Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
WU3D24p3h0.elf

Overview

General Information

Sample Name:WU3D24p3h0.elf
Original Sample Name:aa7bec0933c6e3ae75ba8ebcd80298af.elf
Analysis ID:1345568
MD5:aa7bec0933c6e3ae75ba8ebcd80298af
SHA1:5508852870443a95501ec1ccb4f48171dc9cee79
SHA256:ec1dd8fe9c2ea023c05097458899dbab73ab5ce4f5b1779f1a67ee2a8a9b1df2
Tags:32elfmiraisparc
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox Version:38.0.0 Ammolite
Analysis ID:1345568
Start date and time:2023-11-21 03:59:03 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:WU3D24p3h0.elf
renamed because original name is a hash value
Original Sample Name:aa7bec0933c6e3ae75ba8ebcd80298af.elf
Detection:MAL
Classification:mal76.troj.linELF@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:/tmp/WU3D24p3h0.elf
PID:6208
Exit Code:
Exit Code Info:
Killed:True
Standard Output:
Rakitin
selfrep started
Rakitin.
[watchdog] failed to find a valid watchdog driver, bailing out
selfrep started
Rakitin.
[watchdog] failed to find a valid watchdog driver, bailing out
selfrep started
Rakitin.
[scanner] scanner process initialized. scanning started.
[scanner] FD4 request sent to 139.128.111.178
[scanner] FD5 request sent to 13.68.235.178
[scanner] FD6 request sent to 138.12.103.109
[scanner] FD4 request sent to 109.222.60.42
[scanner] FD5 request sent to 87.141.189.178
[scanner] FD6 request sent to 137.244.158.5
[scanner] FD4 request sent to 241.27.147.2
[scanner] FD5 request sent to 91.201.245.210
[scanner] FD6 request sent to 29.137.187.94
[scanner] FD4 request sent to 123.46.67.118
[scanner] FD5 request sent to 110.94.104.42
[scanner] FD6 request sent to 153.206.32.109
[scanner] FD4 request sent to 110.125.255.2
[scanner] FD5 request sent to 6.254.232.178
[scanner] FD6 request sent to 213.155.183.42
[scanner] FD4 request sent to 121.161.134.79
[scanner] FD5 request sent to 116.103.54.5
[scanner] FD6 request sent to 223.137.117.37
[scanner] FD4 request sent to 81.77.1.109
[scanner] FD6 request sent to 106.180.255.94
[scanner] FD5 request sent to 64.5.64.79
[scanner] FD4 request sent to 74.224.78.212
[scanner] FD6 request sent to 5.175.164.118
[scanner] FD4 request sent to 107.192.9.178
[scanner] FD5 request sent to 245.225.42.94
[scanner] FD6 request sent to 199.104.4.94
[scanner] FD4 request sent to 15.87.124.178
[scanner] FD5 request sent to 129.120.250.210
[scanner] FD6 request sent to 154.5.127.118
[scanner] FD4 request sent to 106.124.2.118
[scanner] FD5 request sent to 26.90.249.178
[scanner] FD4 request sent to 88.67.202.118
[scanner] FD6 request sent to 65.176.35.109
[scanner] FD5 request sent to 4.99.221.118
[scanner] FD6 request sent to 126.119.239.37
[scanner] FD4 request sent to 158.39.112.212
[scanner] FD5 request sent to 224.92.233.94
[scanner] FD6 request sent to 164.13.197.37
[scanner] FD4 request sent to 205.42.131.94
[scanner] FD5 request sent to 226.64.69.178
[scanner] FD6 request sent to 101.151.230.79
[scanner] FD4 request sent to 246.188.60.37
[scanner] FD5 request sent to 125.169.181.210
[scanner] FD6 request sent to 94.202.132.2
[scanner] FD4 request sent to 16.92.39.94
[scanner] FD5 request sent to 33.20.200.94
[scanner] FD6 request sent to 4.117.193.210
[scanner] FD4 request sent to 31.177.125.118
[scanner] FD5 request sent to 125.37.163.94
[scanner] FD4 request sent to 176.105.87.79
[scanner] FD6 request sent to 142.210.18.212
[scanner] FD4 request sent to 196.223.254.79
[scanner] FD5 request sent to 88.1.251.42
[scanner] FD6 request sent to 170.214.244.212
[scanner] FD4 request sent to 228.19.79.79
[scanner] FD5 request sent to 32.129.7.79
[scanner] FD4 request sent to 39.75.120.94
[scanner] FD6 request sent to 70.72.111.42
[scanner] FD4 request sent to 5.55.35.5
[scanner] FD5 request sent to 71.33.232.5
[scanner] FD6 request sent to 159.110.45.42
[scanner] FD4 request sent to 194.76.8.212
[scanner] FD5 request sent to 114.82.88.178
[scanner] FD6 request sent to 27.25.191.210
[scanner] FD4 request sent to 53.89.193.109
[scanner] FD5 request sent to 171.70.20.212
[scanner] FD6 request sent to 85.12.223.79
[scanner] FD4 request sent to 76.80.13.118
[scanner] FD5 request sent to 232.222.30.79
[scanner] FD6 request sent to 5.203.221.37
[scanner] FD4 request sent to 151.216.231.42
[scanner] FD5 request sent to 228.81.138.79
[scanner] FD6 request sent to 84.87.102.37
[scanner] FD4 request sent to 68.207.149.42
[scanner] FD5 request sent to 227.238.0.212
[scanner] FD6 request sent to 67.233.28.212
[scanner] FD4 request sent to 142.98.63.79
[scanner] FD5 request sent to 94.214.181.5
[scanner] FD6 request sent to 25.145.170.212
[scanner] FD4 request sent to 245.172.29.109
[scanner] FD5 request sent to 130.192.79.210
[scanner] FD6 request sent to 213.41.42.5
[scanner] FD4 request sent to 104.28.25.118
[scanner] FD5 request sent to 205.254.189.210
[scanner] FD6 request sent to 121.38.71.118
[scanner] FD4 request sent to 225.206.84.94
[scanner] FD5 request sent to 26.14.158.2
[scanner] FD6 request sent to 140.82.67.178
[scanner] FD4 request sent to 133.79.72.5
[scanner] FD5 request sent to 138.87.125.79
[scanner] FD6 request sent to 28.169.84.178
[scanner] FD4 request sent to selfrep started
Rakitin.
[main] We are the only process on this system!
[scanner] Scanner process initialized. Scanning started.
