Linux Analysis Report
arm7.elf

Overview

General Information

Sample name: arm7.elf
Analysis ID: 1417379
MD5: 77967c843ae42a4d7059e388f938ab0c
SHA1: 03884c9b8873b422dc4a898fdd692eec0160405a
SHA256: d51066a2804b29bff6aaba25103fc002c4bdc5b66dd8de67edb321254c708e03
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm7.elf ReversingLabs: Detection: 70%
Source: arm7.elf Virustotal: Detection: 61% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:48376 -> 67.217.60.78:7854
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 73.87.215.141:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 39.138.65.52:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 5.58.132.135:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.94.14.108:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 136.98.149.207:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 193.20.120.222:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 222.247.71.208:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.73.25.135:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 100.170.77.69:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 100.28.213.197:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.104.228.167:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 81.128.111.110:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 205.246.159.122:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 79.113.155.124:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 164.87.177.177:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 9.176.199.64:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 36.231.52.103:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 212.89.40.173:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 168.220.139.232:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 194.122.28.114:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 35.221.116.5:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.197.6.86:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 108.158.38.10:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 14.33.219.246:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 52.41.76.182:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 119.92.114.108:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.242.170.174:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 216.113.32.112:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 94.242.111.183:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 62.52.216.11:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 189.75.202.207:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.36.134.231:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 217.166.55.94:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 67.243.174.42:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 220.24.91.54:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 49.20.94.25:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 61.250.192.209:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 72.8.88.220:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 4.170.188.90:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 42.153.221.121:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 82.233.101.24:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 64.175.152.24:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 174.82.112.103:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 73.216.176.125:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 111.218.118.153:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 66.186.248.188:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 107.46.194.108:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 93.52.216.33:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 48.114.148.127:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 179.82.155.31:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 1.232.213.13:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 88.167.247.206:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 47.91.169.168:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 129.107.79.153:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 92.177.154.79:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 85.111.252.13:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 53.120.233.61:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.203.243.193:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 27.111.151.149:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 106.118.205.224:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 68.64.208.69:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 34.60.119.120:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 122.115.42.233:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 206.31.172.86:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 218.93.92.95:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.110.168.172:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 84.224.228.212:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 67.193.179.241:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 112.196.144.202:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 191.165.118.143:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 23.143.104.18:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 9.216.78.240:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 136.239.123.57:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 111.206.134.141:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 79.181.253.82:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 166.238.51.182:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 217.72.226.79:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 213.236.84.17:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 168.206.250.202:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.13.95.151:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 194.185.165.174:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 38.190.233.7:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 213.252.72.139:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.77.105.217:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 169.216.106.30:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 128.186.201.220:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 159.219.66.160:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 58.135.136.217:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 201.87.139.204:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 151.15.83.243:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 59.67.137.200:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 83.196.86.197:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 5.148.16.16:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 64.190.160.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 98.106.188.22:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 195.109.255.14:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 121.109.24.87:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.31.104.145:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.71.230.84:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 169.181.3.50:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 105.34.127.105:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.241.202.15:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 53.213.119.192:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 32.253.207.190:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 210.160.122.186:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 166.123.37.54:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 200.250.156.49:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 187.69.217.157:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 82.50.17.226:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 2.6.135.