Open-source atomic malware analysis

Analyze another

fcf212cf6e53b7d3a42f42ab4e162fe42ff886836b39952e308a022e87a29cd4

ELF
Verdict: HOSTILE
AI IoT botnet with persistence and DoS
Mal-ecule
O₆(CICaEr₇P₆La₂)H₆(Cm₁₄F₉DbOs₃Po₃Ti)Md₃(BiHe)
Size 400.8 KB download
First seen 14 days ago
Analyzed 14 days ago
Ecosystem linux
Source abuse.ch
Also detected by 2 sources
Native IoT persistence and kworker masquerade: pid.powerpc:0x5ec2b
Native bot embeds an oversized HTTP POST flood: pid.powerpc:0x5c406
IoT bot with CNC banner and HTTP flood: pid.powerpc:0x5c08e
pid.powerpc elf
0x1672e 0d1711150c1114226f4d584b4e4e430d ......."oMXKNNC.
0x1673e 170c12020a754b4c464d5551026c7602 .....uKLFMUQ.lv.
0x1674e 140c131902756d751416190250541811 .....umu....PT..
0x1675e 1a0c120b02654741494d0d1012131212 .....eGAIM......
0x1676e 13121302644b5047444d5a0d111a0c12 ....dKPGDMZ.....
0x1677e 027147436f4d4c49475b0d100c111722 .qGCoMLIG[....."
0x1678e 4a565652180d0d5555550c5751475043 JVVR...UUU.WQGPC
0x1679e 45474c565156504b4c450c414d4f0d64 EGLVQVPKLE.AMO.d
0x167ae 4b5047444d5a10170c127d4b467d131b KPGDMZ....}KF}..
0x167be 1513120c524a52226f4d584b4e4e430d ....RJR"oMXKNNC.
0x167ce 170c12020a6e4b4c575a1902634c4650 .....nKLWZ..cLFP
0x167de 4d4b4602160c160c101902716f0f7611 MKF........qo.v.
0x167ee 11126c770260574b4e460d696d76161b ..lw.`WKNF.imv..
0x167fe 6a0b026352524e47754740694b560d17 j..cRRNGuG@iKV..
0x1680e 11150c1114020a696a766f6e0e024e4b .......ijvon..NK
0x1681e 494702654741494d0b02614a504d4f47 IG.eGAIM..aJPMOG
0x1682e 0d16170c120c101617160c1a16027143 ..............qC
0x1683e 4443504b0d1711150c1114226f4d584b DCPK......."oMXK
0x1684e 4e4e430d170c12020a4b724346190261 NNC......KrCF..a
0x1685e 7277026d7102147d127d13024e4b4947 rw.mq..}.}..NKIG
0x1686e 026f4341026d71027a0b026352524e47 .oCA.mq.z..cRRNG
0x1687e 754740694b560d uG@iKV.
0x5bfa7 3980010014382100107c0803a64e8000 9....8!..|...N..
0x5bfb7 202f00656c007368002d630078383600 /.el.sh.-c.x86.
0x5bfc7 61726d0070706300736834002f666400 arm.ppc.sh4./fd.
0x5bfd7 6933383600693638360061726d37006d i386.i686.arm7.m
0x5bfe7 6970730061726d380061726d35006d36 ips.arm8.arm5.m6
0x5bff7 386b0025732573000d0a0d0a002f6578 8k.%s%s....../ex
0x5c007 6500616d6436340061726d3634006172 e.amd64.arm64.ar
0x5c017 6d7637007070633634002f7069642e00 mv7.ppc64./pid..
0x5c027 61726d76350061726d7636002f70726f armv5.armv6./pro
0x5c037 63007838365f3634006d697073656c00 c.x86_64.mipsel.
0x5c047 2f70726f632f00756e6b6e6f776e0061 /proc/.unknown.a
0x5c057 61726368363400687474703a2f2f0048 arch64.http://.H
0x5c067 6172647761726500736f636b65743a5b ardware.socket:[
0x5c077 006d6f64656c206e616d650020286465 .model name. (de
0x5c087 6c6574656429002f746d702f7069642e leted)./tmp/pid.IoT bot with CNC banner and HTTP flood
0x5c097 2573002f70726f632f757074696d6500 %s./proc/uptime.
0x5c0a7 2f70726f632f637075696e666f002f70 /proc/cpuinfo./p
0x5c0b7 726f632f73656c662f657865002f7072 roc/self/exe./pr
0x5c0c7 6f632f6e65742f756e6978002f746d70 oc/net/unix./tmp
0x5c0d7 2f6274726163652e6c6f6700436f6e74 /btrace.log.Cont
0x5c0e7 656e742d4c656e6774683a00636f6e74 ent-Length:.cont
0x5c0f7 656e742d6c656e6774683a0000000000 ent-length:.....
0x5c107 260000005a0000005b0000005c000000 &...Z...[...\...
0x5c117 010000005d0000005e0000005f2f6574 ....]...^..._/et
0x5c127 632f6d616368696e652d6964000008c1 c/machine-id....
0x5c137 240008c1760008c1af00000000737973 $...v........sys
0x5c147 74656d642f6e6f746966792d00524543 temd/notify-.REC
0x5c157 565f305f54454152444f574e0a003031 V_0_TEARDOWN..01
0x5c167 3233343536373839616263646566002f 23456789abcdef./
0x5c177 7661722f6c69622f646275732f6d6163 var/lib/dbus/mac
0x5c187 68696e652d6964008520f0098930a754 hine-id.. ...0.T
0x5c197 748b7ddcb43ef75a0dbf3a0d26381af4 t.}..>.Z..:.&8..
0x5c1a7 eba4a98eaa9b4e6a2f70726f632f7379 ......Nj/proc/sy
0x5c1b7 732f6b65726e656c2f72616e646f6d2f s/kernel/random/
0x5c1c7 626f6f745f6964005b44454255475d20 boot_id.[DEBUG]
0x5c1d7 496e6974696174696e6720636f6e6e65 Initiating conneDebug banner initiating CNC connection
0x5c1e7 6374696f6e20746f20434e430a004745 ction to CNC..GE
0x5c1f7 5420257320485454502f312e300d0a48 T %s HTTP/1.0..H
0x5c207 6f73743a2025730d0a557365722d4167 ost: %s..User-Ag
0x5c217 656e743a204d6f7a696c6c612f352e30 ent: Mozilla/5.0
0x5c227 0d0a436f6e6e656374696f6e3a20636c ..Connection: cl
0x5c237 6f73650d0a0d0a000000002f0020000d ose......../. ..
0x5c247 0a005f3d00743d00763d007463700047 .._=.t=.v=.tcp.G
0x5c257 45540050555400220d0a00504f535400 ET.PUT."...POST.
0x5c267 48454144002669643d002f6665656400 HEAD.&id=./feed.
0x5c277 746172676574002f6c6f67696e002f61 target./login./a
0x5c287 646d696e007373682d727361002f7365 dmin.ssh-rsa./se
0x5c297 61726368004f5054494f4e5300582d61 arch.OPTIONS.X-a
0x5c380 6c65002f6170692f76322f6974656d73 le./api/v2/items
0x5c390 002f77702d6c6f67696e2e7068700000 ./wp-login.php..
0x5c3a0 00000000000000030000000000000000 ................
0x5c3b0 0008c6a80008c70e0008c5d30008c5ef ................
0x5c3c0 436f6f6b69653a2073657373696f6e3d Cookie: session=
0x5c3d0 00436f6e74656e742d4c656e6774683a .Content-Length:
0x5c3e0 200020485454502f312e310d0a486f73 . HTTP/1.1..Hos
0x5c3f0 743a20004163636570742d4c616e6775 t: .Accept-Langu
0x5c400 6167653a2000582d466f727761726465 age: .X-ForwardeIoT bot with CNC banner and HTTP flood
0x5c410 642d466f723a2000507261676d613a20 d-For: .Pragma:
0x5c420 6e6f2d63616368650d0a00000008c256 no-cache.......V
0x5c430 0008c2620008c2670008c29c0008c25a ...b...g.......Z
0x5c440 223b204e6f742041284272616e64223b "; Not A(Brand";
