Hostile ^100% Download

bb683292dc1d404c7fdcbd7b4d1dafd9e7981280580f0ae374f7620114452db5.elf

C2, memfd exec, evasion

Bytewise XOR decoded anonymous stage loaderRaw-socket payload written to memfd and executed without a disk file

SHA-256bb683292dc1d404c7fdcbd7b4d1dafd9e7981280580f0ae374f7620114452db5

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(CEr₃Al)H₆(FCm₈DbMgOsPo)Md₂(BkHe)Th

Evidence

Imports the POSIX connect API 0x329–0x529

⋯7 more rows
0x399005f494f5f737464696e5f7573656400._IO_stdin_used.
0x3a9736f636b6574006578697400636f6e6esocket.exit.conn
0x3b96563740073656e640066657865637665ect.send.fexecve
0x3c9007265637600696e65745f6164647200.recv.inet_addr.
0x3d9736574736f636b6f7074007265616c70setsockopt.realp
0x3e961746800676574686f737462796e616dath.gethostbynam
0x3f96500636c6f736500736c656570007379e.close.sleep.sy
0x4097363616c6c00616363657373005f5f6cscall.access.__l
0x4196962635f73746172745f6d61696e0073ibc_start_main.s
0x4296574656e76007772697465005f5f656eetenv.write.__en
0x4397669726f6e00474c4942435f322e3300viron.GLIBC_2.3.
⋯15 more rows

x86 (32-bit) bytewise XOR buffer transform loop 0x786–0x956

⋯7 more rows
0x7f653e8a4feffff83c40c6a0068778a0408S........j.hw...
0x8066864010000e810feffff83c41089c685hd..............
0x816c00f88b30000008d95e8efffff6a0089.............j..
0x8269590ebffff68001000005253e849feff.....h....RS.I..
0x836ff83c4108b9590ebffff85c07e2531c9............~%1.
0x84680340a994139c175f757515256899590.4..A9.u.WQRV...
0x856ebffffe8b2fdffff83c4108b9590ebff................
0x866ffebba89d731c0b90004000083ec0cf3.....1..........
⋯15 more rows

Spoofed per-CPU kworker kernel-thread name 0x9e0–0xbf0

⋯7 more rows
0xa50120000595bc9c3000300000001000200...Y[...........
0xa602f746d702f6c6f675f64652e6c6f6700/tmp/log_de.log.
0xa706c3332202020006100435744005b6b77l32   .a.CWD.[kw
0xa806f726b65722f303a325d00003137382eorker/0:2]..178.
0xa9031362e35332e3931000000000000000016.53.91........
0xaa000000000000000000000000000000000................
⋯21 more rows