Linux Analysis Report
8lzQh5F8lt.elf

Overview

General Information

Sample name: 8lzQh5F8lt.elf
renamed because original name is a hash value
Original sample name: cf879b6b805c877ff2ad4bb73e39b71b.elf
Analysis ID: 1417263
MD5: cf879b6b805c877ff2ad4bb73e39b71b
SHA1: 4a1322ddc4b05f43e175adad28aed674a6623701
SHA256: 0cb59210d3888df745d3073a40903c9ee7efea4e5b9b479aa54326b0ae996e01
Tags: 32elfintelmirai
Infos:

Detection

Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 8lzQh5F8lt.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 8lzQh5F8lt.elf ReversingLabs: Detection: 71%
Machine Learning detection for sample
Source: 8lzQh5F8lt.elf Joe Sandbox ML: detected

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43360
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43362
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43364
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43370
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43372
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43374
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43380
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35022 -> 5.253.246.170:9931
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 117.120.90.253:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 90.187.6.112:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 32.228.135.210:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 81.147.169.246:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 12.2.240.218:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 167.216.157.171:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 113.79.255.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.127.107.145:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.49.178.96:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 198.107.8.18:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 107.227.4.95:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 182.63.53.119:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 111.45.39.125:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 203.4.54.184:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 145.9.181.235:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 96.49.55.213:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 106.213.241.32:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 129.138.64.241:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 169.126.245.137:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 138.1.171.226:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.253.204.201:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 75.194.108.202:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 111.155.31.94:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 39.221.200.198:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.255.23.73:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 49.162.57.237:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.135.152.161:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.184.253.209:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 32.17.21.163:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 104.198.149.134:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 205.9.192.55:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 57.229.125.91:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 57.29.123.99:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 109.192.191.15:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 108.172.58.76:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 143.157.230.246:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 77.47.78.252:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 39.16.70.79:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 144.75.118.223:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 39.106.72.75:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 114.124.49.160:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 89.48.180.190:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.23.102.101:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 14.145.198.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 117.89.16.0:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 164.249.166.248:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 88.43.208.3:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 128.117.50.14:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 74.43.82.46:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 221.112.184.209:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 155.202.197.109:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.201.61.87:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.71.227.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 47.16.64.164:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 223.154.58.152:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 219.164.101.152:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 75.49.229.201:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 114.175.7.80:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 209.152.157.27:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.211.83.226:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 180.181.186.14:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 20.56.83.223:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 19.71.45.205:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 37.251.219.233:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 179.213.166.103:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 189.161.189.42:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 211.163.169.91:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 122.223.31.210:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.198.231.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 92.69.132.18:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 4.207.131.116:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.80.208.216:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 126.13.236.48:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 132.36.183.73:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 87.10.201.225:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.155.153.102:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 156.83.65.186:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.206.27.183:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 218.36.185.195:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 216.75.24.167:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 184.140.29.144:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 106.71.129.134:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 39.110.62.32:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 72.200.160.98:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 170.123.20.143:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 216.72.80.30:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 190.76.85.188:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.143.140.137:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 130.145.98.189:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 132.195.220.155:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 208.184.97.70:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 175.1.249.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 94.239.202.53:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 155.188.132.217:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.115.239.0:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 144.55.40.7:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 13.134.128.