[scanner] FD5 Attempting to brute found IP 150.55.131.61
[scanner] FD6 Attempting to brute found IP 150.55.131.61
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD7 Attempting to brute found IP 207.81.69.86
[scanner] FD7 connected. Trying [91mf`eezga[32m:[91mf`eezga
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91m `e
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD8 Attempting to brute found IP 45.166.213.58
[scanner] FD8 connected. Trying [91mqtpxz{[32m:[91m
[scanner] FD6 connected. Trying [91mqpst`ya[32m:[91m
[scanner] FD8 finished telnet negotiation
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD8 received username prompt
[scanner] FD6 connected. Trying [91mtqx|{[32m:[91m$$$$$$
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[table] Tried to double-lock value
[scanner] FD8 received password prompt
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m&0-22'0B
[scanner] FD8 received shell prompt
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6B[32m:[91mwB
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m

B
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91mafy|{`m
[scanner] FD6 connected. Trying [91mspqvB[32m:[91m!-/!#16B
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mqtpxz{[32m:[91m
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91m!&'$
[scanner] FD5 connected. Trying [91m`fpg[32m:[91m`fpg
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91m#&/+,B[32m:[91mptrs*:B
[scanner] FD5 connected. Trying [91mf`eezga[32m:[91mf`eezga
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91mt{afyd
[scanner] FD5 connected. Trying [91mgzza[32m:[91mt{~z
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD8 received sh prompt
[scanner] FD8 received sh prompt
[scanner] FD5 connected. Trying [91mgzza[32m:[91m`|q(%
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mr`pfa[32m:[91m$'&! #
[scanner] FD8 received shell prompt
[scanner] FD5 connected. Trying [91m0--6[32m:[91m6'.'!-/#&/+,B
[scanner] FD9 Attempting to brute found IP 219.98.196.69
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD9 connected. Trying [91mgzza[32m:[91mflfapx
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m--6B
[scanner] FD5 connected. Trying [91m0--6[32m:[91m#/15B
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91m`t{apv}
[scanner] FD28.14.250.79
[scanner] FD5 request sent to 149.138.64.5
[scanner] FD6 request sent to 113.244.176.178
[scanner] FD4 request sent to 212.15.163.118
[scanner] FD5 request sent to 165.107.243.118
[scanner] FD6 request sent to 108.188.216.118
[scanner] FD4 request sent to 250.217.221.42
[scanner] FD5 request sent to 86.235.99.94
[scanner] FD6 request sent to 119.92.147.37
[scanner] FD4 request sent to 137.83.184.2
[scanner] FD5 request sent to 211.57.254.5
[scanner] FD6 request sent to 145.51.84.178
[scanner] FD4 request sent to 146.128.151.118
[scanner] FD5 request sent to 183.249.124.212
[scanner] FD6 request sent to 245.175.108.178
[scanner] FD4 request sent to 136.98.197.118
[scanner] FD5 request sent to 22.248.162.5
[scanner] FD6 request sent to 69.160.135.79
[scanner] FD4 request sent to 26.181.231.118
[scanner] FD5 request sent to 79.115.180.37
[scanner] FD6 request sent to 220.174.183.37
[scanner] FD4 request sent to 150.224.211.94
[scanner] FD5 request sent to 16.175.163.42
[scanner] FD4 request sent to 2.244.120.94
[scanner] FD5 request sent to 249.221.163.178
[scanner] FD6 request sent to 65.207.1.210
[scanner] FD4 request sent to 37.77.74.42
[scanner] FD5 request sent to 163.166.168.210
[scanner] FD6 request sent to 33.67.148.109
[scanner] FD4 request sent to 10.102.50.109
[scanner] FD5 request sent to 211.149.43.109
[scanner] FD6 request sent to 34.122.86.5
[scanner] FD4 request sent to 160.239.201.5
[scanner] FD5 request sent to 186.210.132.37
[scanner] FD6 request sent to 131.204.184.37
[scanner] FD4 request sent to 206.43.152.79
[scanner] FD5 request sent to 87.105.19.210
[scanner] FD6 request sent to 97.107.69.210
[scanner] FD4 request sent to 157.20.136.118
[scanner] FD5 request sent to 107.103.101.109
[scanner] FD6 request sent to 89.33.27.210
[scanner] FD4 request sent to 44.200.124.2
[scanner] FD5 request sent to 216.141.194.94
[scanner] FD6 request sent to 243.1.164.94
[scanner] FD4 request sent to 209.145.23.178
[scanner] FD5 request sent to 201.180.175.210
[scanner] FD6 request sent to 121.53.255.2
[scanner] FD4 request sent to 231.185.50.118
[scanner] FD5 request sent to 201.254.180.118
[scanner] FD6 request sent to 248.2.118.109
[scanner] FD4 request sent to 71.188.1.37
[scanner] FD5 request sent to 140.96.143.118
[scanner] FD6 request sent to 42.113.49.37
[scanner] FD4 request sent to 54.36.123.5
[scanner] FD5 request sent to 44.144.65.79
[scanner] FD6 request sent to 57.86.176.210
[scanner] FD4 request sent to 63.148.62.5
[scanner] FD5 request sent to 88.189.120.79
[scanner] FD6 request sent to 147.216.193.178
[scanner] FD4 request sent to 112.245.67.5
[scanner] FD5 request sent to 161.189.225.42
[scanner] FD6 request sent to 181.49.241.118
[scanner] FD4 request sent to 21.19.204.212
[scanner] FD5 request sent to 125.233.96.178
[scanner] FD6 request sent to 12.41.142.118
[scanner] FD4 request sent to 3.21.96.2
[scanner] FD5 request sent to 242.178.4.109
[scanner] FD6 request sent to 252.24.51.5
[scanner] FD4 request sent to 55.24.43.79
[scanner] FD5 request sent to 105.7.39.37
[scanner] FD6 request sent to 178.232.103.109
[scanner] FD4 request sent to 141.76.116.5
[scanner] FD5 request sent to 7.73.134.210
[scanner] FD6 request sent to 133.80.155.5
[scanner] FD4 request sent to 240.175.147.212
[scanner] FD5 request sent to 53.191.105.79
[scanner] FD6 request sent to 6.89.236.5
[scanner] FD4 request sent to 105.132.152.5
[scanner] FD5 request sent to 238.19.238.42
[scanner] FD6 request sent to 187.70.181.109
[scanner] FD4 request sent to 147.74.132.210
[scanner] FD5 request sent to 119.222.63.118
[scanner] FD6 request sent to 120.110.22.109
[scanner] FD4 request sent to 90.67.7.5
[scanner] FD5 request sent to 205.46.222.109
[scanner] FD6 request sent to 214.229.247.94
[scanner] FD4 request sent to 30.193.248.5
[scanner] FD5 request sent to 64.95.39.2
[scanner] FD6 request sent to 60.151.198.2
[scanner] FD4 request sent to 195.10.140.94
