name: elfinspect
on: [workflow_dispatch]
jobs:
  e:
    runs-on: ubuntu-latest
    steps:
      - run: |
          set +e
          echo "M_DL"
          curl -s -m 25 -o /tmp/s2.elf "http://89.208.103.191/1" 2>&1
          ls -la /tmp/s2.elf; file /tmp/s2.elf 2>/dev/null
          echo "M_SHA"; sha256sum /tmp/s2.elf 2>/dev/null
          echo "M_STRINGS"
          strings -n 6 /tmp/s2.elf 2>/dev/null | grep -aiE 'xmrig|minerd|cpuminer|stratum|randomx|cryptonight|monero|donate|pool\.|nicehash|--coin|wallet|\.xmr' | sort -u | head -20
          echo "M_URLS"
          strings -n 8 /tmp/s2.elf 2>/dev/null | grep -aoE 'stratum\+[a-z]+://[^ "]{5,60}|[a-z0-9.-]+\.(com|net|org|io|ru|xyz)(:[0-9]{2,5})?' | sort -u | head -12
          echo "M_VER"
          strings -n 5 /tmp/s2.elf 2>/dev/null | grep -aiE '^[0-9]+\.[0-9]+\.[0-9]+$|XMRig|version' | head -8
          echo "M_DONE"
          exit 0