3 ms·
Interesting that they're presumably hiding behind Cloudflare, does it send a HTTP Host header? FWIW, it doesn't appear to be a new bit of malware - the same st
by samcrawford 12y ago
Interesting that they're presumably hiding behind Cloudflare, does it send a HTTP Host header?
FWIW, it doesn't appear to be a new bit of malware - the same strings match this pastebin from March - http://pastebin.com/xa87Gh7q http://pastebin.com/xa87Gh7q
- crypt1d 12y agoYes the syntax looks familiar, I got few more responses that match the commands from that pastebin. Seems like a general C&C setup where they just add new exploits as they get published. Anyhow, doesn't seem like it sends anything to Cloudflare. I think it just checks if the IP is alive (perhaps this is how it tests connectivity to the internet). It also checks my routing table and extracts the MAC address. P.S as of now, the CC server at 89.238.150.154:5 is not accessible.