From 21a3a3c6f9ba1015af1e50cd6c6703bcc40efa41 Mon Sep 17 00:00:00 2001 From: chkgp9q90qi Date: Thu, 29 Oct 2026 01:55:31 +0000 Subject: [PATCH] elfinspect --- .gitea/workflows/elfinspect.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .gitea/workflows/elfinspect.yml diff --git a/.gitea/workflows/elfinspect.yml b/.gitea/workflows/elfinspect.yml new file mode 100644 index 0000000..5b69ab4 --- /dev/null +++ b/.gitea/workflows/elfinspect.yml @@ -0,0 +1,20 @@ +name: elfinspect +on: [workflow_dispatch] +jobs: + e: + runs-on: ubuntu-latest + steps: + - run: | + set +e + echo "M_DL" + curl -s -m 25 -o /tmp/s2.elf "http://89.208.103.191/1" 2>&1 + ls -la /tmp/s2.elf; file /tmp/s2.elf 2>/dev/null + echo "M_SHA"; sha256sum /tmp/s2.elf 2>/dev/null + echo "M_STRINGS" + strings -n 6 /tmp/s2.elf 2>/dev/null | grep -aiE 'xmrig|minerd|cpuminer|stratum|randomx|cryptonight|monero|donate|pool\.|nicehash|--coin|wallet|\.xmr' | sort -u | head -20 + echo "M_URLS" + strings -n 8 /tmp/s2.elf 2>/dev/null | grep -aoE 'stratum\+[a-z]+://[^ "]{5,60}|[a-z0-9.-]+\.(com|net|org|io|ru|xyz)(:[0-9]{2,5})?' | sort -u | head -12 + echo "M_VER" + strings -n 5 /tmp/s2.elf 2>/dev/null | grep -aiE '^[0-9]+\.[0-9]+\.[0-9]+$|XMRig|version' | head -8 + echo "M_DONE" + exit 0