[scanner] FD5 request sent to 46.3.228.118
[scanner] FD6 request sent to 166.116.5.37
[scanner] FD4 request sent to 229.89.93.5
[scanner] FD5 request sent to 94.57.246.94
[scanner] FD6 request sent to 204.129.178.42
[scanner] FD4 request sent to 76.73.139.42
[scanner] FD5 request sent to 26.179.247.5
[scanner] FD6 request sent to 193.58.36.178
[scanner] FD4 request sent to 106.228.181.79
[scanner] FD5 request sent to 7.63.74.94
[scanner] FD6 request sent to 65.162.151.5
[scanner] FD4 request sent to 199.161.194.79
[scanner] FD5 request sent to 130.19.5.42
[scanner] FD6 request sent to 44.131.74.37
[scanner] FD4 request sent to 249.250.17.178
[scanner] FD5 request sent to 54.141.247.94
[scanner] FD6 request sent to 61.180.237.79
[scanner] FD4 request sent to 124.82.57.178
[scanner] FD5 request sent to 210.76.23.178
[scanner] FD6 request sent to 144.99.214.210
[scanner] FD4 request sent to 71.81.63.109
[scanner] FD5 request sent to 157.14.212.94
[scanner] FD6 request sent to 109.7.152.5
[scanner] FD4 request sent to 139.140.6.210
[scanner] FD5 request sent to 245.38.90.37
[scanner] FD6 request sent to 175.152.164.178
[scanner] FD4 request sent to 130.235.82.118
[scanner] FD5 request sent to 143.172.118.210
[scanner] FD6 request sent to 22.123.254.118
[scanner] FD4 request sent to 110.90.254.212
[scanner] FD5 request sent to 121.218.214.5
[scanner] FD6 request sent to 139.51.58.79
[scanner] FD4 request sent to 213.38.133.42
[scanner] FD5 request sent to 25.199.71.37
[scanner] FD6 request sent to 110.158.90.79
[scanner] FD4 request sent to 130.255.124.2
[scanner] FD5 request sent to 239.213.253.42
[scanner] FD6 request sent to 183.204.164.210
[scanner] FD4 request sent to 96.232.145.94
[scanner] FD5 request sent to 0.136.91.79
[scanner] FD6 request sent to 172.225.161.109
[scanner] FD4 request sent to 158.73.41.94
[scanner] FD5 request sent to 112.130.52.37
[scanner] FD6 request sent to 24.68.223.37
[scanner] FD4 request sent to 75.208.131.212
[scanner] FD5 request sent to 192.21.197.118
[scanner] FD6 request sent to 187.123.221.212
[scanner] FD4 request sent to 210.169.171.79
[scanner] FD5 request sent to 213.159.225.94
[scanner] FD6 request sent to 171.7.30.109
[scanner] FD4 request sent to 23.70.240.94
[scanner] FD5 request sent to 132.151.173.210
[scanner] FD6 request sent to 160.60.245.118
[scanner] FD4 request sent to 212.116.176.178
[scanner] FD5 request sent to 27.111.76.94
[scanner] FD6 request sent to 78.165.241.109
[scanner] FD4 request sent to 169.42.46.94
[scanner] FD5 request sent to 143.2.82.42
[scanner] FD6 request sent to 9.175.22.212
[scanner] FD4 request sent to 133.36.34.118
[scanner] FD5 request sent to 150.89.243.2
[scanner] FD6 request sent to 253.62.220.37
[scanner] FD4 request sent to 163.135.44.109
[scanner] FD5 request sent to 148.106.50.109
[scanner] FD6 request sent to 60.157.249.210
[scanner] FD4 request sent to 27.235.16.2
[scanner] FD5 request sent to 187.84.71.37
[scanner] FD6 request sent to 160.212.163.210
[scanner] FD4 request sent to 171.127.30.94
[scanner] FD5 request sent to 78.245.246.109
[scanner] FD6 request sent to 84.132.204.2
[scanner] FD4 request sent to 208.78.236.37
[scanner] FD5 request sent to 249.80.229.94
[scanner] FD6 request sent to 128.1.40.37
[scanner] FD4 request sent to 160.67.72.2
[scanner] FD5 request sent to 151.235.242.2
[scanner] FD6 request sent to 116.73.217.118
[scanner] FD4 request sent to 206.178.221.118
[scanner] FD5 request sent to 10.154.5.94
[scanner] FD6 request sent to 90.146.158.118
[scanner] FD4 request sent to 5.255.34.94
[scanner] FD5 request sent to 248.238.67.37
[scanner] FD6 request sent to 51.128.214.118
[scanner] FD4 request sent to 90.8.24.94
[scanner] FD5 request sent to 149.243.115.42
[scanner] FD6 request sent to 126.205.202.79
[scanner] FD4 request sent to 245.33.94.118
[scanner] FD5 request sent to 73.201.251.2
[scanner] FD6 request sent to 180.242.170.37
[scanner] FD4 request sent to 234.155.218.210
[scanner] FD5 request sent to 22.54.219.212
[scanner] FD6 request sent to 101.137.38.42
[scanner] FD4 request sent to 72.5.55.5
[scanner] FD5 request sent to 74.46.132.94
[scanner] FD6 request sent to 190.239.47.94
[scanner] FD4 request sent to 189.58.117.212
[scanner] FD5 request sent to 254.40.131.2
[scanner] FD5 connected. Trying [91m`fpg[32m:[91m`fpg
[scanner] FD10 Attempting to brute found IP 134.63.251.23
[scanner] FD11 Attempting to brute found IP 199.64.71.185
[scanner] FD12 Attempting to brute found IP 194.252.90.92
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD10 connected. Trying [91mtqx|{[32m:[91m$'&! #
[scanner] FD12 connected. Trying [91mtqx|{[32m:[91m'''''
[scanner] FD11 connected. Trying [91mapy{pa[32m:[91mapy{pa
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91mc|omc
[scanner] FD5 connected. Trying [91mtqx|{[32m:[91my|{`mf}pyy
[scanner] FD6 lost connection
[scanner] FD8 received sh prompt
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 Attempting to brute found IP 11.86.18.163
[scanner] FD6 connected. Trying [91mgzza[32m:[91mqgptxwzm
[scanner] FD5 connected. Trying [91m0--6[32m:[91m8*-,%:+,%B
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mTqx|{|fagtazg[32m:[91m
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m6'.,'6#&/+,[32m:[91m6'.,'6#&/+,
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mgzza[32m:[91m|cqpc
[scanner] FD5 lost connection
[scanner] FD6 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 Attempting to brute found IP 122.8.21.103
[scanner] FD8 connection gracefully closed
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m0--6[32m:[91m6'.'!-/#&/+,B
[scanner] FD8 connected. Trying [91mgzza[32m:[91mapyvz
[scanner] FD8 finished telnet negotiation
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD8 received username prompt
[scanner] FD6 connected. Trying [91m`fpg[32m:[91m`fpg
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD6 error while connecting = 111
[table] Tried to double-lock value
[scanner] FD8 received password prompt
[scanner] FD8 received shell prompt
[scanner] FD8 received sh prompt
[scanner] FD8 received sh prompt
[scanner] FD8 received shell prompt
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91mtqx|{[32m:[91m$'&!
