Hostile ^100% Download

dc4866b34ca3c7df0a48048caabfa8b4cd40b7ae385c957cb66eed4abe3db01f

Prometei botnet configuration

Encrypted parent-relay bot configurationPrometei packed Linux bot

SHA-256dc4866b34ca3c7df0a48048caabfa8b4cd40b7ae385c957cb66eed4abe3db01f

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₃(As₂CAl)H₃(Cm₂FOs)Md₃(Bi₄BkHe)Th

Evidence

ELF64 header omits section table 0x0–0x1f0

0x07f454c46020101000000000000000000.ELF............
0x1002003e000100000050b65e0100000000..>.....P.^.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000300000000000000[email protected].........
0x4001000000060000000000000000000000................
0x5000004000000000000000400000000000..@.......@.....
⋯7 more rows
0xd000000000000000000000000000000000................
0xe0100000000000000056fc093955505821........V..9UPX!
0xf0fc0a0e1600000000b0a9130051041000............Q...
0x10070020000be00000008000000bbfb20ffp............. .
⋯15 more rows

Contains a /tmp/ or /var/tmp/ path 0x5af0f–0x5af9f

0x5af0fffbe90eb6c50a4f7a3f95ff50ffcbef2....lP...._.....
0x5af1f7871c61ecccf6a0072de4861736850ffxq....j.r.HashP.
0x5af2f7fd1ff6f77657250726f6a6563c06100...owerProjec.a.
0x5af3f2f746d702f64656275672e74786fdf9a/tmp/debug.txo..
0x5af4f6d200d0a4e26703c632f7374611e252am ..N&p<c/sta.%*
⋯5 more rows

ELF embeds a cleartext http:// URL 0x6c75e–0x6c96e

⋯3 more rows
0x6c78e89395b5dc3681e0000005ae81e000000.9[].h....Z.....
0x6c79e50524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x6c7ae52495445206661696c65642e0a005e6aRITE failed...^j
0x6c7be025f6a01580f056a7f5f6a3c580f050a._j.X..j._j<X...
0x6c7ce0024496e666f3a20546869732066696c.$Info: This fil
0x6c7de65206973207061636b65642077697468e is packed with
0x6c7ee20746865205550582065786563757461 the UPX executa
0x6c7fe626c65207061636b657220687474703able packer http:
0x6c80e2f2f7570782e73662e6e657420240a00//upx.sf.net $..
0x6c81e2449643a2055505820342e323420436f$Id: UPX 4.24 Co
0x6c82e70797269676874202843292031393936pyright (C) 1996
⋯6 more rows
0x6c89e514d29c94183c8ff6a22415a525e6a03QM).A...j"AZR^j.
0x6c8ae5a29ff6a09580f054889442410505a53Z).j.X..H.D$.PZS
0x6c8be5ead504889e14989d5ad50ad41904889^.PH..I...P.A.H.
0x6c8cef75effd559488b742418488b7c24106a.^..YH.t$.H.|$.j
0x6c8de055a6a0a580f0541ffe55de87effffff.Zj.X..A..].~...
0x6c8ee2f70726f632f73656c662f6578650000/proc/self/exe..
0x6c8fe0100002d0c00003008000008000000ff...-...0........
⋯7 more rows

Prometei Linux bot configuration 0x6d871–0x6da31

⋯7 more rows
0x6d8e1d80600b0a91300492a004cf40000007b.......I*.L....{
0x6d8f122636f6e666967223a312c226964223a"config":1,"id":
0x6d9012241344c68434d5174766879364f5866"A4LhCMQtvhy6OXf
0x6d91143222c22656e636b6579223a224e4b32C","enckey":"NK2
0x6d921316d656c5843396157774143495538761melXC9aWwACIU8v
0x6d93142655a5735473239385674504b623245BeZW5G298VtPKb2E
0x6d94148495944423870524f6e476f736d3176HIYDB8pROnGosm1v
0x6d951474a54524d582b624e326f777055734cGJTRMX+bN2owpUsL
0x6d961464b50425774787661464136384b5559FKPBWtxvaFA68KUY
0x6d97131624b7632644e706f58746c74672b741bKv2dNpoXtltg+t
⋯3 more rows
0x6d9b1455a42333774584b6830747a66654d4fEZB37tXKh0tzfeMO
0x6d9c14f2f33394a6249453d222c2250617265O/39JbIE=","Pare
0x6d9d16e744964223a22423734483135333136ntId":"B74H15316
0x6d9e1364e564d3352584856222c226970223a6NVM3RXHV","ip":
0x6d9f1223135372e3233302e3233362e313933"157.230.236.193
0x6da01222c22506172656e744970223a223137","ParentIp":"17
0x6da11322e31302e3130302e3831222c2250612.10.100.81","Pa
0x6da2172656e74486f73746e616d65223a224brentHostname":"K
0x6da31325052444442227d2c              2PRDDB"},       