Edit tour

Linux Analysis Report
IdTVrdi0dC

Overview

General Information

Sample Name:	IdTVrdi0dC
Analysis ID:	634906
MD5:	4a6d63615986750505074e2fd62fb4ff
SHA1:	0549d8ba0c4cd7cdeb4ebc37e9dacad3c7186c8f
SHA256:	2eaced3f2dd6c845cc0cd8591a2d4959c20d45d3b1364195a7b42d4bf0879d91
Tags:	32elfmiraipowerpc
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Sample is packed with UPX

Uses known network protocols on non-standard ports

Connects to many ports of the same IP (likely port scanning)

Sample contains only a LOAD segment without any section mappings

Yara signature match

Deletes log files

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634906
Start date and time: 27/05/202201:58:17	2022-05-27 01:58:17 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IdTVrdi0dC
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.evad.lin@0/53@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://185.44.81.114/bins/mips;

Runtime Messages

Command:	/tmp/IdTVrdi0dC
PID:	6293
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6208, Parent: 1)

logrotate (PID: 6208, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6272, Parent: 6208)

gzip (PID: 6272, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6273, Parent: 6208)

sh (PID: 6273, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6274, Parent: 6273)

invoke-rc.d (PID: 6274, Parent: 6273, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6275, Parent: 6274)

runlevel (PID: 6275, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6278, Parent: 6274)

systemctl (PID: 6278, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6279, Parent: 6274)

ls (PID: 6279, Parent: 6274, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6280, Parent: 6274)

systemctl (PID: 6280, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6281, Parent: 6208)

gzip (PID: 6281, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6282, Parent: 6208)

sh (PID: 6282, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6283, Parent: 6282)

rsyslog-rotate (PID: 6283, Parent: 6282, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6284, Parent: 6283)

systemctl (PID: 6284, Parent: 6283, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6209, Parent: 1)

install (PID: 6209, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6249, Parent: 1)

find (PID: 6249, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6277, Parent: 1)

mandb (PID: 6277, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

IdTVrdi0dC (PID: 6293, Parent: 6126, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/IdTVrdi0dC

IdTVrdi0dC New Fork (PID: 6295, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6297, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6299, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6300, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6303, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6304, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6307, Parent: 6304)

IdTVrdi0dC New Fork (PID: 6317, Parent: 6307)

IdTVrdi0dC New Fork (PID: 6319, Parent: 6317)

IdTVrdi0dC New Fork (PID: 6309, Parent: 6304)

IdTVrdi0dC New Fork (PID: 6311, Parent: 6309)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
IdTVrdi0dC	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0xa00c:$s1: PROT_EXEC\|PROT_WRITE failed. 0xa07b:$s2: $Id: UPX 0xa02c:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.81.141

Timestamp:	192.168.2.23156.244.81.14158806528692027339 05/27/22-01:59:36.594856
SID:	2027339
Source Port:	58806
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.54.103

Timestamp:	192.168.2.23156.238.54.10360812372152835222 05/27/22-01:59:24.080046
SID:	2835222
Source Port:	60812
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.33.103

Timestamp:	192.168.2.23156.254.33.10341864528692027339 05/27/22-01:59:27.282691
SID:	2027339
Source Port:	41864
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.238.58.244

Timestamp:	192.168.2.23156.238.58.24450826528692027339 05/27/22-02:01:55.686882
SID:	2027339
Source Port:	50826
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.90.220

Timestamp:	192.168.2.23156.254.90.22041412528692027339 05/27/22-02:01:24.819246
SID:	2027339
Source Port:	41412
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.111.153

Timestamp:	192.168.2.23156.226.111.15343688528692027339 05/27/22-02:02:36.420093
SID:	2027339
Source Port:	43688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.26.50

Timestamp:	192.168.2.23156.230.26.5053942372152835222 05/27/22-02:00:48.185738
SID:	2835222
Source Port:	53942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.98.54

Timestamp:	192.168.2.23156.235.98.5460298528692027339 05/27/22-02:02:03.588566
SID:	2027339
Source Port:	60298
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.13.111