[scanner] FD8 received sh prompt
[scanner] FD8 connection gracefully closed
[scanner] FD8 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD6 connected. Trying [91m0--6B[32m:[91m&0-22'0B
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m+2!#/B
[scanner] FD6 finished telnet negotiation
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD6 received username prompt
[table] Tried to double-lock value
[scanner] FD6 received password prompt
[scanner] FD6 received shell prompt
[scanner] FD8 Attempting to brute found IP 40.185.220.206
[scanner] FD13 Attempting to brute found IP 38.15.190.35
[scanner] FD8 connected. Trying [91mgzza[32m:[91ma%atyv%{ag%y!4
[scanner] FD13 connected. Trying [91mgzza[32m:[91mEyfV}rXp$
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 Attempting to brute found IP 194.223.43.34
[scanner] FD15 Attempting to brute found IP 136.219.36.109
[scanner] FD13 connected. Trying [91m0--6B[32m:[91m+2!#/B
[scanner] FD14 connected. Trying [91mgzza[32m:[91ma%atyv%{ag%y!4
[scanner] FD15 connected. Trying [91mf`eezga[32m:[91m$'&!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mapy{pagzza
[scanner] FD14 connected. Trying [91m[32m:[91m!-,,'!6B
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mgzza
[scanner] FD14 connected. Trying [91m0--6[32m:[91m%0-
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91m0--6B[32m:[91m '#0&0-22'0B
[scanner] FD5 connected. Trying [91mapyvz[32m:[91mapyvz
[scanner] FD14 connected. Trying [91mgzza[32m:[91m$'&! #
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mqgptxwzm
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connected. Trying [91mgzza[32m:[91moymm;
[scanner] FD16 Attempting to brute found IP 224.31.6.203
[scanner] FD13 connected. Trying [91mr`pfa[32m:[91m$'&!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connected. Trying [91mgzza[32m:[91mapy{paetff
[scanner] FD13 connected. Trying [91mf`eezga[32m:[91mf`eezga
[scanner] FD16 connected. Trying [91m6'.,'6#&/+,[32m:[91m6'.,'6#&/+,
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91m0--6B[32m:[91m11*B
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91m0--6[32m:[91m8*-,%:+,%B
[scanner] FD14 connected. Trying [91mgzza[32m:[91m `e
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD17 Attempting to brute found IP 171.61.33.109
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91m&'$#[32m:[91mp$31
[scanner] FD17 connected. Trying [91mr`pfa[32m:[91m$'&! #
[scanner] FD14 connected. Trying [91mgzza[32m:[91mgzza
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mof`{$$--
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connected. Trying [91mgzza[32m:[91mvxf %%
[scanner] FD13 connected. Trying [91mf`eezga[32m:[91mf`eezga
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connected. Trying [91mgzza[32m:[91m$$$$
[scanner] FD13 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
6 request sent to 188.103.82.212
[scanner] FD4 request sent to 64.214.116.212
[scanner] FD5 request sent to 212.89.3.109
[scanner] FD6 request sent to 186.118.70.212
[scanner] FD4 request sent to 181.149.240.37
[scanner] FD5 request sent to 121.216.83.5
[scanner] FD6 request sent to 137.66.4.118
[scanner] FD4 request sent to 227.53.149.118
[scanner] FD5 request sent to 137.218.64.118
[scanner] FD6 request sent to 23.170.232.2
[scanner] FD4 request sent to 183.39.231.109
[scanner] FD5 request sent to 181.152.206.178
[scanner] FD6 request sent to 241.160.99.2
[scanner] FD4 request sent to 105.108.36.212
[scanner] FD5 request sent to 51.9.138.109
[scanner] FD4 request sent to 147.124.93.118
[scanner] FD5 request sent to 249.107.94.42
[scanner] FD6 request sent to 237.144.167.210
[scanner] FD4 request sent to 132.155.88.5
[scanner] FD5 request sent to 236.125.5.212
[scanner] FD6 request sent to 127.101.92.212
[scanner] FD4 request sent to 216.92.192.212
[scanner] FD5 request sent to 1.20.11.2
[scanner] FD6 request sent to 135.74.0.94
[scanner] FD4 request sent to 188.48.198.118
[scanner] FD5 request sent to 13.39.180.212
[scanner] FD6 request sent to 231.191.2.37
[scanner] FD4 request sent to 188.223.147.212
[scanner] FD5 request sent to 49.154.228.94
[scanner] FD6 request sent to 73.163.83.109
[scanner] FD4 request sent to 235.157.198.5
[scanner] FD5 request sent to 233.77.164.42
[scanner] FD6 request sent to 95.28.127.5
[scanner] FD4 request sent to 85.211.139.2
[scanner] FD5 request sent to 51.229.90.212
[scanner] FD6 request sent to 253.222.115.42
[scanner] FD4 request sent to 140.36.52.178
[scanner] FD5 request sent to 195.104.124.212
[scanner] FD6 request sent to 207.80.140.210
[scanner] FD4 request sent to 45.238.111.210
[scanner] FD5 request sent to 155.143.192.210
[scanner] FD6 request sent to 127.83.51.178
[scanner] FD4 request sent to 241.61.66.37
[scanner] FD5 request sent to 86.160.122.210
[scanner] FD6 request sent to 128.173.182.210
[scanner] FD4 request sent to 20.89.4.94
[scanner] FD5 request sent to 112.178.208.2
[scanner] FD6 request sent to 210.52.230.37
[scanner] FD4 request sent to 247.39.24.79
[scanner] FD5 request sent to 41.96.81.42
[scanner] FD6 request sent to 52.31.14.212
[scanner] FD4 request sent to 208.105.75.210
[scanner] FD5 request sent to 62.118.200.109
[scanner] FD6 request sent to 52.41.173.79
[scanner] FD4 request sent to 176.243.214.37
[scanner] FD5 request sent to 34.198.135.212
[scanner] FD4 request sent to 98.170.63.79
[scanner] FD5 request sent to 121.95.246.2
[scanner] FD6 request sent to 101.198.255.2
[scanner] FD4 request sent to 237.225.46.109
[scanner] FD5 request sent to 177.196.121.118
[scanner] FD4 request sent to 153.80.74.109
[scanner] FD6 request sent to 31.115.90.37
[scanner] FD5 request sent to 224.166.241.2
[scanner] FD4 request sent to 62.76.17.42
[scanner] FD6 request sent to 112.224.61.42
[scanner] FD5 request sent to 221.165.17.94
[scanner] FD4 request sent to 147.31.223.42
[scanner] FD6 request sent to 18.96.185.79
[scanner] FD5 request sent to 53.144.115.212
[scanner] FD4 request sent to 30.27.202.212
[scanner] FD6 request sent to 14.221.110.210
[scanner] FD5 request sent to 143.82.78.212
[scanner] FD4 request sent to 16.56.30.109
[scanner] FD6 request sent to 124.183.234.5
[scanner] FD5 request sent to 200.107.225.79
