Suspicious ^80% Download

bot-linux-amd64

ransomware, credential theft, persistence

IoT bot DDoS vector setGo attack worker function name

SHA-256f83ae1033045e2b125a97215c1cd7fbb81f38af4dec9c604455219efeb5f3d29

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₅(AsCa₂I₃P₅C)H₆(Cm₁₉Cr₈Db₈F₇Os₈Po₂)Md₃(Bi₂Pt)

Evidence

Systemd service restart policy is always 0x36fffa–0x37025a

⋯5 more rows
0x37004a202c4d332e322e302c4d31312e312e30 ,M3.2.0,M11.1.0
0x37005a526573746172743d616c776179730a41Restart=always.A
0x37006a545441434b5f53544f505f414c4c4d65TTACK_STOP_ALLMe
0x37007a7461646174612d466c61766f722f7072tadata-Flavor/pr
0x37008a6f632f6e65742f726f7574656e6f2073oc/net/routeno s
0x37009a7563682070726f636573736164766572uch processadver
⋯9 more rows
0x37013a667265636f7264206f766572666c6f77frecord overflow
0x37014a62616420636572746966696361746550bad certificateP
0x37015a4b43533157697468534841323536504bKCS1WithSHA256PK
⋯5 more rows
0x3701ba66696e69736865644163636570742d4cfinishedAccept-L
0x3701ca616e6775616765582d466f7277617264anguageX-Forward
0x3701da65642d466f722f6574632f6d696d652eed-For/etc/mime.
0x3701ea747970657328293c3e402c3b3a5c222ftypes()<>@,;:\"/
⋯7 more rows

References a systemd unit path under /etc 0x37a627–0x37a767

⋯5 more rows
0x37a677373236333333363138313634303632357263336181640625
0x37a6872f6574632f73797374656d642f737973/etc/systemd/sys
0x37a69774656d2f6e79782d6167656e742e7365tem/nyx-agent.se
0x37a6a772766963652e636f6e6669672f676f6frvice.config/goo
0x37a6b7676c652d6368726f6d652f4465666175gle-chrome/Defau
0x37a6c76c742f486973746f7279687474703a2flt/Historyhttp:/
0x37a6d72f3136392e3235342e3136392e323534/169.254.169.254
⋯9 more rows

Go attack worker function name 0x43cc66–0x43cd86

⋯5 more rows
0x43ccb66c6541747461636b436f6d6d616e6400leAttackCommand.
0x43ccc66d61696e2e737461727441747461636bmain.startAttack
0x43ccd6006d61696e2e61747461636b4b657900.main.attackKey.
⋯11 more rows

HTTP/2 client connection preface 0x5bfb10–0x5bfc30

⋯5 more rows
0x5bfb60a09f4f00000000000000000000000000..O.............
0x5bfb70505249202a20485454502f322e300d0aPRI * HTTP/2.0..
0x5bfb800d0a534d0d0a0d0a0000000000000000..SM............
⋯11 more rows

Source Engine query payload 0x5bfd94–0x5bfec4

⋯5 more rows
0x5bfde4000000000000000000000000ffffffff................
0x5bfdf454536f7572636520456e67696e652051TSource Engine Q
0x5bfe04756572790000000000000000ffffffffuery............
0x5bfe1454536f7572636520456e67696e652051TSource Engine Q
⋯11 more rows