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 27.127.77.24:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 116.53.77.78:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 89.93.54.237:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 35.91.164.73:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 20.168.240.174:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 203.177.193.133:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 115.56.201.46:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 81.54.152.123:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 143.89.126.55:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 209.35.154.103:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 188.171.38.11:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 122.217.22.74:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 94.136.180.117:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 102.26.98.214:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 76.143.117.48:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 9.50.14.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 96.219.183.168:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 209.145.247.251:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 66.200.202.44:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 193.30.163.174:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 200.22.41.99:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.193.210.189:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 176.132.0.102:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 51.70.250.12:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.153.255.68:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 60.172.148.89:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 73.147.67.208:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 14.72.230.23:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 95.243.23.230:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 175.17.49.206:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 212.98.91.254:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 122.4.245.181:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 152.142.238.5:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 147.239.67.43:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 194.162.88.234:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 63.21.47.54:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 207.145.115.50:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.235.244.28:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 171.161.23.119:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 140.129.38.17:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 9.79.68.224:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 66.194.9.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 156.140.0.75:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.118.79.241:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.37.240.58:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 205.0.143.77:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 82.157.21.151:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 54.33.99.48:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 71.33.55.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 149.205.153.226:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 137.181.248.137:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.206.100.247:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 154.161.17.83:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 49.181.92.126:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 50.205.146.220:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 63.78.51.222:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.2.149.213:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 113.44.204.156:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 201.178.180.109:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.222.25.171:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 27.163.113.143:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 195.88.189.120:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.218.211.10:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 72.9.253.90:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 162.88.172.107:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 179.41.137.59:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 132.137.102.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 12.116.80.197:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 95.135.48.252:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 154.224.53.90:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 90.174.7.127:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 216.54.218.69:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.63.210.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.91.213.133:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.152.203.191:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 17.250.66.204:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 109.99.40.111:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 164.228.16.67:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 17.200.49.18:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 194.217.243.131:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 104.56.72.235:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 131.166.254.47:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.81.62.110:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 72.78.186.147:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 36.101.66.227:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 61.56.57.90:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 171.189.154.179:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 156.153.189.43:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 216.15.68.1:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 59.65.163.203:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 109.40.23.87:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 36.28.191.163:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 52.181.27.17:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 51.19.11.254:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 23.249.162.137:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 196.41.77.126:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 178.202.180.158:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 150.56.70.174:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 31.7.101.247:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 162.18.91.77:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 70.164.105.0:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 212.178.81.183:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 31.7.181.120:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 197.78.76.246:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 54.13.57.47:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.70.138.115:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 221.13.38.14:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 208.183.82.95:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 158.167.24.105:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 149.190.166.151:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.119.244.101:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.84.103.205:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 5.195.47.21:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 223.120.75.154:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 98.1.14.170:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 109.113.177.219:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 152.27.237.146:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 42.74.186.113:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 14.137.219.98:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 31.228.6.126:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 165.62.160.192:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 143.228.179.179:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 130.188.124.56:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 137.55.194.215:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.1.14.