Timestamp:	192.168.2.23156.241.13.11156632528692027339 05/27/22-02:02:28.936352
SID:	2027339
Source Port:	56632
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.87.189

Timestamp:	192.168.2.23156.244.87.18949872372152835222 05/27/22-02:01:06.220662
SID:	2835222
Source Port:	49872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.239.152.59

Timestamp:	192.168.2.23156.239.152.5940308528692027339 05/27/22-02:01:21.193697
SID:	2027339
Source Port:	40308
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.77.199

Timestamp:	192.168.2.23156.226.77.19948134372152835222 05/27/22-02:01:06.437312
SID:	2835222
Source Port:	48134
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.86.129

Timestamp:	192.168.2.23156.241.86.12946264372152835222 05/27/22-02:02:18.660029
SID:	2835222
Source Port:	46264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.28.85

Timestamp:	192.168.2.23156.230.28.8541732528692027339 05/27/22-02:00:19.002233
SID:	2027339
Source Port:	41732
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.106.128

Timestamp:	192.168.2.23156.244.106.12856702528692027339 05/27/22-02:01:11.642375
SID:	2027339
Source Port:	56702
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.22.39

Timestamp:	192.168.2.23156.230.22.3938096372152835222 05/27/22-02:00:16.837999
SID:	2835222
Source Port:	38096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.105.121

Timestamp:	192.168.2.23156.226.105.12135478372152835222 05/27/22-02:01:56.434610
SID:	2835222
Source Port:	35478
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.127.89

Timestamp:	192.168.2.23156.250.127.8933082528692027339 05/27/22-02:01:11.692792
SID:	2027339
Source Port:	33082
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.107.174

Timestamp:	192.168.2.23156.241.107.17440134528692027339 05/27/22-02:00:15.088988
SID:	2027339
Source Port:	40134
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.9.85

Timestamp:	192.168.2.23156.241.9.8551482528692027339 05/27/22-01:59:14.781522
SID:	2027339
Source Port:	51482
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.106.31

Timestamp:	192.168.2.23156.254.106.3150638372152835222 05/27/22-02:00:15.083835
SID:	2835222
Source Port:	50638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.92.118

Timestamp:	192.168.2.23156.250.92.11838502528692027339 05/27/22-01:59:45.871877
SID:	2027339
Source Port:	38502
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.124.137

Timestamp:	192.168.2.23156.244.124.13751360528692027339 05/27/22-02:00:46.025240
SID:	2027339
Source Port:	51360
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.26.43

Timestamp:	192.168.2.23156.247.26.4345236372152835222 05/27/22-01:59:23.853441
SID:	2835222
Source Port:	45236
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.19.49

Timestamp:	192.168.2.23156.230.19.4956760372152835222 05/27/22-02:00:33.943501
SID:	2835222
Source Port:	56760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.102.45

Timestamp:	192.168.2.23156.226.102.4535730372152835222 05/27/22-02:01:54.932609
SID:	2835222
Source Port:	35730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.48.197

Timestamp:	192.168.2.23156.226.48.19734100372152835222 05/27/22-02:00:08.376395
SID:	2835222
Source Port:	34100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.245.62.167

Timestamp:	192.168.2.23156.245.62.16754588528692027339 05/27/22-02:00:19.890456
SID:	2027339
Source Port:	54588
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.86.198

Timestamp:	192.168.2.23156.244.86.19836702528692027339 05/27/22-02:00:35.358091
SID:	2027339
Source Port:	36702
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.78.96

Timestamp:	192.168.2.23156.241.78.9650658528692027339 05/27/22-02:00:11.610290
SID:	2027339
Source Port:	50658
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.74.182

Timestamp:	192.168.2.23156.226.74.18248786372152835222 05/27/22-01:59:44.097026
SID:	2835222
Source Port:	48786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.95.94

Timestamp:	192.168.2.23156.241.95.9447898372152835222 05/27/22-02:02:06.304012
SID:	2835222
Source Port:	47898
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.52.23

