Hostile ^100% Download

ca3235df8fcdcd0b00a14eb0b87e494dd4e5b2229ae415be2a9ce40c41d87397.bin

C2, killswitch, kernel spoofing

References /tmp/log_de.log killswitch pathSpoofed per-CPU kworker kernel-thread name

SHA-256ca3235df8fcdcd0b00a14eb0b87e494dd4e5b2229ae415be2a9ce40c41d87397

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(AlEr₃As)H₄(FCm₈OsPo)Md₄(ArBkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x90

0x07f454c46010101000000000000000000.ELF............
0x100200280001000000d107010034000000..(.........4...
0x200c180000020400053400200008002800........4. ...(.
⋯7 more rows

Parse IP with inet_addr 0x34e–0x4de

⋯4 more rows
0x38e0000000000000000000012000000006c...............l
0x39e6962632e736f2e3600736f636b657400ibc.so.6.socket.
0x3ae6578697400636f6e6e6563740061626fexit.connect.abo
0x3be72740073656e64006d656d7365740066rt.send.memset.f
0x3ce657865637665007265637600696e6574execve.recv.inet
0x3de5f6164647200736574736f636b6f7074_addr.setsockopt
0x3ee007265616c7061746800676574686f73.realpath.gethos
0x3fe7462796e616d6500636c6f736500736ctbyname.close.sl
0x40e6565700073797363616c6c0061636365eep.syscall.acce
0x41e7373005f5f6c6962635f73746172745fss.__libc_start_
0x42e6d61696e00736574656e760077726974main.setenv.writ
0x43e65005f5f656e7669726f6e005f5f676de.__environ.__gm
⋯10 more rows

References /tmp/log_de.log killswitch path 0x8a0–0xa00

⋯5 more rows
0x8f0704700bf08402de90880bde801000200pG...@-.........
0x9002f746d702f6c6f675f64652e6c6f6700/tmp/log_de.log.
0x91001bb0034372e3131342e37322e313000...47.114.72.10.
0x92000000000000000000000000000000000................
0x93000000000613332202020006100435744....a32   .a.CWD
0x940005b6b776f726b65722f303a325d0000.[kworker/0:2]..
0x95080feff7f01000000000000008d080100................
⋯11 more rows