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.84.17.106:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 41.92.127.237:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 83.176.21.121:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.82.80.147:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 64.251.242.203:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 122.150.116.99:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 108.56.202.247:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 5.89.204.229:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 168.64.83.123:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 115.76.163.4:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 102.120.132.49:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 80.12.135.75:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 150.183.138.228:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 180.191.151.193:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 208.153.86.225:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.240.90.189:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.66.203.42:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 48.137.28.134:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 117.83.255.73:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 106.196.36.176:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 197.220.77.205:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 42.224.205.10:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.168.158.94:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 83.160.189.68:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.219.56.252:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 91.185.2.144:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 101.106.9.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 81.37.114.46:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 86.137.134.79:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 185.2.61.254:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 206.113.210.248:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 208.102.121.69:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 47.19.196.140:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 65.124.150.173:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.90.103.167:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 67.212.58.56:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 220.18.210.29:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 102.99.36.205:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 13.39.92.245:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 155.75.72.21:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 166.97.103.246:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 64.196.60.149:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 79.255.100.0:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 142.35.131.61:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 53.26.135.131:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 12.118.16.245:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 161.108.111.212:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 142.49.110.216:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 62.116.200.173:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 194.86.50.90:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 82.47.125.178:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 105.151.208.35:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 50.167.205.55:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 23.160.140.120:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 95.236.241.72:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 74.210.11.241:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 169.223.137.232:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 19.157.242.64:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 128.78.43.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 117.245.130.181:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 97.2.161.151:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 163.23.196.63:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 136.189.11.198:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 183.20.186.79:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 198.117.18.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 171.102.155.2:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.93.173.66:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 137.166.24.163:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 169.168.221.116:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 17.112.100.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 193.131.174.203:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 103.49.136.131:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 75.12.23.208:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 5.29.134.156:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 196.23.194.80:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 131.17.237.106:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 12.42.231.163:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.18.148.37:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.18.179.238:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 137.227.31.113:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 68.217.167.181:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 93.118.18.239:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 40.80.111.157:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 196.78.127.74:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 191.70.125.191:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 66.152.73.204:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 78.97.69.109:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.181.78.201:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 201.105.60.102:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.80.209.242:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 213.166.117.183:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 160.112.70.76:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 151.42.56.180:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 78.160.255.85:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 204.103.17.131:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 94.64.124.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 106.152.46.141:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 168.223.195.43:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 59.233.225.159:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 220.14.102.125:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 45.139.162.178:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.38.243.88:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 148.166.56.17:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 81.47.199.101:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 5.65.182.46:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 8.250.123.234:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 115.104.78.239:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 107.111.30.62:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 159.91.216.123:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 93.54.222.250:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 188.193.78.0:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.221.227.219:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 131.61.145.224:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 185.229.64.148:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.200.67.148:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 46.71.188.