[scanner] FD4 request sent to 49.107.5.118
[scanner] FD6 request sent to 175.10.9.79
[scanner] FD5 request sent to 192.75.4.37
[scanner] FD4 request sent to 142.127.223.210
[scanner] FD6 request sent to 200.31.29.2
[scanner] FD5 request sent to 46.248.67.118
[scanner] FD4 request sent to 235.41.85.109
[scanner] FD6 request sent to 6.81.179.37
[scanner] FD5 request sent to 248.86.10.178
[scanner] FD4 request sent to 224.65.62.37
[scanner] FD6 request sent to 33.246.171.178
[scanner] FD5 request sent to 42.245.108.79
[scanner] FD4 request sent to 4.228.88.2
[scanner] FD6 request sent to 168.56.133.79
[scanner] FD5 request sent to 187.244.19.118
[scanner] FD4 request sent to 68.174.119.109
[scanner] FD6 request sent to 175.233.21.212
[scanner] FD5 request sent to 17.203.136.109
[scanner] FD4 request sent to 105.90.238.94
[scanner] FD6 request sent to 103.28.242.37
[scanner] FD5 request sent to 196.143.210.178
[scanner] FD4 request sent to 114.155.148.94
[scanner] FD6 request sent to 52.235.155.109
[scanner] FD5 request sent to 191.2.72.94
[scanner] FD4 request sent to 125.210.73.212
[scanner] FD6 request sent to 91.9.179.118
[scanner] FD5 request sent to 169.250.46.79
[scanner] FD4 request sent to 184.219.137.5
[scanner] FD6 request sent to 14.77.63.210
[scanner] FD5 request sent to 10.80.129.178
[scanner] FD4 request sent to 144.75.125.212
[scanner] FD6 request sent to 207.24.123.210
[scanner] FD5 request sent to 58.5.255.178
[scanner] FD4 request sent to 25.188.163.178
[scanner] FD6 request sent to 96.236.183.2
[scanner] FD5 request sent to 33.106.237.79
[scanner] FD4 request sent to 25.47.61.42
[scanner] FD6 request sent to 29.53.202.212
[scanner] FD5 request sent to 108.20.111.79
[scanner] FD4 request sent to 168.57.202.5
[scanner] FD6 request sent to 94.147.230.109
[scanner] FD5 request sent to 206.98.169.5
[scanner] FD4 request sent to 153.100.126.210
[scanner] FD6 request sent to 43.164.185.2
[scanner] FD5 request sent to 80.217.126.178
[scanner] FD4 request sent to 44.204.80.37
[scanner] FD6 request sent to 197.105.218.5
[scanner] FD5 request sent to 222.182.81.42
[scanner] FD4 request sent to 209.33.62.94
[scanner] FD6 request sent to 8.252.125.42
[scanner] FD5 request sent to 122.237.165.118
[scanner] FD4 request sent to 217.116.8.42
[scanner] FD6 request sent to 102.36.35.178
[scanner] FD5 request sent to 121.231.30.210
[scanner] FD4 request sent to 180.128.27.178
[scanner] FD6 request sent to 137.45.130.2
[scanner] FD5 request sent to 44.240.240.37
[scanner] FD4 request sent to 106.204.162.210
[scanner] FD6 request sent to 93.30.43.109
[scanner] FD5 request sent to 174.193.59.212
[scanner] FD4 request sent to 18.71.1.37
[scanner] FD6 request sent to 211.225.117.79
[scanner] FD5 request sent to 166.141.105.37
[scanner] FD4 request sent to 103.188.60.2
[scanner] FD6 request sent to 1.178.218.109
[scanner] FD5 request sent to 23.214.123.210
[scanner] FD4 request sent to 164.231.232.2
[scanner] FD6 request sent to 151.237.83.79
[scanner] FD5 request sent to 244.146.127.37
[scanner] FD4 request sent to 219.255.37.94
[scanner] FD6 request sent to 166.76.135.118
[scanner] FD5 request sent to 238.155.130.37
[scanner] FD4 request sent to 50.2.141.42
[scanner] FD6 request sent to 15.197.203.2
[scanner] FD5 request sent to 243.22.54.42
[scanner] FD4 request sent to 94.186.12.94
[scanner] FD6 request sent to 176.168.153.42
[scanner] FD5 request sent to 89.17.208.109
[scanner] FD4 request sent to 59.67.119.5
[scanner] FD6 request sent to 136.88.59.5
[scanner] FD5 request sent to 59.160.97.5
[scanner] FD4 request sent to 49.106.107.2
[scanner] FD6 request sent to 39.46.135.37
[scanner] FD5 request sent to 240.166.104.79
[scanner] FD4 request sent to 91.188.219.2
[scanner] FD6 request sent to 207.51.56.79
[scanner] FD5 request sent to 195.217.22.94
[scanner] FD4 request sent to 188.68.95.109
[scanner] FD6 request sent to 93.172.122.178
[scanner] FD5 request sent to 37.133.253.109
[scanner] FD4 request sent to 39.87.228.212
[scanner] FD6 request sent to 91.217.173.212
[scanner] FD5 request sent to 82.81.17.2
[scanner] FD4 request sent to 109.214.81.178
[scanner] FD6 request sent to 214.56.160.178
[scanner] FD5 request sent to 146.1.188.5
[scanner] FD4 request sent to 187.111.244.212
[scanner] FD6 request sent to 33.167.144.79
[scanner] FD5 request sent to 35.123.197.210
[scanner] FD4 request sent to 249.161.105.109
[scanner] FD6 request sent to 250.2.75.178
[scanner] FD5 request sent to 125.166.222.79
[scanner] FD4 request sent to 212.54.95.212
[scanner] FD6 request sent to 42.193.194.79
[scanner] FD5 request sent to 241.96.125.212
[scanner] FD4 request sent to 127.79.203.210
[scanner] FD6 request sent to 124.49.53.37
[scanner] FD5 request sent to 228.106.118.212
[scanner] FD4 request sent to 31.98.68.42
[scanner] FD6 request sent to 183.69.185.118
[scanner] FD5 request sent to 241.77[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD14 connected. Trying [91mtqx|{[32m:[91my|{`mf}pyy
[scanner] FD13 connected. Trying [91m&'$#[32m:[91mp$31
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD14 connected. Trying [91m&#'/-,B[32m:[91m&#'/-,B
[scanner] FD6 received sh prompt
[scanner] FD6 received sh prompt
[scanner] FD14 connection gracefully closed
[scanner] FD14 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mqpst`ya
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mqgptxwzm
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD15 lost connection
[scanner] FD14 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mtqx|{[32m:[91m$'&! #"-,%
[scanner] FD13 connection gracefully closed
[scanner] FD13 lost connection
[scanner] FD14 connected. Trying [91m0--6B[32m:[91m0'#.6')B
[scanner] FD6 received shell prompt
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD8 connected. Trying [91mtqx|{[32m:[91m$$$$$$
[scanner] FD5 connected. Trying [91m0--6B[32m:[91m0#1 '00;2+'B
[scanner] FD16 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91mgzza[32m:[91mRX-$-'
[scanner] FD15 Attempting to brute found IP 85.20.4.103
[scanner] FD15 connected. Trying [91m0--6B[32m:[91m--6B
[scanner] FD15 lost connection
[scanner] FD15 retrying with different auth combo!
