[spam][crazy] bomb malware

Karl gmkarl at gmail.com
Mon Dec 13 02:12:50 PST 2021


I found some log4j malware!  Somebody sent it to an old disrupted hacker
list.

Log4J Malware/
Log4J Malware/Mirai/
Log4J
Malware/Mirai/3f6120ca0ff7cf6389ce392d4018a5e40b131a083b071187bf54c900e2edad26.sh
Log4J
Malware/Mirai/776c341504769aa67af7efc5acc66c338dab5684a8579134d3f23165c7abcc00
Log4J Malware/Muhstik/
Log4J
Malware/Muhstik/15e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b
Log4J Malware/Kinsing/
Log4J
Malware/Kinsing/7e9663f87255ae2ff78eb882efe8736431368f341849fec000543f027bdb4512.sh
Log4J
Malware/Kinsing/6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b.elf

What is this stuff????

0507 ET, 20% phone battery

$ less
Kinsing/7e9663f87255ae2ff78eb882efe8736431368f341849fec000543f027bdb4512.sh

OK, somebody's AI has never heard of for loops because this shell script is
ridiculous.  The code looks generated and is irritating to review.

Looks like it terminates a lot of processes and wipes a lot of logs.

oop:
BIN_MD5="648effa354b3cbaad87b45f48d59c616"
BIN_DOWNLOAD_URL="http://92.242.40.21/kinsing"
BIN_DOWNLOAD_URL2="http://92.242.40.21/kinsing"
BIN_NAME="kinsing"

I tried downloading it quick but no reply, so if nobody else tee'd them off
I probably just did.  maybe later in the file it shows how to knock.  maybe
the associated .elf is the file.  who knows!

0512 19% battery
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2265 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks/attachments/20211213/94a7e932/attachment.txt>


More information about the cypherpunks mailing list