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 123.34.252.41:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 194.153.217.252:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 164.91.111.112:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.188.27.117:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 48.224.225.35:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.156.250.177:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.132.7.28:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 48.162.163.29:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.99.191.184:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 59.188.19.101:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 14.134.189.0:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 209.35.13.131:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 34.105.116.0:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 164.136.227.195:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 78.133.89.237:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 24.173.188.169:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 71.53.78.95:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 19.52.200.111:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 220.235.183.127:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.157.128.6:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 12.108.117.151:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 199.103.134.168:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 140.254.197.146:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 14.164.71.186:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 69.70.93.211:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 205.140.176.60:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 216.120.46.54:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 69.5.169.54:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 212.249.136.164:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.64.43.199:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 157.38.25.107:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 198.253.152.1:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 25.24.132.0:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 83.7.201.161:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 187.16.241.101:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 4.155.138.86:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 14.0.207.17:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 158.182.89.25:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.151.245.97:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 79.161.221.60:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 185.229.41.49:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.191.36.196:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 65.126.67.32:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 8.73.243.43:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 204.110.190.69:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 209.40.27.198:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 209.246.56.150:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 196.142.193.210:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 36.156.30.50:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 119.115.70.111:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 69.110.111.155:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 152.164.161.128:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 92.67.48.63:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 43.204.192.96:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 182.98.148.230:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 105.0.32.158:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 162.30.30.159:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 54.120.234.53:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 40.48.12.122:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 91.178.84.241:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 49.153.192.204:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 158.146.66.207:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 53.132.118.209:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 202.80.47.29:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 211.72.75.131:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 210.198.101.31:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.227.233.19:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 95.112.18.74:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 197.77.139.44:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 147.181.112.167:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 135.164.210.152:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 185.60.127.167:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 39.109.194.228:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 18.76.209.177:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 13.60.210.214:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 31.228.167.132:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 162.217.200.215:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 133.240.160.100:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 47.193.67.214:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 71.113.175.208:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.135.22.66:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.18.155.76:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 107.219.72.196:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 182.90.229.120:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 57.242.5.211:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 61.50.150.36:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 126.191.45.90:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 99.88.76.99:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 50.109.101.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 199.171.155.190:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 125.157.35.8:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 1.228.26.198:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 160.50.153.215:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 126.31.103.242:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 123.95.183.13:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 14.5.78.158:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 120.115.11.148:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 85.79.248.164:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 193.104.237.71:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 155.71.102.182:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 207.77.148.21:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 182.38.87.32:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 211.126.116.22:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 211.160.63.41:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 139.78.22.31:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 39.241.104.41:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 183.216.82.104:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 27.177.19.102:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 38.166.99.78:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 185.57.133.207:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.213.122.3:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.250.127.43:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 60.77.7.142:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.120.6.101:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 117.111.116.93:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 72.180.244.214:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 32.185.175.104:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 76.63.100.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 160.215.168.195:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 69.53.15.67:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 9.152.234.121:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 101.121.2.147:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 100.248.161.153:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 31.173.100.220:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 156.75.215.247:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 134.44.90.8:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 130.73.29.107:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 51.130.245.250:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 223.180.68.111:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 27.225.141.171:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 155.84.45.105:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 152.225.240.139:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 110.219.234.188:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 162.249.37.228:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 190.236.77.28:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 207.89.128.236:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 144.189.238.107:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.49.236.41:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 108.13.92.223:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 17.3.118.1:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 174.166.104.107:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.143.186.43:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 205.68.191.213:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 36.111.197.138:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 130.55.155.233:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.246.127.95:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 4.145.166.195:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 203.214.239.162:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 20.44.114.61:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 141.101.139.59:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 96.95.122.23:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.150.130.128:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 117.176.235.48:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 65.174.120.233:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 132.174.146.168:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 151.230.67.159:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.108.133.233:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 