Timestamp:	192.168.2.23156.254.52.2345700528692027339 05/27/22-02:01:58.218787
SID:	2027339
Source Port:	45700
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.91.94

Timestamp:	192.168.2.23156.226.91.9455170372152835222 05/27/22-02:00:17.323160
SID:	2835222
Source Port:	55170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.122.125

Timestamp:	192.168.2.23156.241.122.12557538528692027339 05/27/22-02:00:35.351461
SID:	2027339
Source Port:	57538
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.74.55

Timestamp:	192.168.2.23156.244.74.5558358528692027339 05/27/22-02:02:21.920625
SID:	2027339
Source Port:	58358
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.115.252

Timestamp:	192.168.2.23156.241.115.25236214528692027339 05/27/22-01:59:30.621371
SID:	2027339
Source Port:	36214
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.24.199

Timestamp:	192.168.2.23156.224.24.19958360372152835222 05/27/22-01:59:34.881201
SID:	2835222
Source Port:	58360
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.78.250

Timestamp:	192.168.2.23156.226.78.25047808372152835222 05/27/22-02:01:59.662027
SID:	2835222
Source Port:	47808
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.82.153

Timestamp:	192.168.2.23156.244.82.15344694528692027339 05/27/22-02:01:58.247799
SID:	2027339
Source Port:	44694
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.41.165

Timestamp:	192.168.2.23156.254.41.16538674528692027339 05/27/22-01:59:15.425864
SID:	2027339
Source Port:	38674
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.92.40

Timestamp:	192.168.2.23156.250.92.4058054372152835222 05/27/22-02:00:25.009375
SID:	2835222
Source Port:	58054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.227.147

Timestamp:	192.168.2.23156.234.227.14757440372152835222 05/27/22-02:01:55.609934
SID:	2835222
Source Port:	57440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.106.244

Timestamp:	192.168.2.23156.244.106.24459616372152835222 05/27/22-01:59:12.396985
SID:	2835222
Source Port:	59616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.62.197.159

Timestamp:	192.168.2.2341.62.197.15951682372152835222 05/27/22-01:59:57.739942
SID:	2835222
Source Port:	51682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.109.162

Timestamp:	192.168.2.23156.244.109.16240398528692027339 05/27/22-01:59:15.954194
SID:	2027339
Source Port:	40398
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.182

Timestamp:	192.168.2.23156.254.59.18246002528692027339 05/27/22-01:59:38.854059
SID:	2027339
Source Port:	46002
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.73.186

Timestamp:	192.168.2.23156.244.73.18634582528692027339 05/27/22-02:00:17.389933
SID:	2027339
Source Port:	34582
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.92.71

Timestamp:	192.168.2.23156.250.92.7152864528692027339 05/27/22-02:00:30.406969
SID:	2027339
Source Port:	52864
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.20.143

Timestamp:	192.168.2.23156.230.20.14348324528692027339 05/27/22-02:01:08.553112
SID:	2027339
Source Port:	48324
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.21

Timestamp:	192.168.2.23156.254.59.2146148528692027339 05/27/22-02:00:14.853376
SID:	2027339
Source Port:	46148
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.78.122.212

Timestamp:	192.168.2.2341.78.122.21256684372152835222 05/27/22-02:01:37.012472
SID:	2835222
Source Port:	56684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.15.196

Timestamp:	192.168.2.23156.226.15.19640402372152835222 05/27/22-01:59:20.356979
SID:	2835222
Source Port:	40402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.85.137

Timestamp:	192.168.2.23156.226.85.13741602372152835222 05/27/22-02:00:07.712861
SID:	2835222
Source Port:	41602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.15.116

Timestamp:	192.168.2.23156.224.15.11642572528692027339 05/27/22-02:00:37.881857
SID:	2027339
Source Port:	42572
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.91.100

Timestamp:	192.168.2.23156.241.91.10050030528692027339 05/27/22-02:00:18.551698
SID:	2027339
Source Port:	50030
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.70.150