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 112.56.167.169:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.25.147.85:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 154.135.133.83:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 43.7.229.252:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 191.73.223.15:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 184.87.201.131:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 120.50.76.234:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.118.92.46:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 222.33.78.250:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 135.249.173.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 186.83.218.84:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 198.152.30.52:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 67.149.87.69:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 8.252.214.86:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 150.126.227.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.124.91.65:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 199.40.139.204:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 83.253.237.120:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 187.23.186.14:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 164.166.133.215:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 165.252.219.15:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 151.40.20.59:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.139.253.161:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 42.4.228.100:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 189.153.158.13:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 69.214.6.240:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 66.48.247.82:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 174.142.123.80:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 58.175.244.115:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 203.106.152.136:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 206.151.137.65:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 171.175.18.109:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 201.180.194.91:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 205.120.107.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 136.16.51.235:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 64.170.24.63:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 25.231.237.221:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 112.95.73.228:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 126.52.37.2:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 39.73.18.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 124.25.189.57:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 83.41.68.92:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 17.35.13.16:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 190.104.242.182:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 189.78.228.52:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 153.80.226.173:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 18.170.41.171:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 114.206.91.118:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 36.56.128.184:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 147.67.46.181:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 45.101.41.86:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 73.51.31.8:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 155.248.234.153:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 88.46.111.60:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 169.215.70.85:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 27.210.125.163:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.51.195.252:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 1.119.84.151:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 37.43.187.78:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.157.205.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.54.245.183:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 71.196.34.48:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 120.80.18.243:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 124.103.144.23:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 104.17.190.238:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 4.43.44.17:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 180.69.27.82:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 36.101.240.110:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 196.7.250.237:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 139.158.183.247:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 203.235.69.93:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 76.55.134.118:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 216.171.71.48:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 95.55.230.222:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 88.153.75.109:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 151.157.51.51:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 25.51.48.13:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 75.91.131.142:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 145.218.57.58:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.228.61.211:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 181.168.189.9:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 145.80.139.246:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 142.255.107.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 46.16.44.120:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 165.1.27.75:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 223.119.241.123:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 186.127.41.42:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 54.49.160.51:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 222.213.191.233:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 67.225.160.22:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 106.72.239.201:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 45.250.238.203:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 95.78.82.49:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 67.8.92.30:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 123.54.242.1:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.78.121.241:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 27.21.129.