Hostile ^100% Download

c6d07f9aab66d6d499849b1c0682a62e62c679b23484cebbd00b35d56062c641

SSH credential stealer with Discord exfil

Go SSH server sends captured passwords and keys to DiscordSSH credential stealer carries XMRig and NBMiner configuration

SHA-256c6d07f9aab66d6d499849b1c0682a62e62c679b23484cebbd00b35d56062c641

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Am)O₇(EuI₂As₂Ca₃PCDy)H₆(Cm₁₃Cr₄Db₄F₅Os₈Po₂)Md₃(Bi)Th₂

Evidence

libpam.so library string 0x13b9–0x1539

⋯7 more rows
0x14296e0e0200000000000000000000000000n...............
0x14396c696270616d2e736f2e30005f5f676dlibpam.so.0.__gm
0x14496f6e5f73746172745f5f006c69627074on_start__.libpt
⋯15 more rows

Go credential attack-queue identifier 0x2c7a56–0x2c7c06

⋯7 more rows
0x2c7ac665000b6170706c69636174696f6e000be..application..
0x2c7ad661747461636b7175657565000b617574attackqueue..aut
0x2c7ae6686f726974696573000b626164436861horities..badCha
⋯7 more rows
0x2c7b666865636b4275636b6574000b63686563heckBucket..chec
0x2c7b766b486569676874000b63697068657253kHeight..cipherS
0x2c7b8675697465000b636c6f7365496649646cuite..closeIfIdl
0x2c7b9665000b636c6f73654c6f636b6564000be..closeLocked..
⋯7 more rows

Go NBMiner enabled or algorithm preset field 0x2d3986–0x2d3a56

⋯3 more rows
0x2d39b65363616c6172426173654d756c74001bScalarBaseMult..
0x2d39c663757272656e745f7072657365745f6ecurrent_preset_n
0x2d39d6626d696e65725f616c676f001b706172bminer_algo..par
0x2d39e6736544796e616d69635461626c655369seDynamicTableSi
⋯7 more rows

Go NBMiner pool address or user fields 0x2d4bbc–0x2d4cdc

⋯3 more rows
0x2d4bec6571756573744d7367544c533133001fequestMsgTLS13..
0x2d4bfc63757272656e745f7072657365745f6ecurrent_preset_n
0x2d4c0c626d696e65725f706f6f6c4164647200bminer_poolAddr.
0x2d4c1c1f63757272656e745f7072657365745f.current_preset_
0x2d4c2c6e626d696e65725f706f6f6c50617373nbminer_poolPass
0x2d4c3c001f63757272656e745f707265736574..current_preset
0x2d4c4c5f6e626d696e65725f706f6f6c557365_nbminer_poolUse
0x2d4c5c72001f66696c6c536c69636546726f6dr..fillSliceFrom
0x2d4c6c436d646c696e6557697468436f6e7465CmdlineWithConte
⋯7 more rows

Go SSH key and password record 0x2ed3bf–0x2ed50f

⋯5 more rows
0x2ed40f6374207b20462075696e747074723b20ct { F uintptr; 
0x2ed41f707269766174656b657920737472696eprivatekey strin
0x2ed42f673b20757365726e616d652073747269g; username stri
0x2ed43f6e673b20697020737472696e673b2070ng; ip string; p
0x2ed44f617373776f726420737472696e67207dassword string }
0x2ed45f00080000000000000008000000000000................
⋯11 more rows