Timestamp:	192.168.2.23156.244.70.15033964372152835222 05/27/22-01:59:34.757301
SID:	2835222
Source Port:	33964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.17.76

Timestamp:	192.168.2.23156.247.17.7641420372152835222 05/27/22-02:01:13.912399
SID:	2835222
Source Port:	41420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.64.142

Timestamp:	192.168.2.23156.244.64.14244396372152835222 05/27/22-02:00:29.460742
SID:	2835222
Source Port:	44396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.84.30

Timestamp:	192.168.2.23156.241.84.3037158528692027339 05/27/22-02:01:06.103355
SID:	2027339
Source Port:	37158
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.231.83

Timestamp:	192.168.2.23156.234.231.8355454372152835222 05/27/22-01:59:47.462212
SID:	2835222
Source Port:	55454
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.58.142

Timestamp:	192.168.2.23156.254.58.14252614528692027339 05/27/22-02:01:55.460901
SID:	2027339
Source Port:	52614
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.69.212

Timestamp:	192.168.2.23156.241.69.21244796372152835222 05/27/22-02:00:07.160349
SID:	2835222
Source Port:	44796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 41.193.241.189

Timestamp:	192.168.2.2341.193.241.18951020528692027339 05/27/22-02:02:27.790700
SID:	2027339
Source Port:	51020
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.97.209

Timestamp:	192.168.2.23156.235.97.20942092528692027339 05/27/22-01:59:11.365155
SID:	2027339
Source Port:	42092
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.87.253

Timestamp:	192.168.2.23156.244.87.25341444528692027339 05/27/22-02:01:21.724866
SID:	2027339
Source Port:	41444
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.111.213

Timestamp:	192.168.2.23156.244.111.21334364372152835222 05/27/22-02:01:49.478596
SID:	2835222
Source Port:	34364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.125.137

Timestamp:	192.168.2.23156.241.125.13759590528692027339 05/27/22-02:02:33.353508
SID:	2027339
Source Port:	59590
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.44.183

Timestamp:	192.168.2.23156.238.44.18340602372152835222 05/27/22-01:59:21.924982
SID:	2835222
Source Port:	40602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.73.67

Timestamp:	192.168.2.23156.241.73.6741324372152835222 05/27/22-02:01:26.646996
SID:	2835222
Source Port:	41324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.17.129

Timestamp:	192.168.2.23156.247.17.12945064372152835222 05/27/22-02:02:26.831090
SID:	2835222
Source Port:	45064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.32.129

Timestamp:	192.168.2.23156.238.32.12940776372152835222 05/27/22-02:01:26.337550
SID:	2835222
Source Port:	40776
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.23.19

Timestamp:	192.168.2.23156.247.23.1940560372152835222 05/27/22-02:02:29.631312
SID:	2835222
Source Port:	40560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.94.204

Timestamp:	192.168.2.23156.241.94.20449800372152835222 05/27/22-02:01:10.590932
SID:	2835222
Source Port:	49800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.68.189

Timestamp:	192.168.2.23156.241.68.18940686528692027339 05/27/22-02:00:54.497921
SID:	2027339
Source Port:	40686
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.139.83

Timestamp:	192.168.2.23156.225.139.8359006528692027339 05/27/22-01:59:33.005431
SID:	2027339
Source Port:	59006
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.86.60

Timestamp:	192.168.2.23156.226.86.6052034372152835222 05/27/22-02:00:04.130060
SID:	2835222
Source Port:	52034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.21.39

Timestamp:	192.168.2.23156.230.21.3951456372152835222 05/27/22-02:01:32.609232
SID:	2835222
Source Port:	51456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.232.91.140

Timestamp:	192.168.2.23156.232.91.14047196372152835222 05/27/22-02:01:49.092359
SID:	2835222
Source Port:	47196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.84.164

Timestamp:	192.168.2.23156.250.84.16442614372152835222 05/27/22-01:59:31.466307
SID:	2835222
Source Port:	42614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.63.251

