Open-source atomic malware analysis

Analyze another

5dc7cef8a389cbd45cef863b10f2657e471101c1b4db34acba289b33066886ed

ELF
Verdict: HOSTILE
AI KillBotX MIPS malware with DDoS capabilities
Mal-ecule
K₂(McAm)O₄(I₂P₃Er₃As)H₅(F₁₀Cm₁₆DbOs₇Po₅)Md(Bi₃)Th
Size 70.7 KB download
First seen 1 day ago
Analyzed 1 day ago
Ecosystem linux
Source abuse.ch
Also detected by 2 sources
Native binary installs both cron and systemd persistence: upx@0
Bundled Linux daemon skiplist (rival-bot): upx@0
Binary contains a UPX packing marker: killbotx.mipsel
killbotx.mipsel elf
0x0 7f454c46010101000000000000000000 .ELF............
0x10 03000800010000008804010034000000 ............4...
0x20 00000000071000003400200002002800 ........4. ...(.
0x30 00000000010000000000000000000000 ................
0x40 00000000d2180100d218010005000000 ................
0x50 00000100010000000000000000000200 ................
0x60 0000020000000000e8a9010006000000 ................
0x70 000001001210c43e5550582154140d1e .......>UPX!T...
0x80 00000000248d0200248d0200f4000000 ....$...$.......
0x90 6d0000000e0000001a03003f91458468 m..........?.E.h
0xa0 3bdedea611c27e99a600ac0757ed53c8 ;.....~.....W.S.
0xb0 6e8c01cafc6497e61552d6df5c0e8bd5 n....d...R..\...
0xc0 79ccc108d7fc24cdf4f5f87aa36909d1 y.....$....z.i..
0xd0 d6377439e54caa95e481b2d6cff99881 .7t9.L..........
0xe0 0458a6af4d6250341f6b8ba47ed82108 .X..MbP4.k..~.!.
0xf0 fd34df789a3bd538cf746a76001a3ec0 .4.x.;.8.tjv..>.
0x100 e3c5e608e6387f02000bff00000e0000 .....8..........
0x110 001a0300006e2448e8124460d233896c .....n$H..D`.3.l
0x120 8f97faaebc6e497f361fa5cfbdc16b76 .....nI.6.....kv
0x130 372416f2566fcc119601a9299a6e8f69 7$..Vo.....).n.i
0x140 2410e54dead0a4fab4435463bc073628 $..M.....CTc..6(
0x150 855f6107eec9f0eb7280778e32d49830 ._a.....r.w.2..0
0x160 51764ad59137224e3e975fa7b890f444 QvJ..7"N>._....D
0x170 127d6b35357d16b74858881562d6fb13 .}k55}..HX..b...
0x180 cd0a33a47efb044b8e5c1adff52b8b8c ..3.~..K.\...+..
0x190 7bf0ccdd5982df88955d4e22ae102f4b {...Y....]N"../K
0x1a0 733f03606aeab20d9597c46c568d24a5 s?.`j......lV.$.
0x1b0 82c512cc51791a773a91912de8455ca2 ....Qy.w:..-.E\.
0x1c0 34047112ef8d6fdc08e68912e0ec3634 4.q...o.......64
0x1d0 e4c301cf8165a9f1e222f7dc77dcb3f7 .....e..."..w...
0x1e0 794cbf7a09419ecaa3ca359ce0f9e14e yL.z.A....5....N
0x1f0 7b70a6ab33045b92ceafb884524240f8 {p..3.[.....RB@.
0x200 071822baeb0ad35811bb567242dc4bc9 .."....X..VrB.K.
0x210 174db151e6e59704a71804da6563856a .M.Q........ec.j
0x220 9938677f096db9a9d5632ee9ec44e09b .8g..m...c...D..
0x230 d69a2a9ac1b7efd24ed6cdaa281db787 ..*.....N...(...
0x1878 8705a8e2c6e459cd112d0d5c9c782359 ......Y..-.\.x#Y
0x1888 7d1744d5c15bcab4521b633e22839fe2 }.D..[..R.c>"...
0x1898 cb3778b012e222b81d79af7f43ab8851 .7x..."..y..C..Q
0x18a8 d37950b93e4e7f810efa3b1c198ef3f3 .yP.>N....;.....
0x18b8 a099cc368d19cdf322e372970d960ac5 ...6....".r.....
0x18c8 8ea9a5b19b0ba486f160e6cae0cd962a .........`.....*