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 115.184.24.133:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 191.148.49.207:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 113.189.99.159:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 166.82.33.118:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 88.212.190.12:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 151.56.141.49:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 89.137.172.176:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 60.28.150.191:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 38.175.149.38:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 147.162.172.136:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 142.226.243.15:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 45.240.144.67:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 96.110.39.159:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 82.190.192.194:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 141.221.168.166:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 166.93.24.105:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 110.79.124.141:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 93.211.8.229:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 133.209.237.220:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.51.173.119:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 125.191.169.213:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 142.150.213.183:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 157.155.239.113:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 47.134.65.167:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 85.175.2.176:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 187.145.169.41:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 204.121.179.148:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 183.45.52.27:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 153.84.186.63:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 17.147.73.193:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 52.229.124.103:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 53.44.145.67:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 65.194.51.6:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 170.175.165.199:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 122.74.199.11:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 167.10.211.219:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 223.53.57.240:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.235.153.90:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 202.51.192.129:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 8.91.78.31:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 101.232.6.36:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 48.189.229.193:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 66.5.132.14:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 41.91.9.24:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 221.219.137.84:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 99.15.202.166:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 103.225.97.138:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 102.131.46.71:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 198.191.198.10:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 197.241.144.133:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 204.47.237.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 198.3.5.76:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 12.135.84.108:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 167.142.42.186:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 27.199.33.148:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 134.92.79.63:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 150.176.137.118:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 52.243.59.59:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 134.146.94.158:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 126.109.244.7:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 90.131.239.167:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 145.118.95.39:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 217.162.142.171:2323
Source: global traffic TCP traffic: 192.168.2.23:63933 -> 32.115.1.202:2323
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 5.253.246.170
Source: unknown TCP traffic detected without corresponding DNS query: 117.120.90.253
Source: unknown TCP traffic detected without corresponding DNS query: 118.119.18.253
Source: unknown TCP traffic detected without corresponding DNS query: 172.244.232.102
Source: unknown TCP traffic detected without corresponding DNS query: 144.232.143.110
Source: unknown TCP traffic detected without corresponding DNS query: 167.124.169.250
Source: unknown TCP traffic detected without corresponding DNS query: 91.94.81.124
Source: unknown TCP traffic detected without corresponding DNS query: 161.78.252.59
Source: unknown TCP traffic detected without corresponding DNS query: 167.48.249.88
Source: unknown TCP traffic detected without corresponding DNS query: 43.16.1.23
Source: unknown TCP traffic detected without corresponding DNS query: 90.201.133.145
Source: unknown TCP traffic detected without corresponding DNS query: 90.187.6.112
Source: unknown TCP traffic detected without corresponding DNS query: 113.172.71.161
Source: unknown TCP traffic detected without corresponding DNS query: 201.143.214.107
Source: unknown TCP traffic detected without corresponding DNS query: 217.181.61.55
Source: unknown TCP traffic detected without corresponding DNS query: 23.2.200.134
Source: unknown TCP traffic detected without corresponding DNS query: 98.182.195.226
Source: unknown TCP traffic detected without corresponding DNS query: 173.195.187.191
Source: unknown TCP traffic detected without corresponding DNS query: 150.171.179.168
Source: unknown TCP traffic detected without corresponding DNS query: 9.19.242.216
Source: unknown TCP traffic detected without corresponding DNS query: 32.228.135.210
Source: unknown TCP traffic detected without corresponding DNS query: 203.171.14.156
Source: unknown TCP traffic detected without corresponding DNS query: 91.157.101.197
Source: unknown TCP traffic detected without corresponding DNS query: 158.35.146.144
Source: unknown TCP traffic detected without corresponding DNS query: 140.207.216.180
Source: unknown TCP traffic detected without corresponding DNS query: 196.18.80.39
Source: unknown TCP traffic detected without corresponding DNS query: 170.94.72.107
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.204.215
Source: unknown TCP traffic detected without corresponding DNS query: 130.54.201.5
Source: unknown TCP traffic detected without corresponding DNS query: 85.104.17.153
Source: unknown TCP traffic detected without corresponding DNS query: 49.147.65.184
Source: unknown TCP traffic detected without corresponding DNS query: 48.109.41.5
Source: unknown TCP traffic detected without corresponding DNS query: 80.144.83.108
Source: unknown TCP traffic detected without corresponding DNS query: 145.93.189.122
Source: unknown TCP traffic detected without corresponding DNS query: 40.211.245.76
Source: unknown TCP traffic detected without corresponding DNS query: 149.196.150.106
Source: unknown TCP traffic detected without corresponding DNS query: 36.107.179.138
Source: unknown TCP traffic detected without corresponding DNS query: 90.128.218.215
Source: unknown TCP traffic detected without corresponding DNS query: 81.147.169.246
Source: unknown TCP traffic detected without corresponding DNS query: 12.2.240.218
Source: unknown TCP traffic detected without corresponding DNS query: 209.156.191.247
Source: unknown TCP traffic detected without corresponding DNS query: 162.198.212.131
Source: unknown TCP traffic detected without corresponding DNS query: 44.252.238.239
Source: unknown TCP traffic detected without corresponding DNS query: 148.167.153.226
Source: unknown TCP traffic detected without corresponding DNS query: 46.247.211.123
Source: unknown TCP traffic detected without corresponding DNS query: 188.218.45.66
Source: unknown TCP traffic detected without corresponding DNS query: 154.235.229.173
Source: unknown TCP traffic detected without corresponding DNS query: 43.155.75.56
Source: unknown TCP traffic detected without corresponding DNS query: 167.216.157.171