Timestamp:	192.168.2.23156.238.63.25155806372152835222 05/27/22-02:02:16.754251
SID:	2835222
Source Port:	55806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 197.214.96.76

Timestamp:	192.168.2.23197.214.96.7640638528692027339 05/27/22-01:59:53.606556
SID:	2027339
Source Port:	40638
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.55.116

Timestamp:	192.168.2.23156.254.55.11643886372152835222 05/27/22-01:59:09.829867
SID:	2835222
Source Port:	43886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.95.97

Timestamp:	192.168.2.23156.244.95.9744928372152835222 05/27/22-01:59:11.369422
SID:	2835222
Source Port:	44928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.21.42

Timestamp:	192.168.2.23156.247.21.4256234372152835222 05/27/22-02:01:14.340412
SID:	2835222
Source Port:	56234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.49.30

Timestamp:	192.168.2.23156.245.49.3060860372152835222 05/27/22-02:01:35.971454
SID:	2835222
Source Port:	60860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.11.236

Timestamp:	192.168.2.23156.250.11.23657594528692027339 05/27/22-01:59:17.459127
SID:	2027339
Source Port:	57594
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.103.248

Timestamp:	192.168.2.23156.241.103.24836054372152835222 05/27/22-02:00:23.723270
SID:	2835222
Source Port:	36054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.131.245

Timestamp:	192.168.2.23197.246.131.24551946372152835222 05/27/22-02:01:56.320167
SID:	2835222
Source Port:	51946
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.13.173

Timestamp:	192.168.2.23156.226.13.17332948372152835222 05/27/22-02:01:58.818532
SID:	2835222
Source Port:	32948
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.153.134

Timestamp:	192.168.2.23156.225.153.13438534528692027339 05/27/22-02:01:55.645339
SID:	2027339
Source Port:	38534
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.17.7

Timestamp:	192.168.2.23156.230.17.753602372152835222 05/27/22-02:00:57.236010
SID:	2835222
Source Port:	53602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.90.175

Timestamp:	192.168.2.23156.244.90.17548954528692027339 05/27/22-02:01:12.861867
SID:	2027339
Source Port:	48954
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.153.115

Timestamp:	192.168.2.23156.225.153.11546282372152835222 05/27/22-02:00:30.753840
SID:	2835222
Source Port:	46282
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.83.202

Timestamp:	192.168.2.23156.244.83.20259496528692027339 05/27/22-01:59:50.344265
SID:	2027339
Source Port:	59496
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.48.219

Timestamp:	192.168.2.23156.226.48.21956620528692027339 05/27/22-02:01:12.803099
SID:	2027339
Source Port:	56620
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.64.92

Timestamp:	192.168.2.23156.241.64.9257610372152835222 05/27/22-01:59:29.238933
SID:	2835222
Source Port:	57610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.119.157

Timestamp:	192.168.2.23156.241.119.15760482528692027339 05/27/22-01:59:39.082470
SID:	2027339
Source Port:	60482
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.100.98

Timestamp:	192.168.2.23156.244.100.9832892528692027339 05/27/22-02:01:55.160357
SID:	2027339
Source Port:	32892
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.74.228

Timestamp:	192.168.2.23156.244.74.22833762528692027339 05/27/22-02:02:01.306520
SID:	2027339
Source Port:	33762
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.227.241.10

Timestamp:	192.168.2.23156.227.241.1052928528692027339 05/27/22-02:01:50.961196
SID:	2027339
Source Port:	52928
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.79.24

Timestamp:	192.168.2.23156.254.79.2459036528692027339 05/27/22-02:01:03.615589
SID:	2027339
Source Port:	59036
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.50.72

Timestamp:	192.168.2.23156.226.50.7253032528692027339 05/27/22-02:01:17.282629
SID:	2027339
Source Port:	53032
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.97.161

Timestamp:	192.168.2.23156.254.97.16138488372152835222 05/27/22-02:00:16.843487
SID:	2835222
Source Port:	38488
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.116.88

