Suspicious ^80% Download

manji.ppc440

Persistence, evasion, network C2

Unix ELF TracerPid debugger checkReferences a systemd ExecStart directive

SHA-256e79974dc43adf32c52817bb5fd9b5e8eae84db7409f5cb7219794d1195ab0a72

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₃(AlDyP₄)H₅(Cm₂Db₂F₈Os₆Po₂)Md₂(Bi₂He)

Evidence

PowerPC socketcall connect operation wrapper 0xc8e0–0xca40

⋯3 more rows
0xc9104e8000209421ffe07c0802a690610008N.. .!..|....a..
0xc920386000039081000c38810008900100248`......8......$
0xc93090a1001048001fdd8001002438210020....H......$8!. 
⋯7 more rows
0xc9b07c0803a64e8000209421ffe07c0802a6|...N.. .!..|...
0xc9c0906100083860000a9081000c38810008.a..8`......8...
0xc9d09001002490a1001090c1001448001f35...$........H..5
⋯7 more rows

PowerPC socketcall socket operation wrapper 0xcab0–0xcb70

⋯3 more rows
0xcae04e8000209421ffe07c0802a690610008N.. .!..|....a..
0xcaf0386000019081000c38810008900100248`......8......$
0xcb0090a1001048001e0d8001002438210020....H......$8!. 
⋯7 more rows

PowerPC Linux socketcall syscall wrapper 0xe8e0–0xe9b0

⋯3 more rows
0xe9109421fff07c0802a693e1000c90010014.!..|...........
0xe92038000066440000027c000026740910008..fD...|..&t...
0xe9307c7f1b7841a200104bffaaf593e30000|..xA...K.......
0xe9403860ffff8001001483e1000c382100108`..........8!..
⋯7 more rows

Embedded shell echo stage marker 0x127fc–0x12aec

⋯3 more rows
0x1282c6d6e6f707172737475767778797a0000mnopqrstuvwxyz..
0x1283c2f70726f632f25642f636d646c696e65/proc/%d/cmdline
0x1284c000000002f70726f632f256400000000..../proc/%d....
0x1285c2f70726f632f73656c66000064697675/proc/self..divu
0x1286c732d6368656174732e636f6d00000000s-cheats.com....
0x1287c2f70726f632f73656c662f6578650000/proc/self/exe..
0x1288c2f70726f632f637075696e666f000000/proc/cpuinfo...
0x1289c7200000063707520636f726573000000r...cpu cores...
0x128ac00000003000000000001020304050607................
⋯4 more rows
0x128fc2f0000002f7573722f6c6f63616c2f00/.../usr/local/.
0x1290c2f6f70742f0000002f70726f632f6d6f/opt/.../proc/mo
0x1291c756e747300000000252a732025323535unts....%*s %255
0x1292c7320253633730000746d706673000000s %63s..tmpfs...
0x1293c72616d667300000025732f2573000000ramfs...%s/%s...
0x1294c2f657463000000002f6574632f737973/etc..../etc/sys
0x1295c74656d642f73797374656d002f657463temd/system./etc
0x1296c2f73797374656d642f73797374656d2f/systemd/system/
0x1297c25732e73657276696365000077000000%s.service..w...
⋯4 more rows
0x129cc766963655d0a0000547970653d73696dvice]...Type=sim
0x129dc706c650a000000004578656353746172ple.....ExecStar
0x129ec743d25730a000000526573746172743dt=%s....Restart=
0x129fc616c776179730a005265737461727453always..RestartS
0x12a0c65633d31300a0a005b496e7374616c6cec=10...[Install
0x12a1c5d0a000057616e74656442793d6d756c]...WantedBy=mul
0x12a2c74692d757365722e7461726765740a00ti-user.target..
0x12a3c73797374656d63746c20656e61626c65systemctl enable
0x12a4c2025732e73657276696365203e2f6465 %s.service >/de
0x12a5c762f6e756c6c20323e2631207c7c2074v/null 2>&1 || t
0x12a6c72756500610000000a23204175746f2drue.a....# Auto-
0x12a7c616464656420736572766963650a0000added service...
0x12a8c257320260a00000063726f6e74616220%s &....crontab 
0x12a9c2d6c20323e2f6465762f6e756c6c0000-l 2>/dev/null..
0x12aac2863726f6e746162202d6c20323e2f64(crontab -l 2>/d
0x12abc65762f6e756c6c3b206563686f202740ev/null; echo '@
0x12acc7265626f6f7420257320262729207c20reboot %s &') | 
0x12adc63726f6e746162202d0000002f657463crontab -.../etc
0x12aec2f696e69742e64002f6574632f696e69/init.d./etc/ini

References own process status procfs path 0x12bac–0x12e3c

⋯3 more rows
0x12bdc5758595a303132333435363738390000WXYZ0123456789..
0x12bec2f6574632f72632e6c6f63616c000000/etc/rc.local...
0x12bfc2f7661722f746d70000000002f646576/var/tmp..../dev
0x12c0c2f73686d000000002f7573722f6c6f63/shm..../usr/loc
⋯6 more rows
0x12c7c10012c2410012c3410012c3c10012c48..,$..,4..,<..,H
0x12c8c10012c5410012c4010012c602f70726f..,T..,@..,`/pro
0x12c9c632f73656c662f737461747573000000c/self/status...
0x12cac5472616365725069643a00004c445f50TracerPid:..LD_P
0x12cbc52454c4f414400004c445f4155444954RELOAD..LD_AUDIT
⋯7 more rows
0x12d3c2f73686d2f0000006874747064000000/shm/...httpd...
0x12d4c6e67696e780000006170616368650000nginx...apache..
0x12d5c6c696768747470640000000073736864lighttpd....sshd
0x12d6c0000000074656c6e65746400626f6100....telnetd.boa.
0x12d7c75687474706400006d696e695f687474uhttpd..mini_htt
0x12d8c7064000064726f706265617200000000pd..dropbear....
0x12d9c73797374656d64006b74687265616464systemd.kthreadd
0x12dac000000006b736f667469727164000000....ksoftirqd...
0x12dbc6b737761706400006b776f726b657200kswapd..kworker.
0x12dcc0000000010012d4410012d5c10012d4c......-D..-\..-L
⋯7 more rows