[scanner] FD15 error while connecting = 111
[scanner] FD7 timed out (state = 2)
[scanner] FD14 lost connection
[scanner] FD7 retrying with different auth combo!
[scanner] FD7 connected. Trying [91m0--6B[32m:[91m11*B
[scanner] FD14 Attempting to brute found IP 59.118.121.94
[scanner] FD14 connected. Trying [91mgzza[32m:[91mt{~z
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD5 connected. Trying [91m&'$#[32m:[91mp$31
[scanner] FD6 received sh prompt
[scanner] FD8 lost connection
[scanner] FD8 retrying with different auth combo!
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD13 connected. Trying [91m0--6B[32m:[91m11*B
[scanner] FD15 Attempting to brute found IP 155.172.10.103
[scanner] FD16 Attempting to brute found IP 97.151.192.81
[scanner] FD7 lost connection
[scanner] FD7 retrying with different auth combo!
[scanner] FD7 connected. Trying [91m&'$#[32m:[91m
:*.5z
[scanner] FD6 connection gracefully closed
[scanner] FD6 lost connection
[scanner] FD6 retrying with different auth combo!
[scanner] FD6 connected. Trying [91mgzza[32m:[91m$'&!dbpg
[scanner] FD15 connected. Trying [91m +,B[32m:[91m
[scanner] FD18 Attempting to brute found IP 142.205.152.149
[scanner] FD19 Attempting to brute found IP 113.55.243.213
[scanner] FD16 connected. Trying [91mgzza[32m:[91mapyvz
[scanner] FD20 Attempting to brute found IP 151.20.163.107
[scanner] FD6 finished telnet negotiation
[scanner] FD18 connected. Trying [91mgzza[32m:[91mafy|{`m
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD6 received username prompt
[scanner] FD19 connected. Trying [91mgzza[32m:[91mmv& $$
[scanner] FD16 finished telnet negotiation
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD16 received username prompt
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD20 connected. Trying [91m#&/+,[32m:[91m.111.42
[scanner] FD4 request sent to 177.4.191.178
[scanner] FD6 request sent to 96.135.82.118
[scanner] FD5 request sent to 114.12.118.178
[scanner] FD4 request sent to 74.70.109.79
[scanner] FD6 request sent to 78.91.106.42
[scanner] FD5 request sent to 179.88.251.210
[scanner] FD4 request sent to 174.95.125.118
[scanner] FD6 request sent to 230.67.214.178
[scanner] FD5 request sent to 158.188.47.2
[scanner] FD4 request sent to 50.112.117.79
[scanner] FD6 request sent to 225.145.134.109
[scanner] FD5 request sent to 94.81.142.37
[scanner] FD4 request sent to 127.77.230.37
[scanner] FD6 request sent to 38.175.225.94
[scanner] FD4 request sent to 32.65.70.94
[scanner] FD5 request sent to 12.169.219.37
[scanner] FD6 request sent to 254.70.159.5
[scanner] FD4 request sent to 161.203.60.5
[scanner] FD5 request sent to 49.255.210.79
[scanner] FD6 request sent to 177.254.241.212
[scanner] FD4 request sent to 152.139.50.5
[scanner] FD5 request sent to 189.220.3.118
[scanner] FD4 request sent to 122.249.108.2
[scanner] FD6 request sent to 203.5.178.37
[scanner] FD5 request sent to 137.170.11.37
[scanner] FD4 request sent to 205.231.241.109
[scanner] FD6 request sent to 20.201.71.37
[scanner] FD5 request sent to 94.164.173.5
[scanner] FD4 request sent to 147.55.67.2
[scanner] FD6 request sent to 240.127.190.212
[scanner] FD5 request sent to 223.150.237.118
[scanner] FD4 request sent to 32.127.165.5
[scanner] FD6 request sent to 238.44.133.178
[scanner] FD5 request sent to 20.169.118.37
[scanner] FD4 request sent to 193.29.115.2
[scanner] FD6 request sent to 42.185.220.210
[scanner] FD5 request sent to 148.37.199.118
[scanner] FD4 request sent to 242.229.204.2
[scanner] FD6 request sent to 176.173.237.118
[scanner] FD5 request sent to 251.232.252.212
[scanner] FD4 request sent to 43.105.93.118
[scanner] FD6 request sent to 24.16.91.5
[scanner] FD5 request sent to 2.12.184.37
[scanner] FD4 request sent to 244.176.116.42
[scanner] FD6 request sent to 154.129.203.37
[scanner] FD4 request sent to 215.112.30.42
[scanner] FD5 request sent to 170.19.31.37
[scanner] FD6 request sent to 55.37.167.118
[scanner] FD4 request sent to 105.232.32.42
[scanner] FD5 request sent to 98.32.120.178
[scanner] FD6 request sent to 9.145.23.109
[scanner] FD4 request sent to 178.51.120.178
[scanner] FD5 request sent to 77.187.40.2
[scanner] FD6 request sent to 39.191.186.210
[scanner] FD4 request sent to 107.171.132.42
[scanner] FD5 request sent to 108.253.52.79
[scanner] FD6 request sent to 38.130.16.118
[scanner] FD4 request sent to 226.123.59.5
[scanner] FD5 request sent to 222.179.110.109
[scanner] FD6 request sent to 248.60.58.5
[scanner] FD5 request sent to 32.65.70.94
[scanner] FD6 request sent to 254.70.159.5
[scanner] FD5 request sent to 98.251.162.5
[scanner] FD6 request sent to 109.175.12.178
[scanner] FD6 request sent to 128.102.118.212
[scanner] FD4 request sent to 12.169.219.37
[scanner] FD5 request sent to 45.248.76.79
[scanner] FD6 request sent to 201.155.155.94
[scanner] FD4 request sent to 48.222.32.212
[scanner] FD5 request sent to 184.189.137.178
[scanner] FD4 request sent to 18.94.73.94
[scanner] FD6 request sent to 77.2.34.2
[scanner] FD5 request sent to 56.77.92.109
[scanner] FD4 request sent to 185.212.47.5
[scanner] FD6 request sent to 11.18.249.79
[scanner] FD5 request sent to 116.121.110.212
[scanner] FD4 request sent to 243.205.51.94
[scanner] FD6 request sent to 171.239.88.42
[scanner] FD5 request sent to 33.129.179.118
[scanner] FD4 request sent to 248.77.103.210
[scanner] FD6 request sent to 79.25.6.94
[scanner] FD5 request sent to 118.228.187.212
[scanner] FD4 request sent to 226.176.11.212
[scanner] FD6 request sent to 229.16.21.212
[scanner] FD5 request sent to 220.177.15.42
[scanner] FD4 request sent to 249.151.68.94
[scanner] FD6 request sent to 64.14.71.37
[scanner] FD5 request sent to 203.141.221.178
[scanner] FD4 request sent to 78.149.14.109
[scanner] FD6 request sent to 0.243.103.5
[scanner] FD5 request sent to 207.97.109.118
[scanner] FD4 request sent to 110.228.109.210
[scanner] FD6 request sent to 250.129.193.42$+0'6+&'B
[scanner] FD5 connected. Trying [91mgzza[32m:[91mf`epg`fpg
[table] Tried to double-lock value
[scanner] FD6 received password prompt
[table] Tried to double-lock value
[scanner] FD16 received password prompt
[scanner] FD13 lost connection
[scanner] FD13 retrying with different auth combo!
