Suspicious ^80% Download

bc6854418c71d63e.bin

C2 beacon, evasion, Android targeting

ARM architecture from ELF header bytesELF omits compiler metadata (.comment)

SHA-256bc6854418c71d63e9209be6260fdc76517603fb9c1bdbcabb9858043207a418d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(AlAsDyErPr)H₄(Cm₇F₉Os₅Po₆)Md₅(ArBi₂BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x90

0x07f454c46010101000000000000000000.ELF............
0x100200280001000000800c010034000000..(.........4...
0x202c760200000400053400200004002800,v......4. ...(.
⋯7 more rows

ARM literal pool contains send syscall number 0x3180–0x3240

⋯3 more rows
0x31b00630c4e5acffffeabcd08de2f08fbde8.0..............
0x31c021010000b4050000ffff000099030000!...............
0x31d0f04f2de90160a0e1ccd04de20410a0e3.O-..`....M.....
⋯7 more rows

ARM supervisor-call syscall instruction 0x15144–0x15204

⋯3 more rows
0x15174d71200eb0000a0e38010a0e30d20a0e1............. ..
0x15184000000ef0030a0e30300a0e14e2f83e2.....0......N/..
0x1519402108de0382151e5000052e30300001a....8!Q...R.....
⋯7 more rows

ARM EABI direct uname(2) wrapper 0x17934–0x17a04

⋯3 more rows
0x17964b080bde830540480a8e1000004702de5....0T.......p-.
0x179747a70a0e3000000ef04709de44df8ffeazp.......p..M...
0x1798404702de5dc70a0e3000000ef04709de4.p-..p.......p..
0x1799448f8ffea1eff2fe1f3472de90190a0e1H...../..G-.....
⋯7 more rows

ARM literal pool contains connect syscall number 0x17b14–0x17bd4

⋯3 more rows
0x17b44b00b00eb14d08de204e09de4d9f7ffea................
0x17b541b0100000030a0e3b0002de90340a0e1.....0....-..@..
0x17b640c709fe50350a0e1000000efb000bde8.p...P..........
⋯7 more rows