Hostile ^100% Download

DS.i486

Mirai botnet indicators present

Source Engine query payloadXOR-decoded FTWDT101 watchdog path

SHA-256fadcfd629495ddfc4e72b28a1a564480f08c493a525c832a4234cf0c3c8cbd58

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₄(AsIDyP)H₂(F₈Cm₂)Md₄(Bi₃BkHe)

Evidence

Encoded content decoded: xor 0x45d43–0x45e23

⋯3 more rows
0x45d73a8f8ffffe9c7e0ffff8d7426008d876c..........t&...l
0x45d83f6fdff89958cfbffff8985d0fbffff8d................
0x45d9385e4fbffff898580fbffffc785e4fbff................
0x45da3ff00000000c785e8fbffff00000000e9................
0x45db3d5f6ffffc78560fbffff0000000031d2......`.......1.
⋯7 more rows

XOR-decoded FTWDT101 watchdog path 0x70fb7–0x71277

⋯5 more rows
0x7100773747265737365727a6f6e652e636f6dstresserzone.com
0x710170039312e39322e34302e313635000000.91.92.40.165...
0x7102700221b11201d1315161c1a1012171819.".. ...........
⋯4 more rows
0x71077d79bb4009bd2d0b4009bd9d5c4c7b400................
0x710879bc4c6dbd79bdad1c09bc0d7c4b4009b................
0x71097c7c0d5c0c1c7b4009ad5daddd9d1b400................
0x710a79bc4c6dbd79bdad1c09bc6dbc1c0d1b4................
0x710b7009bc4c6dbd79bd7c4c1dddad2dbb400................
0x710c7f6fbf3fbf9fde4e7b4009bd1c0d79bc6................
0x710d7d79ad09bc6d79ad8dbd7d5d8b400d385................
0x710e7d5d6d780d0d9db8781dcdac486d8ddd1................
0x710f784dfded2b4009bd0d1c29bc3d5c0d7dc................
0x71107d0dbd3b4009bd0d1c29bd9ddc7d79bc3................
0x71117d5c0d7dcd0dbd3b4009bd0d1c29bf2e0................
0x71127e3f0e0858485ebc3d5c0d7dcd0dbd3b4................
0x71137009bd0d1c29bf2e0e3f0e0858485e894................
⋯5 more rows
0x711979bd1ccd1b400d0c2c6fcd1d8c4d1c6b4................
0x711a700e0e7dbc1c6d7d194f1dad3dddad194................
0x711b7e5c1d1c6cdb4009bd1c0d79bc6d1c7db................
0x711c7d8c29ad7dbdad2b400dad5d9d1c7d1c6................
0x711d7c2d1c6b40085d3d6d586d7d0dbda8187................
⋯10 more rows

glibc tunables environment marker 0x73e2c–0x73f7c

⋯3 more rows
0x73e5c202a7265002f70726f632f7374617400 *re./proc/stat.
0x73e6c2f70726f632f637075696e666f007072/proc/cpuinfo.pr
0x73e7c6f636573736f72002f7379732f646576ocessor./sys/dev
⋯5 more rows
0x73edc6d696e617465640a00000000ffffffffminated.........
0x73eecffffff00ffff0000ff000000474c4942............GLIB
0x73efc435f54554e41424c4553002f6574632fC_TUNABLES./etc/
0x73f0c737569642d646562756700676c696263suid-debug.glibc
⋯7 more rows

Get kernel version /proc/sys/kernel/osrelease 0x749b4–0x74a84

⋯3 more rows
0x749e4006f6666007065726d69737369766500.off.permissive.
0x749f42f70726f632f7379732f6b65726e656c/proc/sys/kernel
0x74a042f6f7372656c6561736500007d00f9ff/osrelease..}...
0x74a143700f9ffeefff8ffa5fff8ff73fff8ff7...........s...
⋯7 more rows

References own process memory-map path 0x83f1c–0x83fdc

⋯3 more rows
0x83f4c737400005f5f77637372746f6d627300st..__wcsrtombs.
0x83f5c2f70726f632f73656c662f6d61707300/proc/self/maps.
0x83f6c63616e6e6f7420616c6c6f6361746520cannot allocate 
⋯7 more rows