0x5c450 763d22005365632d46657463682d5573 v=".Sec-Fetch-Us
0x5c460 65723a203f310d0a00222c2022476f6f er: ?1...", "Goo
0x5c470 676c65204368726f6d65223b763d2200 gle Chrome";v=".
0x5c480 5365632d43682d55612d4d6f62696c65 Sec-Ch-Ua-Mobile
0x5c490 3a203f300d0a005365632d4665746368 : ?0...Sec-Fetch
0x5c4a0 2d536974653a206e6f6e650d0a005353 -Site: none...SS
0x5c4b0 482d322e302d4f70656e5353485f392e H-2.0-OpenSSH_9.
0x5c4c0 3370320d0a0000000000000000000056 3p2............V
0x5c4d0 00000096000000e100000137000001bf ...........7....
0x5c4e0 7370656564746573743a20736f636b65 speedtest: socke
0x5c4f0 74206661696c65640043616368652d43 t failed.Cache-C
0x5c500 6f6e74726f6c3a206e6f2d6361636865 ontrol: no-cache
0x5c510 0d0a00582d466f727761726465642d46 ...X-Forwarded-F
0x5c520 6f723a20312e322e332e340d0a005365 or: 1.2.3.4...Se
0x5c530 632d46657463682d446573743a20646f c-Fetch-Dest: do
0x5c540 63756d656e740d0a005365632d466574 cument...Sec-Fet
0x5c550 63682d4d6f64653a206e617669676174 ch-Mode: navigat
0x5c560 650d0a00436f6e6e656374696f6e3a20 e...Connection:
0x5c570 6b6565702d616c6976650d0a0d0a0000 keep-alive......
0x5c580 0903040506070f111216181e1a1b1c20 ...............
0x5c590 21222325262728292a2b0a0e03130700 !"#%&'()*+......
0x5c5a0 0b051511020914060f010c081204100a ................
0x5c5b0 0d161718191a1b50726f78792d417574 .......Proxy-Aut
0x5c5c0 686f72697a6174696f6e3a2042617369 horization: Basi
0x5c5d0 6320004163636570742d456e636f6469 c .Accept-Encodi
0x5c5e0 6e673a2062722c20677a69700d0a0041 ng: br, gzip...A
0x5c5f0 63636570742d456e636f64696e673a20 ccept-Encoding:
0x5c600 6964656e746974790d0a005365632d46 identity...Sec-F
0x5c610 657463682d536974653a2063726f7373 etch-Site: cross
0x5c620 2d736974650d0a006469666669652d68 -site...diffie-h
0x5c630 656c6c6d616e2d67726f757031382d73 ellman-group18-s
0x5c640 686135313200557067726164652d496e ha512.Upgrade-In
0x5c650 7365637572652d52657175657374 secure-Request
0x5c7f4 0008c27e0008c2d10008c3670008c294 ...~.......g....
0x5c804 0008c3750008c2db0008c3830008c391 ...u............
0x5c814 0008c2850008c2e50008c2ef0008c271 ...............q
0x5c824 4142434445464748494a4b4c4d4e4f50 ABCDEFGHIJKLMNOP
0x5c834 5152535455565758595a616263646566 QRSTUVWXYZabcdef
0x5c844 6768696a6b6c6d6e6f70717273747576 ghijklmnopqrstuv
0x5c854 7778797a303132333435363738392b2f wxyz0123456789+/
0x5c864 00000000000000000000001800000032 ...............2
0x5c874 00000047000000620000007a00000093 ...G...b...z....
0x5c884 000000a9000000c3000000d1000000e9 ................
0x5c894 000001030000011b000001360000014d ...........6...M
0x5c8a4 000001690000017d00000198000001b6 ...i...}........
0x5c8b4 000001cb25732025733f257520485454 ....%s %s?%u HTT
0x5c8c4 502f312e310d0a486f73743a2025730d P/1.1..Host: %s.