188.14.180.32:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 81.247.204.136:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 73.232.113.65:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.106.130.181:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 131.93.216.25:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 177.245.208.17:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 87.232.186.107:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 49.70.149.106:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 52.251.112.4:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.109.255.189:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 152.40.135.3:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 218.47.235.186:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 93.55.181.1:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 182.108.25.61:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 151.241.121.111:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 164.90.177.1:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 110.213.140.185:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 198.78.142.151:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 164.3.56.224:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 1.222.132.74:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 184.16.209.129:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 128.243.165.86:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 65.168.255.230:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 182.25.212.59:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 78.149.12.28:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 158.195.227.65:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 140.240.22.100:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 81.86.171.218:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 147.11.109.253:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.148.238.68:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 189.120.102.151:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 165.58.130.201:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 17.13.237.90:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.16.100.205:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 169.0.33.199:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 78.28.44.130:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 61.61.167.56:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 1.52.145.44:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 188.118.183.11:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 134.106.156.26:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 37.167.61.254:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 50.83.191.240:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 78.72.100.135:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 218.169.22.24:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.185.96.9:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 191.93.16.140:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 218.185.105.195:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 143.145.158.153:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 9.252.178.145:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 209.57.181.202:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 69.145.68.119:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 175.166.147.229:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 32.158.137.160:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 147.155.161.18:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 51.242.210.22:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 175.136.84.91:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 135.74.45.198:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 19.250.22.125:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 36.242.69.42:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 89.132.236.99:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 128.13.123.216:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 130.121.40.98:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 93.222.65.53:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 34.138.39.247:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 156.158.88.241:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.45.207.211:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 185.87.244.146:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 211.225.40.94:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 63.241.64.230:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 77.177.0.203:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 121.218.196.82:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.168.15.154:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 41.213.195.144:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 78.129.220.12:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 123.24.71.27:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 221.12.206.227:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 216.173.170.97:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 200.108.114.112:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 50.80.70.70:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 218.119.230.254:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 90.55.215.254:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.46.214.93:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 57.0.107.77:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 73.173.159.172:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 1.112.79.239:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 166.50.145.63:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 157.218.43.108:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 135.217.50.103:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.133.89.128:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 125.78.40.216:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 211.145.207.33:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 160.251.186.93:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 178.96.115.115:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 210.177.184.87:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 117.185.127.83:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 189.166.8.134:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 12.146.86.230:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 204.233.148.160:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 121.83.238.232:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 107.138.66.41:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 51.36.206.239:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 104.177.167.40:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 48.113.231.38:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 198.30.222.214:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 109.34.203.144:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 32.65.113.162:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 42.165.146.122:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 150.41.111.170:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 89.185.55.162:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 205.154.197.216:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 17.27.207.21:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 84.2.50.35:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 196.21.0.127:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 162.31.63.53:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.123.7.175:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 74.59.240.197:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 219.168.87.50:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.11.65.128:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 134.207.129.215:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 106.217.145.59:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 24.161.242.202:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 213.149.18.164:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 94.153.7.121:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 43.117.79.84:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 45.227.238.82:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 41.11.249.168:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 206.25.104.46:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 52.145.234.155:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 98.206.99.188:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 61.203.90.138:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 71.118.172.75:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 189.246.102.64:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 37.1.123.95:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 149.221.148.155:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 12.159.218.67:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 53.188.115.192:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.63.123.155:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 