Hostile ^100% Download

d138a416cb7844173677eb4ec9e318edf3997c547137cb5d2144364183e18b29.elf

SNOWLIGHT C2, evasion, killswitch

Detects Linux.Generic.ThreatReferences /tmp/log_de.log killswitch path

SHA-256d138a416cb7844173677eb4ec9e318edf3997c547137cb5d2144364183e18b29

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(AlEr₃)H₄(FCm₈OsPo)Md₂(BkHe)Th₂

Evidence

Parse IP with inet_addr 0x4aa–0x62a

⋯4 more rows
0x4ea0000000000000000000000000000006c...............l
0x4fa6962632e736f2e3600736f636b657400ibc.so.6.socket.
0x50a6578697400636f6e6e6563740073656eexit.connect.sen
0x51a64006665786563766500726563760069d.fexecve.recv.i
0x52a6e65745f6164647200736574736f636bnet_addr.setsock
0x53a6f7074007265616c7061746800676574opt.realpath.get
0x54a686f737462796e616d6500636c6f7365hostbyname.close
0x55a00736c6565700073797363616c6c0061.sleep.syscall.a
0x56a6363657373005f5f6c6962635f737461ccess.__libc_sta
0x57a72745f6d61696e00736574656e760077rt_main.setenv.w
0x58a72697465005f5f656e7669726f6e005frite.__environ._
⋯10 more rows

SNOWLIGHT 0xa5d–0xb7d

⋯5 more rows
0xaad7ffdffff85c04889c289c17e214889e8......H....~!H..
0xabd80309948ffc089c629ee39ce7cf24863.0.H....).9.|.Hc
0xacdd24889ee4489e7e887fdffffebc531c0.H..D.........1.
⋯11 more rows

References /tmp/log_de.log killswitch path 0xc54–0xdf4

⋯7 more rows
0xcc44883ec084883c408c300000001000200H...H...........
0xcd42f746d702f6c6f675f64652e6c6f6700/tmp/log_de.log.
0xce46c3634202020006100435744005b6b77l64   .a.CWD.[kw
0xcf46f726b65722f303a325d000034332e31orker/0:2]..43.1
0xd0434322e3130392e31343600000000000042.109.146......
0xd1400000000000000000000000000000000................
⋯14 more rows