Hostile ^100% Download

putita.arm6

IoT botnet implant with C2 and persistence

Multi-architecture IoT bot fetches a named /bins payloadNative ARM implant combines systemd persistence with shell staging

SHA-256c2f08561f696d13adb4f92397aac79662447292e0243843ae5f5e33faee9cdfc

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(CP₄Er)H₆(F₅Cm₇CrDbOs₃Po₅)Md₂(ArBi₂)

Evidence

Native ARM implant combines systemd persistence with shell staging 0x0–0x110

0x07f454c46010101000000000000000000.ELF............
0x1003002800010000008c12000034000000..(.........4...
0x2014130200000200053400200006002800........4. ...(.
0x301600150001000070b4010200b4010200.......p........
0x40b4010200080000000800000004000000................
0x5004000000010000000000000000000000................
0x6000000000c0010200c001020005000000................
0x700000010001000000f00d0200f00d0300................
0x80f00d030028040000a451010006000000....(....Q......
⋯9 more rows

ARM EABI direct execve(2) wrapper 0x15568–0x15638

⋯3 more rows
0x15598010000ea6cba01003400000004702de5....l...4....p-.
0x155a80b70a0e3000000ef04709de4faf4ffea.p.......p......
0x155b81eff2fe11eff2fe1f04f2de984d04de2../.../..O-...M.
0x155c80d80a0e10000e0e3f8ffffeb0800a0e1................
⋯7 more rows

Multi-architecture IoT bot fetches a named /bins payload 0x1cc88–0x1ced8

⋯7 more rows
0x1ccf80000000000000000756e6b6e6f776e00........unknown.
0x1cd08474554202f62696e732f707574697461GET /bins/putita
0x1cd182e0020485454502f312e300d0a436f6e.. HTTP/1.0..Con
0x1cd286e656374696f6e3a20636c6f73650d0anection: close..
0x1cd380d0a002f746d702f7570640047455420.../tmp/upd.GET 
0x1cd482f64796e616d69632e6a736f6e204854/dynamic.json HT
0x1cd5854502f312e310d0a486f73743a202573TP/1.1..Host: %s
0x1cd680d0a557365722d4167656e743a204369..User-Agent: Ci
⋯10 more rows
0x1ce1863682d75612d706c6174666f726d3a20ch-ua-platform: 
0x1ce282257696e646f77732200557067726164"Windows".Upgrad
0x1ce38652d496e7365637572652d5265717565e-Insecure-Reque
0x1ce487374733a203100557365722d4167656ests: 1.User-Agen
0x1ce58743a204d6f7a696c6c612f352e302028t: Mozilla/5.0 (
0x1ce6857696e646f7773204e542031302e303bWindows NT 10.0;
⋯7 more rows

Native binary emulates browser navigation request headers 0x1cef8–0x1d018

⋯3 more rows
0x1cf284163636570742d456e636f64696e673aAccept-Encoding:
0x1cf38206964656e74697479005365632d4665 identity.Sec-Fe
0x1cf487463682d536974653a206e6f6e650053tch-Site: none.S
0x1cf5865632d46657463682d4d6f64653a206eec-Fetch-Mode: n
0x1cf6861766967617465005365632d46657463avigate.Sec-Fetc
0x1cf78682d557365723a203f31005365632d46h-User: ?1.Sec-F
0x1cf88657463682d446573743a20646f63756detch-Dest: docum
0x1cf98656e74004163636570742d4c616e6775ent.Accept-Langu
0x1cfa86167653a20656e2d55532c656e3b713dage: en-US,en;q=
⋯7 more rows

X25519 or Curve25519 algorithm reference 0x1d08a–0x1d24a

⋯19 more rows
0x1d1ba20005b53454c462d5445535420464149 .[SELF-TEST FAI
0x1d1ca4c5d20583235353139206b657967656eL] X25519 keygen
0x1d1da206d69736d61746368210a2020476f74 mismatch!.  Got
⋯7 more rows