0x18d8 f1314817849994ed1c57d71ccf5476d8 .1H......W...Tv.
0x18e8 89f055b92f8bf9529b2f4d8ced0cc1e6 ..U./..R./M.....
0x18f8 f0b30effa29e7973d5171228241eb7be ......ys...($...
0x1908 05cf4d7df163770698fd068a54830fe6 ..M}.cw.....T...
0x1918 3669acfad533362e688be4777f8ec0b7 6i...36.h..w....
0x1928 14ababf7215126818253f74e4c095d0b ....!Q&..S.NL.].
0x1938 24f397fed937baa2d385705d90644ddd $....7....p].dM.
0x1948 57ea1fab8aa7019f610aaf7700deb965 W.......a..w...e
0x1958 4d0f257fae436629412b4ec82b9d11ed M.%..Cf)A+N.+...
0x1968 fa5362a15b2aaf14180497e17cdda7d7 .Sb.[*......|...
0x1978 f489ac0c23dba6aced091c0859b8ee8b ....#.......Y...
0x1988 e7e5b9ce76d80b4d6de8f21b2298955b ....v..Mm..."..[
0x1998 b44b91562b1ea455a91b15adfd2ae118 .K.V+..U.....*..
0x19a8 7ce774df342abcfad2f80ff16d7b04f3 |.t.4*......m{..
0x19b8 1ae61c41f7458065d2be420df672c56f ...A.E.e..B..r.o
0x19c8 2f5b1093921fa44a3069952bcb67957b /[.....J0i.+.g.{
0x19d8 c80fcfe1f294112f0d2d9cdaa2e745e9 ......./.-....E.
0x19e8 9800cd386ce79764950bbb80750648f1 ...8l..d....u.H.
0x19f8 1a8e7f4970eb3a3b28a142f68a466177 ...Ip.:;(.B..Faw
0x1a08 2e8d90a103a1d90fee7caa45218db99e .........|.E!...
0x1a18 ae5d43d4126d3f037d47018bbbe3702b .]C..m?.}G....p+
0x1a28 90be7a511ed1dc5e68de355aa2d91087 ..zQ...^h.5Z....
0x1a38 2c32472d6a495f8718a0291eec3f5ab7 ,2G-jI_...)..?Z.
0x1a48 a91e3a4cc290e3cc8909013afd957941 ..:L.......:..yA
0x1a58 e5f08fa9d6b79b6d0afc89ad61956e0d .......m....a.n.
0x1a68 cde86dde828ad2dedbcaafa8fd37448e ..m..........7D.
0x1a78 dd294ccefd0b1626ee777676b30f06ff .)L....&.wvv....
0x1a88 0747add66abaf3b125635a3e82912bfd .G..j...%cZ>..+.
0x1a98 3f122c0e0aacaffeb051a6c8a1dd2b18 ?.,......Q....+.
0x1aa8 d48d73a526ad43b9be743449fc932852 ..s.&.C..t4I..(R
0x1ab8 dab15abfff404541c9617ae625417ff5 ..Z..@EA.az.%A..
0x1ac8 76d645dd9487245ff31be3dc44e4f382 v.E...$_....D...
0x1ad8 f17819c499fd1b3aa8d5b927bfa039fe .x.....:...'..9.
0x1ae8 dbb2dfbe755fa8502a9968f8e72a74dc ....u_.P*.h..*t.
0x1af8 d9870262c13982a8a231b781002921e0 ...b.9...1...)!.
0x1b08 06dd782ee7f79166add4ffe749f33b62 ..x....f....I.;b
0x1b18 a49801a15d84b54442d07a97c5877107 ....]..DB.z...q.
0x1b28 2b4051f6440b28f3447f8422721b8d9b +@Q.D.(.D.."r...
0x1b38 7d8fb8ad69f3111df127316596e644eb }...i....'1e..D.
0x1b48 2f5f816f45e01751a7131e76c6d77619 /_.oE..Q...v..v.
0x1b58 cb58549afe2fa9b9efc952d53287f6b3 .XT../....R.2...
0x1b68 00c4917591525d3baba632f14093eb84 ...u.R];..2.@...
0x3e6c c38a64f33829e15a31d47c36f92837f6 ..d.8).Z1.|6.(7.
0x3e7c 4d9aa06e26bd1adb5afd4fb31ab93d59 M..n&...Z.O...=Y
0x3e8c 2042dea6b9e5830dd9b8bd0391b776c9 B............v.
0x3e9c 7c07d7a2581eb51f6788a61f4987ecba |...X...g...I...
0x3eac a2bad7d5ee08a11b540b2e76521f78dc ........T..vR.x.
0x3ebc c668d90708a56b589dfe688f27f97da9 .h....kX..h.'.}.
0x3ecc 8375d8d1880cc89a617b7c85c4e34fd4 .u......a{|...O.
0x3edc bea8bfa376eb445562e160873de0fd80 ....v.DUb.`.=...
0x3eec e19c460a2acf542b42509bb7e2729565 ..F.*.T+BP...r.e