Source: unknown TCP traffic detected without corresponding DNS query: 202.237.135.58
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 8lzQh5F8lt.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6194) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.CYk8MuxQaI /tmp/tmp.yRbbqgjDr7 /tmp/tmp.iqDdXm5vlC Jump to behavior
Source: /usr/bin/dash (PID: 6205) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.CYk8MuxQaI /tmp/tmp.yRbbqgjDr7 /tmp/tmp.iqDdXm5vlC Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43360
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43362
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43364
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43370
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43372
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43374
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43380

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 8lzQh5F8lt.elf, type: SAMPLE
Source: Yara match File source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 8lzQh5F8lt.elf, type: SAMPLE
Source: Yara match File source: 6222.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6221.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6224.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
65.131.38.219
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
101.102.207.24
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
54.168.59.198
 unknown United States
16509 AMAZON-02US false
45.173.76.64
 unknown Brazil
268801 REGINALDOFIRMOMARTINSJUNIORBR false
83.16.62.114
 unknown Poland
5617 TPNETPL false
109.79.102.193
 unknown Ireland
15502 VODAFONE-IRELAND-ASNIE false
166.50.136.60
 unknown United States
3371 MCI-ASNUS false
136.53.110.240
 unknown United States
16591 GOOGLE-FIBERUS false
48.5.11.93
 unknown United States
2686 ATGS-MMD-ASUS false
76.58.153.84
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
185.71.13.143
 unknown Switzerland
15623 CYBERLINKCyberlinkAGCH false
202.213.223.79
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
13.213.43.239
 unknown United States
16509 AMAZON-02US false
186.213.21.216
 unknown Brazil
18881 TELEFONICABRASILSABR false
116.198.160.6
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
75.74.47.233
 unknown United States
7922 COMCAST-7922US false
68.143.234.235
 unknown United States
7029 WINDSTREAMUS false
39.69.244.185
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
142.150.250.14
 unknown Canada
239 UTORONTO-ASCA false
115.33.14.82
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
45.176.183.118
 unknown Brazil
268949 SMTelecomNetLtdaBR false
71.222.85.47
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
83.245.144.36
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
18.75.205.198
 unknown United States
3 MIT-GATEWAYSUS false
64.94.12.234
 unknown United States
30636 INTERNAP-BLK6US false
122.220.116.194
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
70.181.105.51
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
140.240.66.225
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
114.199.124.56
 unknown Indonesia
24525 SAP-AS-IDPTSolusiAksesindoPratamaID false
52.55.4.101
 unknown United States
14618 AMAZON-AESUS false
48.67.24.206
 unknown United States
2686 ATGS-MMD-ASUS false
123.8.73.65
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
93.125.83.176
 unknown Belarus
42772 A1-BY-ASBY false
27.189.35.194
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
99.18.216.73
 unknown United States
7018 ATT-INTERNET4US false
136.160.238.151
 unknown United States
394395 TOWSON-UNIVERSITYUS false
194.1.14.97
 unknown Slovakia (SLOVAK Republic)
2607 SANETSlovakAcademicNetworkSK false
177.194.0.106
 unknown Brazil
28573 CLAROSABR false
210.26.108.109
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
75.20.216.70
 unknown United States
7018 ATT-INTERNET4US false
34.25.84.232
 unknown United States
2686 ATGS-MMD-ASUS false
216.186.136.6
 unknown United States
12083 WOW-INTERNETUS false
167.47.24.235
 unknown Canada
2665 CDAGOVNCA false
131.85.43.93
 unknown United States
140 DNIC-AS-00140US false
196.58.32.171
 unknown Seychelles
37518 FIBERGRIDSC false
196.136.113.59
 unknown Egypt
36935 Vodafone-EG false
93.204.191.38
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
99.41.85.211
 unknown United States
7018 ATT-INTERNET4US false
176.242.84.199
 unknown Italy
30722 VODAFONE-IT-ASNIT false
185.121.200.0
 unknown Croatia (LOCAL Name: Hrvatska)
44377 MTNET-ASMAGIC-NETHR false
139.65.64.61
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
221.245.137.240
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
172.171.219.163
 unknown United States
7018 ATT-INTERNET4US false
69.31.120.97
 unknown United States
3257 GTT-BACKBONEGTTDE false
79.246.77.120
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
171.14.107.243
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
53.153.108.45
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
23.157.196.199
 unknown Reserved
64267 AS-SPRIOUS false
42.152.242.60
 unknown Malaysia
9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
81.120.137.92
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
87.136.201.45
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
101.17.108.228
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
189.166.227.115
 unknown Mexico
8151 UninetSAdeCVMX false
93.28.7.196
 unknown France
15557 LDCOMNETFR false
219.226.153.16
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
66.216.213.5
 unknown United States
11693 NULINKUS false
75.134.246.175
 unknown United States
20115 CHARTER-20115US false
195.64.94.82
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
125.172.247.38
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
201.246.161.149
 unknown Chile
16629 CTCCORPSATELEFONICAEMPRESASCL false
156.114.33.37
 unknown Netherlands
59630 NN_INSURANCE_EURASIA_NV_ITH-ASNL false
177.127.229.37
 unknown Brazil
22381 MegatelecomTelecomunicacoesLtdaBR false
137.54.216.10
 unknown United States
225 VIRGINIA-ASUS false
85.53.70.123
 unknown Spain
12479 UNI2-ASES false
8.208.198.83
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
189.20.154.117
 unknown Brazil
10429 TELEFONICABRASILSABR false
120.179.242.196
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
51.227.18.102
 unknown United States
2686 ATGS-MMD-ASUS false
9.75.55.26
 unknown United States
3356 LEVEL3US false
176.196.14.230
 unknown Russian Federation
39927 ELIGHT-ASRU false
117.26.163.12
 unknown China
133776 CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN false
201.13.213.85
 unknown Brazil
27699 TELEFONICABRASILSABR false
129.66.74.53
 unknown United States
3464 ASC-NETUS false
102.148.89.8
 unknown Zambia
37287 ZAIN-ZAMBIAZM false
200.246.162.177
 unknown Brazil
4230 CLAROSABR false
107.112.85.158
 unknown United States
7018 ATT-INTERNET4US false
114.190.78.21
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
138.93.155.243
 unknown United States
11482 CANISIUS-COLLEGEUS false
204.243.128.143
 unknown United States
174 COGENT-174US false
31.226.165.42
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
38.144.99.87
 unknown United States
174 COGENT-174US false
178.121.229.59
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
173.175.185.173
 unknown United States
11427 TWC-11427-TEXASUS false
79.48.47.24
 unknown Italy
3269 ASN-IBSNAZIT false
179.177.63.160
 unknown Brazil
18881 TELEFONICABRASILSABR false
163.100.32.2
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
88.190.58.13
 unknown France
12322 PROXADFR false
197.220.77.205
 unknown Somalia
37326 GICOSO false
193.45.101.1
 unknown Sweden
1299 TELIANETTeliaCarrierEU false
189.198.19.27
 unknown Mexico
13999 MegaCableSAdeCVMX false