[scanner] FD16 received shell prompt
[scanner] FD13 connected. Trying [91mtqx|{[32m:[91m$'&!
[scanner] FD6 received shell prompt
[scanner] FD16 received sh prompt
[scanner] FD21 Attempting to brute found IP 149.232.122.94
[scanner] FD21 connected. Trying [91mgzza[32m:[91mapy{pagzza
[scanner] FD7 lost connection
[scanner] FD7 retrying with different auth combo!
[scanner] FD7 connected. Trying [91mr`pfa[32m:[91m$'&! #
[scanner] FD8 timed out (state = 1)
[scanner] FD8 Attempting to brute found IP 7.105.129.77
[scanner] FD22 Attempting to brute found IP 9.50.120.94
[scanner] FD23 Attempting to brute found IP 222.188.81.191
[scanner] FD9 timed out (state = 2)
[scanner] FD6 received sh prompt
[scanner] FD5 lost connection
[scanner] FD5 retrying with different auth combo!
[scanner] FD8 connected. Trying [91mgzza[32m:[91m!&'$
[scanner] FD22 connected. Trying [91mgzza[32m:[91m`|q(%
[scanner] FD23 connected. Trying [91m0--6B[32m:[91m--6B
[scanner] FD5 connected. Trying [91mgzza[32m:[91my|{`mf}pyy
[scanner] FD9 Attempting to brute found IP 178.60.23.218
[scanner] FD16 connection gracefully closed
[scanner] FD16 lost connection
[scanner] FD16 retrying with different auth combo!
[scanner] FD23 finished telnet negotiation
[scanner] FD16 connected. Trying [91m0--6B[32m:[91m--6B
[scanner] FD9 connected. Trying [91m&#'/-,B[32m:[91m&#'/-,B
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD23 received username prompt
[scanner] FD16 finished telnet negotiation
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD16 received username prompt
[scanner] FD10 timed out (state = 2)
[scanner] FD11 timed out (state = 2)
[scanner] FD12 timed out (state = 2)
[scanner] FD6 received sh prompt
[scanner] FD9 finished telnet negotiation
[scanner] FD10 Attempting to brute found IP 236.125.96.34
[scanner] FD13 lost connection
[scanner] FD11 retrying with different auth combo!
[scanner] FD10 connected. Trying [91mw|{[32m:[91m
[table] Tried to double-lock value
[table] Tried to double-lock value
[scanner] FD9 received username prompt
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[table] Tried to double-lock value
[scanner] FD23 received password prompt
[scanner] FD10 connected. Trying [91m&'$#[32m:[91m6.52 -t
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[table] Tried to double-lock value
[scanner] FD16 received password prompt
[scanner] FD11 connected. Trying [91mtqx|{[32m:[91m"`X~z%tqx|{
[scanner] FD10 connected. Trying [91m#&/+,[32m:[91m$+0'6+&'B
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[scanner] FD10 connected. Trying [91m[32m:[91m2#115-0&B
[table] Tried to double-lock value
[scanner] FD9 received password prompt
[scanner] FD9 received shell prompt
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[scanner] FD16 received shell prompt
[scanner] FD10 connected. Trying [91mqtpxz{[32m:[91m
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[scanner] FD10 connected. Trying [91mgzza[32m:[91mRX-$-'
[scanner] FD7 lost connection
[scanner] FD7 retrying with different auth combo!
[scanner] FD10 connection gracefully closed
[scanner] FD10 lost connection
[scanner] FD10 retrying with different auth combo!
[scanner] FD10 connected. Trying [91mgzza[32m:[91m"`X~z%tqx|{
[scanner] FD7 connected. Trying [91mtqx|{[32m:[91metffbzgq
[scanner] FD10 connection gracefully closed
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
WU3D24p3h0.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
  • 0x12de0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
WU3D24p3h0.elfMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0x14ac8:$s1: LCOGQGPTGP
  • 0x141a8:$s3: CFOKLKQVPCVMP
  • 0x14318:$s4: QWRGPTKQMP
  • 0x142e0:$s5: HWCLVGAJ

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6210.1.00007fe884011000.00007fe884028000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x12de0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6210.1.00007fe884011000.00007fe884028000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x14ac8:$s1: LCOGQGPTGP
    • 0x141a8:$s3: CFOKLKQVPCVMP
    • 0x14318:$s4: QWRGPTKQMP
    • 0x142e0:$s5: HWCLVGAJ
    6214.1.00007fe884011000.00007fe884028000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x12de0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6214.1.00007fe884011000.00007fe884028000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x14ac8:$s1: LCOGQGPTGP
    • 0x141a8:$s3: CFOKLKQVPCVMP
    • 0x14318:$s4: QWRGPTKQMP
    • 0x142e0:$s5: HWCLVGAJ
    6208.1.00007fe884011000.00007fe884028000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x12de0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    Click to see the 4 entries

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Antivirus / Scanner detection for submitted sample
    Source: WU3D24p3h0.elfAvira: detected
    Multi AV Scanner detection for submitted file
    Source: WU3D24p3h0.elfReversingLabs: Detection: 50%
    Source: WU3D24p3h0.elfVirustotal: Detection: 58%Perma Link

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46938
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46944
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46946
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46956
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46958
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46968
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46970
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46974
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46978
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46986
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46988
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46998
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47004
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47016
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47026
    Source: global trafficTCP traffic: 192.168.2.23:44628 -> 45.88.90.129:9902
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 193.15.128.139:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 41.61.211.253:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 84.177.69.232:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 41.3.250.83:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 12.17.84.238:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 94.64.224.44:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 161.249.64.205:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 8.239.112.190:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 217.19.193.142:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 42.166.221.214:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 177.144.104.98:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 113.60.67.26:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 72.140.254.94:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 61.131.123.208:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 176.51.210.133:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 84.252.25.16:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 161.195.96.1:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 58.213.76.135:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 180.79.220.190:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 108.192.69.119:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 117.55.11.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 202.23.235.192:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 69.71.200.140:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 43.3.155.110:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 94.76.49.36:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.48.233.221:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 18.242.233.47:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 17.193.65.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.37.54.89:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 109.243.92.155:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 126.142.203.197:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 38.144.149.20:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 212.168.250.182:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 96.112.162.195:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 77.44.38.74:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 86.107.7.179:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 9.35.13.84:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 161.228.124.9:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 81.83.233.146:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 125.2.78.63:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.140.123.43:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 75.177.213.174:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 207.55.49.1:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 154.195.123.180:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.143.156.194:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.67.91.227:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 168.116.0.57:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.213.42.57:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 200.138.87.91:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 196.15.116.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 179.54.50.147:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 168.33.82.219:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 36.91.81.192:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 59.245.247.147:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 27.85.157.149:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 196.122.97.247:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 79.105.203.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 162.204.32.170:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 198.143.216.169:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.153.241.40:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 83.26.140.11:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 169.46.170.6:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 206.23.88.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 81.71.37.41:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 92.31.195.225:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 40.103.172.201:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 103.230.191.177:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 169.40.168.1:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 212.173.117.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 160.9.86.132:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 63.94.109.194:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 80.14.8.120:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 177.197.16.8:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 2.155.119.15:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 212.9.94.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 78.122.13.101:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 113.110.133.18:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 159.67.183.158:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 206.115.62.142:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 19.135.172.71:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 9.216.21.177:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 53.178.178.169:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 19.217.215.20:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 200.131.16.246:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.182.143.55:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 112.7.85.7:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 141.141.132.109:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 2.206.75.155:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 102.9.244.192:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 191.173.91.99:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 169.18.51.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 37.102.160.119:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 149.217.148.231:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 4.100.144.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 103.97.155.157:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 43.60.188.248:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 123.181.89.173:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 176.203.124.201:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 197.61.1.112:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 165.19.55.131:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 41.182.183.187:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 173.15.78.149:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 165.221.180.11:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 202.77.32.236:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.169.98.227:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 84.139.165.121:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 64.237.173.