0x3efc b783912f892c3108b3c47a48d853e6f7 .../.,1...zH.S..
0x3f0c b18cb2e32cfc588ca0101c64c1aa0d3e ....,.X....d...>
0x3f1c 2016951cee1a23f3fb6e29703e44fba0 .....#..n)p>D..
0x3f2c ead29e1bf09c55ea0a6fced110f7dddc ......U..o......
0x3f3c 5c7d67fa733165619f9545fbad1e6c3c \}g.s1ea..E...l<
0x3f4c 3b85873aac8eadedca0a8f18baa63f74 ;..:..........?t
0x3f5c e2fad768269e8956f1662ba1e77f981f ...h&..V.f+.....
0x3f6c c6b96fabd2f30b09b416e5d1f6b6f69c ..o.............
0x3f7c 65fdfbdfc8bc0f5c6459399c0004c2c2 e......\dY9.....
0x3f8c abb5ba010cf2f475289120 .......u(.
0x4049 948ef1e7a7d8e8b9c74cd32e7ecc22d7 .........L..~.".
0x4059 1d39781cbb4c4b26ef3995cd75433243 .9x..LK&.9..uC2C
0x4069 f96768c8236efa0ef66981432e529676 .gh.#n...i.C.R.v
0x4079 7dbcea354d0e468f1595ddcb564d2b46 }..5M.F.....VM+F
0x4089 1ce11c00fe66440f2f165760fe990b3b .....fD./.W`...;
0x4099 064346e79d0f24e2b0b6afdb02784cb6 .CF...$......xL.
0x40a9 f45cd1084554e8dc3ecfa1be0ea7e461 .\..ET..>......a
0x40b9 43cd2519ae67df85e474ac23b5d31344 C.%..g...t.#...D
0x40c9 78d94cac700143569abee29607d14d1b x.L.p.CV......M.
0x40d9 fdef8988ed6360f33d6b2cf76e40b710 .....c`.=k,.n@..
0x40e9 200d6bef4e98ecc2f773ea17de57326e .k.N....s...W2n
0x40f9 65638f3ed776edd1b4d193308536316f ec.>.v.....0.61o
0x4109 7297e1888ba7f9d2e1e98c r..........
0xe3dc b35ad51b1c60a66266af56c75ea5eed5 .Z...`.bf.V.^...
0xe3ec 5afdecd7d713e89e36aaf78def5af116 Z.......6....Z..
0xe3fc 925db560cba74c3cd97205bcd91d3c4f .].`..L<.r....<O
0xe40c dbdac491e2a6cf8c9c01a074db60c396 ...........t.`..
0xe41c 8554db3c877f67d9d45f6211dd85f2dd .T.<..g.._b.....
0xe42c 69955152afa6acba29766d24d05a92e6 i.QR....)vm$.Z..
0xe43c 2aed0c7c787a84645243edba85f0648c *..|xz.dRC....d.
0xe44c b26cf7f17e9a9dbc7f564baf3db24edf .l..~....VK.=.N.
0xe45c 5f65428ab3d60c8f2081cd278ec0781b _eB..... ..'..x.
0xe46c 00dd06dc651eb167db0728fbfc94def1 ....e..g..(.....
0xe47c c70d30c70b5776f10d2ccd914e46a911 ..0..Wv..,..NF..
0xe48c b28b643fc95b4d410ba6465a1710fbf0 ..d?.[MA..FZ....
0xe49c 305d40895c21f7be8bc544a33a967fe8 0]@.\!....D.:...
0xe4ac f57558da9afb7457683baa64768a2dd7 .uX...tWh;.dv.-.
0xe4bc 4a7d11473cfbc89116c8bf81704df552 J}.G<.......pM.R
0xe4cc f52852bd2633844fa1c29e0fe95a8158 .(R.&3.O.....Z.X
0xe4dc 8a00aa3b2901f613b0dd628a1180f03c ...;).....b....<
0xe4ec 364576bd6a0f124f5339273c3a69fa57 6Ev.j..OS9'<:i.W
0xe4fc 0deb38f301f3a52d6c6359 ..8....-lcY

Loading traits…

Identity

SHA-256 5dc7cef8a389cbd45cef863b10f2657e471101c1b4db34acba289b33066886ed
Canonical SHA-256 1c246410593a1d5bc31cf4d58c6905df5e30fa7948c23e82ed424d6c9e2198ec
Filename killbotx.mipsel
Package 5dc7cef8a389cbd45cef863b10f2657e471101c1b4db34acba289b33066886ed

Origin

Source harvest
Feed malwarebazaar
Ecosystem linux
Domain abuse.ch

Timeline

First seen 5 Aug 2026 23:01 UTC
First analyzed 5 Aug 2026 23:41 UTC
Last analyzed 5 Aug 2026 23:41 UTC
Last updated 5 Aug 2026 23:41 UTC

Labeling

Label bad
Label source harvest
Traits version b5ca8