Hostile ^100% Download

fa6f34f439e2f40f.bin

Mirai botnet malware

UPnP AddPortMapping field injects a download-and-execute commandCondi bot propagates through UPnP command injection

SHA-256fa6f34f439e2f40fcdccaa83a88e08fbe2e9285eba8c9e29228df3e3c16c1078

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(Mc₆Li)O₉(As₄C₇I₃LaP₃Er₅AlDy₂Xe)H₅(Cm₂₄F₁₃Cr₅Os₇Po₇)Md₅(ArBi₅Bk₂He)Th₂

Evidence

ARM architecture from ELF header bytes 0x0–0x2f0

0x07f454c46010101030000000000000000.ELF............
0x100200280001000000500d040034000000..(.....P...4...
0x2000000000020000043400200003002800........4. ...(.
0x3000000000010000000000000000800000................
0x40008000001a9703001a97030005000000................
0x5000800000010000000468000004e80900.........h......
⋯42 more rows

ARM creates an IPv4 raw socket 0xe368–0xe428

⋯3 more rows
0xe3982e0a5878ff053e5fa6b79eb7008bcf4a..Xx..>_.......J
0xe3a85f660f10c2e8e521141ca642280e07f7_f.....!...B(...
0xe3b8eecd0e091b3e9e255a7620ddce7fb82c.....>.%Zv ....,
⋯7 more rows

_main program entry symbol 0x13018–0x130d8

⋯3 more rows
0x130484f6f03365616016fd481ae7ef2ee0dc7Oo.6V..o...~....
0x130580c78e729cfccfafeb8b757ae7b8a1578.x.)......W.{..x
0x13068900662e9fe071fa70f2f87253c060c6b..b....../.%<..k
⋯7 more rows

UPX packer banner string 0x38f30–0x390f0

⋯5 more rows
0x38f80000000ef7f00a0e30170a0e3000000ef.........p......
0x38f9050524f545f455845437c50524f545f57PROT_EXEC|PROT_W
0x38fa052495445206661696c65642e0a000a00RITE failed.....
0x38fb024496e666f3a20546869732066696c65$Info: This file
0x38fc0206973207061636b6564207769746820 is packed with 
0x38fd074686520555058206578656375746162the UPX executab
0x38fe06c65207061636b657220687474703a2fle packer http:/
0x38ff02f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x3900049643a2055505820332e393420436f70Id: UPX 3.94 Cop
0x390107972696768742028432920313939362dyright (C) 1996-
⋯14 more rows

Canonical trailing UPX PackHeader magic 0x397a1–0x39841

⋯7 more rows
0x39811c34f443c5d958492492495ff00000000.OD<]...I$......
0x398215550582100000000000000555058210dUPX!.......UPX!.
0x3983117090a74194550359777a450020000e5...t.EP5.w.P....
0x39841000000841a080050000086a0000000  .......P....... 