0x5c8d4 0a557365722d4167656e743a204d6f7a .User-Agent: Moz
0x5c8e4 696c6c612f352e300d0a436f6e6e6563 illa/5.0..Connec
0x5c8f4 74696f6e3a206b6565702d616c697665 tion: keep-alive
0x5c904 0d0a582d466f727761726465642d466f ..X-Forwarded-Fo
0x5c914 723a2025752e25752e25752e25750d0a r: %u.%u.%u.%u..
0x5c924 0d0a0000000441a40004487400044d10 ......A...Ht..M.
0x5c934 0004531400045a3c000461c000046780 ..S...Z<..a...g.
0x5c944 00046db80004760c00047bcc00047d54 ..m...v...{...}T
0x5c954 000482280004832800057e3000058270 ...(...(..~0...p
0x5c964 0005ab5c000484b0000573040005bcbc ...\......s.....
0x5c974 0005cc0c0005dc800005ef7400048638 ...........t...8
0x5c984 0004896c0005e41c0006422800065a44 ...l......B(..ZD
0x5c994 00066a88504f5354202f20485454502f ..j.POST / HTTP/Native bot embeds an oversized HTTP POST flood
0x5c9a4 312e310d0a486f73743a2025730d0a55 1.1..Host: %s..U
0x5c9b4 7365722d4167656e743a204d6f7a696c ser-Agent: Mozil
0x5c9c4 6c612f352e3020282573290d0a436f6e la/5.0 (%s)..Con
0x5c9d4 74656e742d547970653a206170706c69 tent-Type: appli
0x5c9e4 636174696f6e2f782d7777772d666f72 cation/x-www-for
0x5c9f4 6d2d75726c656e636f6465640d0a436f m-urlencoded..CoIoT bot with CNC banner and HTTP flood
0x5ca04 6e74656e742d4c656e6774683a203231 ntent-Length: 21
0x5ca14 34373438333634370d0a436f6e6e6563 47483647..Connec
0x5ca24 74696f6e3a206b6565702d616c697665 tion: keep-alive
0x5ca34 0d0a00474c0f77710e474c19531f120c ...GL.wq.GL.S...
0x5ca44 1b00474c0f77710e474c19531f120c1b ..GL.wq.GL.S....
0x5ca54 0e475119531f120c1a00474c0f65600e .GQ.S.....GL.e`.
0x5ca64 474c19531f120c1b0e474c0f77711953 GL.S.....GL.wq.S
0x5ca74 1f120c1a00474c19531f120c1b0e4647 .....GL.S.....FG
0x5ca84 19531f120c1a0044500f64700e445019 .S.....DP.dp.DP.
0x5ca94 531f120c1b0e474c19531f120c1a0047 S.....GL.S.....G
0x5caa4 4c0f61630e474c19531f120c1b0e4450 L.ac.GL.S.....DP
0x5cab4 0f616319531f120c1a0050570f70770e .ac.S.....PW.pw.
0x5cac4 505719531f120c1b0e474c19531f120c PW.S.....GL.S...
0x5cad4 1a0048430f68720e484319531f120c1b ..HC.hr.HC.S....
0x5cae4 0e474c19531f120c1a0052560f60700e .GL.S.....RV.`p.
0x5ebab 67696e7800646863706400646f636b65 ginx.dhcpd.docke
0x5ebbb 72007068702d66706d0073797374656d r.php-fpm.system
0x5ebcb 6400727379736c6f6764006972716261 d.rsyslogd.irqba
0x5ebdb 6c616e6365005b6b626c6f636b642f30 lance.[kblockd/0
0x5ebeb 5d005b6b626c6f636b642f315d005b65 ].[kblockd/1].[e
0x5ebfb 7874342d726376795d00646275732d64 xt4-rcvy].dbus-d
0x5ec0b 61656d6f6e005b6b7468726f746c642f aemon.[kthrotld/
0x5ec1b 305d005b6a6264322f646d302d385d00 0].[jbd2/dm0-8].
0x5ec2b 5b6b776f726b65722f303a305d005b6b [kworker/0:0].[kNative IoT persistence and kworker masquerade
0x5ec3b 776f726b65722f303a315d005b6b776f worker/0:1].[kwoIoT bot with CNC banner and HTTP flood
