Hostile ^93% Download

f0dcbe613c97ee1c0fa0bbb31ed35df657506145acd9fabeffff5f3f26996219

UPX-packed MIPS botnet C2

Hostile packed IoT socket C2 botHostile packed IoT shell-command bot

SHA-256f0dcbe613c97ee1c0fa0bbb31ed35df657506145acd9fabeffff5f3f26996219

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

ELF32 header omits section table 0x0–0x180

0x07f454c46010201000000000000000000.ELF............
0x100002000800000001004206a800000034.........B.....4
0x2000000000000010070034002000020028.........4. ...(
0x3000000000000000010000000000400000.............@..
0x4000400000000210f2000210f200000005.@..............
0x5000010000000000010000000000430000.............C..
0x60004300000000000000092fd800000006.C......../.....
0x70000100000c2ad42a555058210a580d89.....*.*UPX!.X..
0x8000000000000000000000000000000094................
0x900000005e020000007cf724ff7f454c46...^....|.$..ELF
⋯15 more rows

Static ELF contains socket API marker 0x1961e–0x1990e

⋯7 more rows
0x1968e8c07bc54f003e2fbefccaee30be16017...T..........`.
0x1969ee228736f636b65742079167bd87b726f.(socket y.{.{ro
0x196ae723b0870611792dbff7ff66e64321d20r;.pa......nd2. 
⋯7 more rows
0x1972eb3639b7573076d6e740ce8b523686fbf.c.us.mnt...#ho.
0x1973e08079705fbfe5b636e635d072f080001......[cnc]./...
0x1974e86707e600c25356875d6df366c31eae6.p~`.%5hu..6l1..
⋯19 more rows
0x1988e67a7922f9f1f32005ffacffd8f2992f1g../..2._....)..
0x1989e13856d76202d66d7da626f747632ecdf..mv -f..botv2..
0x198ae7f7b636d03313a76343a4a426cf02530.{cm.1:v4:JBl.%0
0x198be3258f7417a037b642563031347e6b62e2X.Az.{d%c..G...
0x198ce4813592f0775f24eed90dec209865803H.Y/.u.N......X.
0x198de2f6d177d4d110a233f5e66082f6d85f7/m.}M..#?^f./m..
0x198eead2d1672632e640468c66cddd5cd9613.-.rc.d.h.l.....
0x198fe0ecb2b5f786974f67784f6370a548026..+_xit.w..7.T.&
0x1990e0a1120300a0b94e0992c0f312ee936d2.. 0.....,.1..6.