Timestamp:	192.168.2.23156.244.116.8833914372152835222 05/27/22-01:59:52.728837
SID:	2835222
Source Port:	33914
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.115.96

Timestamp:	192.168.2.23156.250.115.9644040528692027339 05/27/22-02:01:55.737151
SID:	2027339
Source Port:	44040
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.96.152

Timestamp:	192.168.2.23156.235.96.15244412372152835222 05/27/22-02:01:39.860809
SID:	2835222
Source Port:	44412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.75.43

Timestamp:	192.168.2.23156.226.75.4348582528692027339 05/27/22-02:00:26.512225
SID:	2027339
Source Port:	48582
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.81.19

Timestamp:	192.168.2.23156.250.81.1945382372152835222 05/27/22-02:02:04.097360
SID:	2835222
Source Port:	45382
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.21.152

Timestamp:	192.168.2.23156.224.21.15241288372152835222 05/27/22-02:01:54.117029
SID:	2835222
Source Port:	41288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.114.185

Timestamp:	192.168.2.23156.250.114.18555492372152835222 05/27/22-02:00:34.147798
SID:	2835222
Source Port:	55492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.10.77

Timestamp:	192.168.2.23156.241.10.7736376372152835222 05/27/22-02:01:58.507926
SID:	2835222
Source Port:	36376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.107.128

Timestamp:	192.168.2.23156.240.107.12838328372152835222 05/27/22-02:01:36.170451
SID:	2835222
Source Port:	38328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.115.235

Timestamp:	192.168.2.23156.250.115.23536014528692027339 05/27/22-02:00:28.975937
SID:	2027339
Source Port:	36014
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.110.153

Timestamp:	192.168.2.23156.241.110.15356256372152835222 05/27/22-02:01:58.258420
SID:	2835222
Source Port:	56256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.9.85

Timestamp:	192.168.2.23156.224.9.8542998372152835222 05/27/22-02:00:44.448215
SID:	2835222
Source Port:	42998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.83.83

Timestamp:	192.168.2.23156.244.83.8350380528692027339 05/27/22-02:01:58.512058
SID:	2027339
Source Port:	50380
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.107.166

Timestamp:	192.168.2.23156.244.107.16658722528692027339 05/27/22-02:02:21.932784
SID:	2027339
Source Port:	58722
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.81.244

Timestamp:	192.168.2.23156.244.81.24446998528692027339 05/27/22-01:59:46.159096
SID:	2027339
Source Port:	46998
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.19.205

Timestamp:	192.168.2.23156.230.19.20548094372152835222 05/27/22-02:02:34.126639
SID:	2835222
Source Port:	48094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.119.150

Timestamp:	192.168.2.23156.244.119.15059104528692027339 05/27/22-02:01:32.144220
SID:	2027339
Source Port:	59104
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.24.7

Timestamp:	192.168.2.23156.247.24.749256372152835222 05/27/22-01:59:20.596556
SID:	2835222
Source Port:	49256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.8.62

Timestamp:	192.168.2.23156.250.8.6239124528692027339 05/27/22-02:00:21.894988
SID:	2027339
Source Port:	39124
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.232.95.161

Timestamp:	192.168.2.23156.232.95.16152518372152835222 05/27/22-02:01:43.911283
SID:	2835222
Source Port:	52518
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.94.36

Timestamp:	192.168.2.23156.244.94.3637970372152835222 05/27/22-01:59:35.272349
SID:	2835222
Source Port:	37970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.137.15

Timestamp:	192.168.2.23156.225.137.1545166528692027339 05/27/22-02:01:09.406968
SID:	2027339
Source Port:	45166
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.91

Timestamp:	192.168.2.23156.254.59.9150450528692027339 05/27/22-02:00:21.503092
SID:	2027339
Source Port:	50450
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.88.198

Timestamp:	192.168.2.23156.241.88.19835890528692027339 05/27/22-02:00:59.100766
SID:	2027339
Source Port:	35890
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.105.123

Timestamp:	192.168.2.23156.235.105.12336360528692027339 05/27/22-02:00:46.055414
SID:	2027339
Source Port:	36360
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.232.95.51