0x5ec4b 726b65722f313a305d005b6b776f726b rker/1:0].[kwork
0x5ec5b 65722f313a315d005b6b776f726b6572 er/1:1].[kworker
0x5ec6b 2f323a305d005b6b776f726b65722f32 /2:0].[kworker/2
0x5ec7b 3a315d005b6b776f726b65722f333a30 :1].[kworker/3:0
0x5ec8b 5d005b6b776f726b65722f753a305d00 ].[kworker/u:0].
0x5ec9b 5b6b776f726b65722f753a315d005b6b [kworker/u:1].[k
0x5ecab 776f726b65722f753a325d00000008ec worker/u:2].....
0x5ecbb 2b0008ec390008ec470008ec550008ec +...9...G...U...
0x5eccb 630008ec710008ec7f0008ec8d0008ec c...q...........
0x5ecdb 9b0008eca90008ec110008ebe10008eb ................
0x5eceb ed0008ec1e0008ebf90008ebb60008eb ................
0x5ecfb bd0008ebaa0008eba00008ebcd0008eb ................
0x5ed0b c50008ec050008ebb00008eba50008eb ................
0x5ed1b 9c0008ebd656002f62696e2f002f6d61 .....V./bin/./ma
0x5ed2b 7073002f7362696e2f002f6d656d6664 ps./sbin/./memfd
0x5ed3b 3a00736f636b65743a5b002f636d646c :.socket:[./cmdl
0x5ed4b 696e65002f6465762f66642f002f656e ine./dev/fd/./en
0x5ed5b 7669726f6e002f7573722f6c69622f00 viron./usr/lib/.
0x5ed6b 2f7573722f62696e2f002f6465762f73 /usr/bin/./dev/s
0x5ed7b 686d2f00202864656c6574656429002f hm/. (deleted)./
0x5ed8b 7573722f7362696e2f00000017091315 usr/sbin/.......
0x5ed9b b31d7b915fce852f7573722f6c6f6361 ..{._../usr/loca
0x5edab 6c2f004c445f5052454c4f41443d0000 l/.LD_PRELOAD=..
0x5edbb 000008edd50008ede30008ee032f6c69 ............./li
0x5edcb 622f73797374656d64002f6465762f77 b/systemd./dev/w
0x5eddb 61746368646f67002f6465762f776174 atchdog./dev/wat
0x5edeb 6368646f673000303132333435363738 chdog0.012345678
0x5edfb 39414243444546002f6465762f6d6973 9ABCDEF./dev/mis
0x5ee0b 632f7761746368646f6700094e4f5051 c/watchdog..NOPQ
0x5ee1b 5253545557585931696b7274730e0f10 RSTUWXY1ikrts...
0x5ee2b 111213141f1e151617191a1c1d2a2b2c .............*+,
0x5ee3b 2d3233343538393a3b56686a6c707175 -234589:;Vhjlpqu
0x5ee4b 29454773680073736864006261736800 )EGsh.sshd.bash.
0x5ee5b 776765740074667470006375726c002f wget.tftp.curl./
0x5ee6b 62696e2f002f6c69622f002f7362696e bin/./lib/./sbin
0x5ee7b 2f0062757379626f78002f7573722f62 /.busybox./usr/b
0x5ee8b 696e2f002f7573722f7362696e2f002f in/./usr/sbin/./
0x5ee9b 7573722f6c6f63616c2f00d903053a07 usr/local/....:.

Objectives

Micro-behaviors

Metadata

20 of 36 traits shown

Identity

SHA-256 fcf212cf6e53b7d3a42f42ab4e162fe42ff886836b39952e308a022e87a29cd4
Filename pid.powerpc
Package fcf212cf6e53b7d3a42f42ab4e162fe42ff886836b39952e308a022e87a29cd4

Origin

Source harvest
Feed malwarebazaar
Ecosystem linux
Domain abuse.ch

Timeline

First seen 10 Aug 2026 01:41 UTC
First analyzed 10 Aug 2026 08:03 UTC
Last analyzed 10 Aug 2026 14:19 UTC
Last updated 10 Aug 2026 14:19 UTC

Labeling

Label bad
Label source harvest
Traits version 73866