Got one hit on my honneypot for #log4j during the night.
This one is not trying to bypass detection and still uses basic payload to trigger the jndi vuln.
This one is not trying to bypass detection and still uses basic payload to trigger the jndi vuln.
The IP address seems to still be up and responding, but the port is closed now.
The base64 payload decodes as a wget command to get a shell script on another server
The shell script downloads 3 ELF files and executes them, it is really simple but does the job
The ELFs seems to be part of the MIRAI botnet as shown by VT
776c341504769aa67af7efc5acc66c338dab5684a8579134d3f23165c7abcc00 x86
8052f5cc4dfa9a8b4f67280a746acbc099319b9391e3b495a27d08fb5f08db81 x86_64
2b794cc70cb33c9b3ae7384157ecb78b54aaddc72f4f9cf90b4a4ce4e6cf8984 x86_g
776c341504769aa67af7efc5acc66c338dab5684a8579134d3f23165c7abcc00 x86
8052f5cc4dfa9a8b4f67280a746acbc099319b9391e3b495a27d08fb5f08db81 x86_64
2b794cc70cb33c9b3ae7384157ecb78b54aaddc72f4f9cf90b4a4ce4e6cf8984 x86_g
2 new #Mirai botnet sample uploaded to virustotal thanks to the carelessness of the people who tried to drop it using #log4shell
7937bbe245511e3666b1f90661bc5fff1ae7bcb1cfda1e5aad9976b66d871c7f sh4
1de182015b280f40b04faac87424f3ae00db8bc90b3ec5d7c02092d72ca1b21e arm5
7937bbe245511e3666b1f90661bc5fff1ae7bcb1cfda1e5aad9976b66d871c7f sh4
1de182015b280f40b04faac87424f3ae00db8bc90b3ec5d7c02092d72ca1b21e arm5
• • •
Missing some Tweet in this thread? You can try to
force a refresh