Timestamp:	192.168.2.23156.232.95.5137688528692027339 05/27/22-02:00:40.261876
SID:	2027339
Source Port:	37688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.112.26

Timestamp:	192.168.2.23156.241.112.2640084372152835222 05/27/22-01:59:37.267591
SID:	2835222
Source Port:	40084
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.98.140

Timestamp:	192.168.2.23156.226.98.14046226528692027339 05/27/22-02:00:56.365384
SID:	2027339
Source Port:	46226
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.94.48

Timestamp:	192.168.2.23156.241.94.4832996372152835222 05/27/22-02:02:10.711942
SID:	2835222
Source Port:	32996
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.90.76

Timestamp:	192.168.2.23156.226.90.7648608372152835222 05/27/22-02:00:20.202547
SID:	2835222
Source Port:	48608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.72.72

Timestamp:	192.168.2.23156.244.72.7235322528692027339 05/27/22-02:02:01.523460
SID:	2027339
Source Port:	35322
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.94.26

Timestamp:	192.168.2.23156.250.94.2639952528692027339 05/27/22-02:00:43.534578
SID:	2027339
Source Port:	39952
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.56.234

Timestamp:	192.168.2.23156.245.56.23437958372152835222 05/27/22-02:02:18.656583
SID:	2835222
Source Port:	37958
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.79.175

Timestamp:	192.168.2.23156.244.79.17551328372152835222 05/27/22-01:59:38.565688
SID:	2835222
Source Port:	51328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.84.108

Timestamp:	192.168.2.23156.254.84.10859450372152835222 05/27/22-01:59:46.564418
SID:	2835222
Source Port:	59450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.44.190

Timestamp:	192.168.2.23156.238.44.19044604372152835222 05/27/22-02:01:54.959373
SID:	2835222
Source Port:	44604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.55.168

Timestamp:	192.168.2.23156.254.55.16844094372152835222 05/27/22-01:59:24.100328
SID:	2835222
Source Port:	44094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.111.170

Timestamp:	192.168.2.23156.226.111.17045034528692027339 05/27/22-02:00:21.892038
SID:	2027339
Source Port:	45034
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.24.127

Timestamp:	192.168.2.23156.226.24.12737400372152835222 05/27/22-02:00:47.670144
SID:	2835222
Source Port:	37400
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.69.154

Timestamp:	192.168.2.23156.226.69.15439230528692027339 05/27/22-02:01:17.460017
SID:	2027339
Source Port:	39230
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.17.132

Timestamp:	192.168.2.23156.247.17.13241798528692027339 05/27/22-02:01:57.974569
SID:	2027339
Source Port:	41798
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.122.59

Timestamp:	192.168.2.23156.250.122.5936524372152835222 05/27/22-01:59:26.957137
SID:	2835222
Source Port:	36524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.9.162

Timestamp:	192.168.2.23156.226.9.16241224372152835222 05/27/22-02:00:11.258185
SID:	2835222
Source Port:	41224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.65.168

Timestamp:	192.168.2.23156.241.65.16838068372152835222 05/27/22-02:01:37.321901
SID:	2835222
Source Port:	38068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.86.126

Timestamp:	192.168.2.23156.250.86.12647748528692027339 05/27/22-02:00:38.554220
SID:	2027339
Source Port:	47748
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.51.115

Timestamp:	192.168.2.23156.226.51.11539150372152835222 05/27/22-02:01:16.789476
SID:	2835222
Source Port:	39150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.92.232

Timestamp:	192.168.2.23156.254.92.23237656372152835222 05/27/22-02:01:29.348977
SID:	2835222
Source Port:	37656
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.54.157

Timestamp:	192.168.2.23156.226.54.15733994372152835222 05/27/22-02:02:15.142084
SID:	2835222
Source Port:	33994
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.82.220

Timestamp:	192.168.2.23156.254.82.22034904528692027339 05/27/22-02:02:21.966924
SID:	2027339
Source Port:	34904
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.75.0