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 108.148.156.181:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 37.90.211.137:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 147.111.157.241:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 37.119.18.28:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 144.110.58.226:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 133.174.99.73:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 13.88.116.44:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 83.0.183.86:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 205.234.248.133:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 45.74.83.125:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 71.57.255.66:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 147.83.62.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 207.79.26.29:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 152.68.38.183:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 12.197.248.66:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 151.168.186.233:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 202.220.31.206:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.119.20.181:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 102.58.134.252:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 93.35.229.164:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 168.192.181.162:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 175.140.42.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 201.31.70.142:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 34.40.192.210:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 151.227.10.214:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 130.48.209.60:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.52.144.216:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 203.52.73.143:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 163.55.19.222:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 135.13.179.102:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 163.19.148.84:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 92.197.64.0:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.34.84.116:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 211.53.92.2:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 118.135.181.34:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 97.68.51.77:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.56.95.106:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 44.177.45.170:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 32.21.221.164:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.248.192.250:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 144.113.20.240:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 222.56.27.0:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 120.118.38.92:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 86.126.28.163:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 212.219.196.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 125.253.234.235:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 201.70.118.84:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 187.92.53.29:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 88.44.222.104:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 108.19.122.227:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 220.85.3.50:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 99.50.118.183:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 92.71.211.80:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 85.209.41.212:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 121.68.209.100:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 122.64.39.199:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 162.232.212.163:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 148.59.250.152:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 132.184.71.180:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.247.141.226:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 113.28.184.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 13.72.43.239:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.172.12.230:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 155.67.51.230:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 57.212.115.23:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 164.248.221.7:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 109.191.24.108:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 208.192.242.70:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 140.164.168.175:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 126.189.203.231:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 73.155.31.117:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 35.18.174.237:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 99.75.9.197:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 206.9.245.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 19.229.25.166:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 20.210.208.198:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 150.253.74.221:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.145.146.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.30.54.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 163.62.46.251:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 125.176.136.216:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 5.84.207.218:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 94.50.24.158:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 209.178.21.175:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 209.55.53.246:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 153.144.44.9:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 198.20.31.105:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 101.172.235.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 140.72.20.231:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 124.208.240.174:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 145.193.39.16:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 184.181.39.36:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 174.116.112.0:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 182.224.98.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 12.123.83.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 156.205.209.51:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 154.140.96.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 96.194.249.36:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 222.122.33.30:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 189.20.105.28:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 39.68.95.223:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.108.200.139:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 47.126.36.238:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 78.160.208.235:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 38.56.181.86:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 132.156.147.6:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 122.108.66.246:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 73.204.104.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 136.41.35.80:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 114.64.161.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 117.182.7.15:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 76.167.183.104:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 113.154.198.177:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 174.199.64.203:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 73.178.101.202:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 59.39.32.163:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 8.97.45.36:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 167.180.88.191:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 119.205.30.5:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 87.234.124.33:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 148.94.169.135:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 195.37.34.226:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 205.128.230.186:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 206.177.16.128:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 176.93.1.140:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 98.98.250.228:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 82.82.149.237:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 162.27.198.13:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 5.227.38.16:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 197.28.201.66:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 99.69.33.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 166.41.149.131:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 18.94.186.51:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 48.18.102.64:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 209.204.31.248:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 107.223.105.67:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 136.205.153.128:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 196.208.69.18:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 114.108.116.87:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 188.146.127.155:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 104.184.100.115:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 216.99.172.135:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 69.65.107.179:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 119.177.45.111:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 31.18.194.220:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 44.226.229.220:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 129.222.8.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 12.126.25.204:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 219.23.201.96:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 190.205.41.83:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 47.52.230.27:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 99.88.49.48:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 179.3.183.163:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 144.58.251.65:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 99.92.5.130:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 101.250.95.160:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 218.210.195.220:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 118.72.14.95:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 38.157.17.190:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 161.180.30.72:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 116.249.104.254:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 31.253.44.8:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 34.185.32.118:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 58.204.150.185:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.154.208.180:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 126.37.64.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 24.251.173.129:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 217.236.77.106:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 104.159.243.132:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 186.140.147.10:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 190.56.40.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 107.138.53.211:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 37.50.96.82:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 37.213.178.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 80.118.130.242:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 174.10.123.239:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 171.229.130.19:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 61.143.94.86:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 139.0.205.140:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 207.207.65.48:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 128.23.228.162:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 113.101.30.193:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 16.160.5.204:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 208.88.86.42:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 73.5.161.236:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 198.32.22.62:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 191.123.173.149:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 87.232.151.55:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 36.190.171.240:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 46.80.203.59:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 91.195.253.175:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 124.38.96.153:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 57.45.2.14:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 23.123.202.228:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 117.34.111.186:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 91.12.20.104:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 148.2.70.93:2323
    Source: global trafficTCP traffic: 192.168.2.23:29142 -> 207.89.29.1:2323
    Source: global tr