Comment

Comment by patapon

Only one of the binaries is for arm (tfti). Others are for x86 and mips. All symbols are stripped off the binaries. I only see two quick clues : an irc server url, and two japanese strings that also appear in this article : http://www.edison-newworld.com/2017/09/linuxtsunami-malware-...

Perl scripts join an IRC chan, wait for commands and google for vulnerable sites to exploit and/or exploit them. They also contain a nice list of proxies.

Do you know how you got hacked ?

parent patapon 8 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton