Hostile ^100% Download

violet.arm7

C2, persistence, hidden files

Cron with hidden file pathsNameless static ELF pins an external address

SHA-256eaad5ab26818c6ff13abd1f21c9100fea6d5e7e9925deae14998e478d7564409

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₄(AsEr₃PDy)H₅(Cm₃DbF₄Os₂Po₃)Md₅(ArBi₃BkHe)

Evidence

ARM architecture from ELF header bytes 0x0–0x90

0x07f454c46010101000000000000000000.ELF............
0x1002002800010000009481000034000000..(.........4...
0x20681f0100020000043400200005002800h.......4. ...(.
⋯7 more rows

ARM creates IPv4 raw socket, r1 first 0x177c–0x183c

⋯3 more rows
0x17acbcd04de2e4a08de20e008ae848008de5..M.........H...
0x17bc0310a0e30200a0e31120a0e3891200eb......... ......
0x17cc010070e350008de55001000ab8308de2..p.P...P....0..
⋯7 more rows

ARM supervisor-call syscall instruction 0x42c0–0x4380

⋯3 more rows
0x42f00c0000ea10409de52556a0e1c070a0e3.....@..%V...p..
0x4300000000ef010a70e30500009a24309fe5......p.....$0..
0x4310002060e203309fe7080000eb032080e7. `..0....... ..
⋯7 more rows

Direct ARM EABI kill(2) syscall wrapper 0x45f4–0x46d4

⋯3 more rows
0x46240000e0e38040bde81eff2fe160560100.....@..../.`V..
0x463480402de92570a0e3000000ef010a70e3.@-.%p........p.
0x46440500009a18309fe5002060e203309fe7.....0... `..0..
0x465439ffffeb032080e70000e0e38040bde89.... .......@..
0x46641eff2fe12856010090402de90c409de5../.(V...@-..@..
⋯7 more rows

Pinned external IPv4 host literal in binary 0x108c4–0x10b94

⋯5 more rows
0x10914f0df2de904b04ce2f0af1be920000000..-...L..... ...
0x109242f746d702f2e76696f6c657400000000/tmp/.violet....
0x109342f70726f632f25642f65786500000000/proc/%d/exe....
0x109442863726f6e746162202d6c20323e2f64(crontab -l 2>/d
0x1095465762f6e756c6c3b206563686f202740ev/null; echo '@
0x109647265626f6f742025732025732729207creboot %s %s') |
0x109742063726f6e746162202d20323e2f6465 crontab - 2>/de
0x10984762f6e756c6c000025640a003137322ev/null..%d..172.
0x109943234352e3130362e31343400436f6e6e245.106.144.Conn
0x109a4656374656420546f20434e430d0a0000ected To CNC....
0x109b474656c6e657464002f00000076696f6ctelnetd./...viol
0x109c4657400002f7661722f72756e2f2e7669et../var/run/.vi
0x109d46f6c6574000000002f6d6e742f2e7669olet..../mnt/.vi
0x109e46f6c6574000000002f726f6f742f2e76olet..../root/.v
0x109f4696f6c65740000002f746d702f2e7669iolet.../tmp/.vi
0x10a046f6c65742e706964000000002f746d70olet.pid..../tmp
0x10a142f2e76696f6c65742e7764002f746d70/.violet.wd./tmp
0x10a242f2e76696f6c65742e63726f6e000f00/.violet.cron...
0x10a342f096c6f63616c686f737463dd010000/.localhostc....
⋯4 more rows
0x10a84286e756c6c2900002b002d0020003078(null)..+.-. .0x
0x10a9400305800101010080a0a0a00686c4c6a.0X.........hlLj
0x10aa47a74715a000204080800000800000108ztqZ............
0x10ab4001f0500000f07080200040001000300................
⋯3 more rows
0x10af407080001010104020101010101010000................
0x10b046e7078586f7564696646654567476141npxXoudifFeEgGaA
0x10b144353637300000000202b302d23274900CScs.... +0-#'I.
0x10b24556e6b6e6f776e206572726f72200000Unknown error ..
⋯7 more rows