Hostile ^100% Download

Owari.mpsl

Mirai botnet malware

MIPS pinned-host C2 with TCP inspectionStatic MIPS watchdog bot with an encoded Source-query flood payload

SHA-256c46e5696b47b08f2283c2f8de1e97ba4e0046207483afa33a75ca9374ddff131

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McTe)O₄(CIAsLa)H₄(F₇Po₃Cm₄Os)Md₄(Bi₃BkHe)

Evidence

Little-endian MIPS syscall instruction 0xd264–0xd3e4

⋯7 more rows
0xd2d41000bc8f0b00001000000000d70f0224...............$
0xd2e40c0000003881998f0600e01021804000....8.......!.@.
0xd2f409f82003000000001000bc8f000050ac.. ...........P.
⋯15 more rows

Little-endian MIPS open/create flags 0xd55c–0xd6fc

⋯3 more rows
0xd58ce0ffbd271c00bfaf1800b0af1000bcaf...'............
0xd59cc50f02240c0000003881998f0600e010...$....8.......
0xd5ac2180400009f82003000000001000bc8f!.@... .........
0xd5bc000050acffff1024211000021c00bf8f..P....$!.......
⋯9 more rows
0xd65c05001c3cb4bd9c2721e099032480998f...<...'!...$...
0xd66c2130a000080020030103052400000000!0.... ....$....
0xd67c0000000005001c3c90bd9c2721e09903.......<...'!...
0xd68cd8ffbd271c00beaf21f0a0032000bfaf...'....!... ...
⋯7 more rows

Little-endian MIPS direct connect syscall 0xe25c–0xe3ec

⋯7 more rows
0xe2cce0ffbd271c00bfaf1800b0af1000bcaf...'............
0xe2dc4a1002240c0000003881998f0600e010J..$....8.......
0xe2ec2180400009f82003000000001000bc8f!.@... .........
0xe2fc000050acffff02241c00bf8f1800b08f..P....$........
⋯15 more rows

Little-endian MIPS direct socket syscall 0xe67c–0xe74c

⋯3 more rows
0xe6ace0ffbd271c00bfaf1800b0af1000bcaf...'............
0xe6bc571002240c0000003881998f0600e010W..$....8.......
0xe6cc2180400009f82003000000001000bc8f!.@... .........
0xe6dc000050acffff02241c00bf8f1800b08f..P....$........
⋯7 more rows

Alternate watchdog device path 0x10c87–0x10f77

⋯5 more rows
0x10cd78f000000001c00bf8f000000000800e0................
0x10ce7032000bd27000000002f000000783939. ..'..../...x99
0x10cf7782e6475636b646e732e6f7267000000x.duckdns.org...
0x10d070039342e32362e3130362e3332000000.94.26.106.32...
0x10d17000a0000000000000000000001000000................
⋯4 more rows
0x10d67ffe416fbffa019fbffe418fbfffffa1f................
0x10d7700500018fff0000000fffb1f002c6d6d.P...........,mm
0x10d872c7a3021373f303a277a3b2633540000,z0!7?0:'z;&3T..
0x10d9700539b0000445200001b0315061d646d.S...DR.......dm
0x10da76566673d306d3d6566672c306d656654efg=0m=efg,0mefT
0x10db700273c313838540000313a3536383154.'<188T..1:5681T
0x10dc700272d272031395400273c54007b363d.'-' 19T.'<T.{6=
0x10dd73a7b3621272d363b2c741b0315061d54:{6!'-6;,t.....T
0x10de7001b0315061d6e74352424383120743a......nt5$$81 t:
0x10df73b2074323b213a3054000000003a373b; t2;!:0T....:7;
0x10e072626313720540000007b363d3a7b3621&&17 T...{6=:{6!
0x10e17272d363b2c74242754000000007b363d'-6;,t$'T....{6=
0x10e273a7b3621272d363b2c743f3d38387479:{6!'-6;,t?=88ty
0x10e376d745400007b24263b377b54007b312cmtT..{$&;7{T.{1,
0x10e4731540000007b323054000000007b39351T...{20T....{95
0x10e5724275400007b24263b377b3a31207b20$'T..{$&;7{:1 { 
0x10e6737245400007b272035202127540000007$T..{' 5 !'T...
0x10e77007a353a3d393154007b24263b377b3a.z5:=91T.{$&;7{:
0x10e8731207b263b21203154000000003527271 {&;! 1T....5''
0x10e97233b263054000000007b3120377b2631#;&0T....{1 7{&1
0x10ea7273b38227a373b3a32540000003a3539';8"z7;:2T...:59
0x10eb7312731262231267454000000007b30311'1&"1&tT....{01
0x10ec7227b233520373c303b335400007b3031"{#5 7<0;3T..{01
0x10ed7227b393d27377b233520373c303b3354"{9='7{#5 7<0;3T
0x10ee700243636322a372145000000003b333d.$662*7!E....;3=
0x10ef73a54000000313a2031265400006d2165:T...1: 1&T..m!e
0x10f07666760606c2165666035216c65603060fg``l!ef`5!le`0`
0x10f172c656454000000000000073b21263731,edT.......;!&71
0x10f2774113a333d3a3174052131262d540000t.:3=:1t.!1&-T..
0x10f37000000000000000000ec4bfbfffc4bfb..........K...K.
0x10f47ff744bfbff884bfbff9c4bfbffb04bfb.tK...K...K...K.
0x10f57ffc44bfbffd84bfbff2f6465762f6e75..K...K../dev/nu
0x10f676c6c0000000000000000000000000000ll..............
0x10f7700000000000000000000000000000000................