I'm not sure if this has anything to do with OSBot, but linking the timestamps together it seems like the most plausible guess.

For some reason I seem to find tons of random 24 byte .dat files in my home directory, they're formatted like so: [uppercase md5 hash].dat

 

Does anyone know why these are popping up and what they're for? They seem to just contain random binary crap. Thanks for the help.

 

Example of what my home directory looks like:

hostname:~ Username$ ls -l
total 216
-rw-r--r--   1 Username  staff     24 Dec 14 23:58 013B7C6D260F2F184AA31F869B339D5C.dat
-rw-r--r--   1 Username  staff     24 Dec 19 17:22 040E35483D0E77EC5150849224803BF1.dat
-rw-r--r--   1 Username  staff     24 Dec 19 21:52 0B21DFB008D533ADDD871D02CD763B24.dat
-rw-r--r--   1 Username  staff     24 Nov  1 13:02 1E0755FC7B3E0B243E93E369BFDE47B5.dat
-rw-r--r--   1 Username  staff     24 Dec 19 20:25 2BA96FF3976F4068A00719041A60B4C0.dat
-rw-r--r--   1 Username  staff     24 Dec 19 19:36 4EA9320FC8112C60271B756FB27D9AA6.dat
-rw-r--r--   1 Username  staff     24 Dec 19 20:52 51304A38B36724DC66655D8B02E770DB.dat
-rw-r--r--   1 Username  staff     24 Dec 19 14:57 59FD4A472346A86736EF5599F6695714.dat
-rw-r--r--   1 Username  staff     24 Dec 19 21:15 6510418B27CBD0526F352E273A9C6465.dat
-rw-r--r--   1 Username  staff     24 Dec 19 13:13 7A1920D61156ABC05A60135AEFE8BC67.dat
-rw-r--r--   1 Username  staff     24 Dec 19 15:21 959A51A0777CD608BE4B82DAAE5A79A4.dat
-rw-r--r--   1 Username  staff     24 Dec 19 15:46 A8310E5CB13828145EE84640AA6F724F.dat
drwx------   7 Username  staff    238 Dec  1 22:35 Applications
-rw-r--r--   1 Username  staff     24 Dec 19 14:46 BC095AFB925F481F9E6A316AA67C9E4D.dat
-rw-r--r--   1 Username  staff     24 Dec 17 12:29 C42377796D72696FC41BF7591D6714AB.dat
drwx------+  7 Username  staff    238 Dec 19 23:18 Desktop
drwx------+ 13 Username  staff    442 Dec 16 18:59 Documents
drwx------+ 21 Username  staff    714 Dec 19 18:39 Downloads
-rw-r--r--   1 Username  staff     24 Dec 19 20:08 E71A47C8E18101F129AB8B3E9AD07F0A.dat
-rw-r--r--   1 Username  staff     24 Dec 19 19:19 F108D1502B207CFBAB5F8904326E20F0.dat
-rw-r--r--   1 Username  staff     24 Dec 19 21:41 F3CBDEA0D00A4113008B7FEF6C362CB4.dat
drwx------@ 76 Username  staff   2584 Sep 28 15:06 Library
drwx------+ 22 Username  staff    748 Dec 19 14:07 Movies
drwx------+ 18 Username  staff    612 Dec  2 12:18 Music
drwx------+ 51 Username  staff   1734 Dec 16 12:41 Pictures
drwxr-xr-x+  5 Username  staff    170 Sep 23 14:22 Public

Those are hexadecimal strings generated by the rs client to identify sessions