0x286cc75653b20646f0a002020202069662021ue; do..    if !
0x286dc207067726570202d66206e65745c2e78 pgrep -f net\.x
0x286ec38365f3634203e2f6465762f6e756c6c86_64 >/dev/null
⋯3 more rows
0x2872c66690a0020202020736c656570203230fi..    sleep 20
0x2873c0a000000646f6e650a0000002f766172....done..../var
0x2874c2f746d702f2e7379735f7265636f7665/tmp/.sys_recove
0x2875c72792e736800000063686d6f64202b78ry.sh...chmod +x

Doubly-encoded secret 0x29128–0x292b8

⋯7 more rows
0x291983855297e687d6a616d666e09000000008U)~h}jamfn.....
0x291a86d6b714e4a7a42476d3c583a6378453fmkqNJzBGm<X:cxE?
0x291b87a7b7b7070506a3d4a4e6d626c4e7031z{{ppPj=JNmblNp1
0x291c809000000584f5200000000002f62696e....XOR...../bin
0x291d8732f6e65742e00004745542000000000s/net...GET ....
0x291e820485454502f312e300d0a486f73743a HTTP/1.0..Host:
0x291f82000000025642e25642e25642e256400 ...%d.%d.%d.%d.
⋯12 more rows

Unusual character combinations 0x2a398–0x2a508

⋯5 more rows
0x2a3e8180019001a001b001c001d001e001f00................
0x2a3f820002100220023002400250026002700 .!.".#.$.%.&.'.
0x2a408280029002a002b002c002d002e002f00(.).*.+.,.-.../.
⋯16 more rows