Timestamp:	192.168.2.23156.244.75.051058528692027339 05/27/22-01:59:20.270104
SID:	2027339
Source Port:	51058
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.112.51

Timestamp:	192.168.2.23156.244.112.5133208372152835222 05/27/22-02:00:07.655644
SID:	2835222
Source Port:	33208
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.156.29

Timestamp:	192.168.2.23156.225.156.2947620372152835222 05/27/22-01:59:25.449564
SID:	2835222
Source Port:	47620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.74.232

Timestamp:	192.168.2.23156.241.74.23242836528692027339 05/27/22-01:59:35.587913
SID:	2027339
Source Port:	42836
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.18.63

Timestamp:	192.168.2.23156.224.18.6349984528692027339 05/27/22-02:01:58.907491
SID:	2027339
Source Port:	49984
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.120.114

Timestamp:	192.168.2.23156.241.120.11460550528692027339 05/27/22-01:59:30.128446
SID:	2027339
Source Port:	60550
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.61.255

Timestamp:	192.168.2.23156.238.61.25560542372152835222 05/27/22-02:00:06.879400
SID:	2835222
Source Port:	60542
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.13.223

Timestamp:	192.168.2.23156.241.13.22357166372152835222 05/27/22-01:59:25.691089
SID:	2835222
Source Port:	57166
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.31.130

Timestamp:	192.168.2.23156.224.31.13038708372152835222 05/27/22-02:01:40.026999
SID:	2835222
Source Port:	38708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.59.122

Timestamp:	192.168.2.23156.254.59.12240468372152835222 05/27/22-02:02:18.907439
SID:	2835222
Source Port:	40468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.105.74

Timestamp:	192.168.2.23156.240.105.7447002372152835222 05/27/22-01:59:55.467525
SID:	2835222
Source Port:	47002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.76.48

Timestamp:	192.168.2.23156.244.76.4854348372152835222 05/27/22-01:59:30.483658
SID:	2835222
Source Port:	54348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.243.250

Timestamp:	192.168.2.23156.227.243.25060450372152835222 05/27/22-01:59:52.671121
SID:	2835222
Source Port:	60450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.18.158

Timestamp:	192.168.2.23156.224.18.15858570528692027339 05/27/22-02:01:55.533063
SID:	2027339
Source Port:	58570
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.93.225.76

Timestamp:	192.168.2.23156.93.225.7634494528692027339 05/27/22-02:01:24.598749
SID:	2027339
Source Port:	34494
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.67

Timestamp:	192.168.2.23156.235.102.6758594372152835222 05/27/22-02:01:55.776959
SID:	2835222
Source Port:	58594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.118.194

Timestamp:	192.168.2.23156.250.118.19436896372152835222 05/27/22-02:01:32.653094
SID:	2835222
Source Port:	36896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.113.241

Timestamp:	192.168.2.23156.250.113.24148532528692027339 05/27/22-01:59:55.530262
SID:	2027339
Source Port:	48532
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.141.245

Timestamp:	192.168.2.23156.225.141.24554112528692027339 05/27/22-02:02:13.388905
SID:	2027339
Source Port:	54112
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.135.131

Timestamp:	192.168.2.23156.225.135.13156976372152835222 05/27/22-02:01:37.392743
SID:	2835222
Source Port:	56976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.82.45

Timestamp:	192.168.2.23156.241.82.4556192372152835222 05/27/22-02:00:24.990098
SID:	2835222
Source Port:	56192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.65.197

Timestamp:	192.168.2.23156.254.65.19744380528692027339 05/27/22-02:00:38.336694
SID:	2027339
Source Port:	44380
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.14.5

Timestamp:	192.168.2.23156.224.14.555720372152835222 05/27/22-02:00:57.236114
SID:	2835222
Source Port:	55720
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.19.201

Timestamp:

192.168.2.23156

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report
IdTVrdi0dC

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Snort Signatures

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report IdTVrdi0dC

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Snort Signatures

Linux Analysis Report
IdTVrdi0dC