46.85.207.131:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 80.217.44.168:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 163.90.95.163:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 96.61.203.239:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.221.221.30:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 190.172.124.144:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 112.241.28.97:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 156.255.36.104:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 201.228.105.243:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 159.222.129.31:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 58.192.104.165:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 75.143.77.64:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 63.191.65.109:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 184.137.196.125:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 82.157.149.186:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 5.108.134.167:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 159.246.56.77:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 64.80.219.4:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 158.62.85.167:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.229.249.125:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 124.2.117.87:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 110.149.2.104:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 219.83.161.77:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 74.13.144.240:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 183.143.97.63:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 63.236.32.203:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 37.132.80.51:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 18.112.253.47:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 105.155.11.182:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 20.15.130.104:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 151.113.247.195:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 105.187.240.7:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 191.11.88.181:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 82.147.195.127:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 106.60.198.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 82.28.123.172:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 32.231.136.105:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 188.121.124.16:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.194.11.172:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 59.13.225.191:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 156.24.238.194:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 130.223.165.187:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 44.78.131.189:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 139.29.56.19:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 110.10.148.50:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 80.146.244.147:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 5.244.110.249:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 216.254.2.207:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 25.134.45.11:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 27.138.2.247:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.253.132.63:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 116.46.109.170:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 108.185.227.145:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 47.212.36.80:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 209.224.255.50:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 216.190.64.53:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 141.110.199.161:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 87.72.124.73:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 108.181.237.15:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 169.74.156.179:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 61.101.96.143:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 206.254.168.39:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 95.31.17.205:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 188.45.246.119:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 48.96.183.3:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 94.85.81.147:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 106.66.111.6:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 140.215.184.67:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 9.111.27.246:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 156.213.166.153:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 113.77.24.20:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 125.104.77.17:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 146.225.142.239:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 40.201.212.6:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 87.63.211.248:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 83.10.227.152:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 167.104.71.81:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 122.163.164.137:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 148.183.171.105:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 81.38.50.26:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 80.8.12.211:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 213.25.220.39:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 143.58.75.253:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 113.229.180.120:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.99.58.132:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 169.210.208.137:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 118.152.209.64:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 126.138.187.177:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 64.207.158.223:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 188.196.13.140:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 171.175.46.239:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 80.15.227.34:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 86.157.90.112:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 114.90.152.27:2323
Source: global traffic TCP traffic: 192.168.2.14:56737 -> 180.99.37.238:2323
Sample listens on a socket
Source: /tmp/arm7.elf (PID: 5495) Socket: 192.168.2.14::10345 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 67.217.60.78
Source: unknown TCP traffic detected without corresponding DNS query: 73.87.215.141
Source: unknown TCP traffic detected without corresponding DNS query: 91.212.235.99
Source: unknown TCP traffic detected without corresponding DNS query: 147.165.131.141
Source: unknown TCP traffic detected without corresponding DNS query: 96.40.66.78
Source: unknown TCP traffic detected without corresponding DNS query: 96.79.6.43
Source: unknown TCP traffic detected without corresponding DNS query: 201.155.28.215
Source: unknown TCP traffic detected without corresponding DNS query: 103.67.207.178
Source: unknown TCP traffic detected without corresponding DNS query: 94.239.55.12
Source: unknown TCP traffic detected without corresponding DNS query: 39.138.65.52
Source: unknown TCP traffic detected without corresponding DNS query: 158.88.5.162
Source: unknown TCP traffic detected without corresponding DNS query: 216.174.195.76
Source: unknown TCP traffic detected without corresponding DNS query: 195.203.188.143
Source: unknown TCP traffic detected without corresponding DNS query: 90.208.176.64
Source: unknown TCP traffic detected without corresponding DNS query: 97.71.231.112
Source: unknown TCP traffic detected without corresponding DNS query: 194.241.52.172
Source: unknown TCP traffic detected without corresponding DNS query: 57.146.89.94
Source: unknown TCP traffic detected without corresponding DNS query: 4.79.253.159
Source: unknown TCP traffic detected without corresponding DNS query: 220.134.187.97
Source: unknown TCP traffic detected without corresponding DNS query: 66.83.152.25
Source: unknown TCP traffic detected without corresponding DNS query: 187.9.131.150
Source: unknown TCP traffic detected without corresponding DNS query: 5.58.132.135
Source: unknown TCP traffic detected without corresponding DNS query: 54.155.43.135
Source: unknown TCP traffic detected without corresponding DNS query: 132.67.72.190
Source: unknown TCP traffic detected without corresponding DNS query: 95.152.204.43
Source: unknown TCP traffic detected without corresponding DNS query: 44.196.86.7
Source: unknown TCP traffic detected without corresponding DNS query: 188.235.179.179
Source: unknown TCP traffic detected without corresponding DNS query: 137.239.170.132
Source: unknown TCP traffic detected without corresponding DNS query: 149.94.14.108
Source: unknown TCP traffic detected without corresponding DNS query: 50.6.126.112
Source: unknown TCP traffic detected without corresponding DNS query: 8.26.165.60
Source: unknown TCP traffic detected without corresponding DNS query: 206.68.38.141
Source: unknown TCP traffic detected without corresponding DNS query: 50.65.230.34
Source: unknown TCP traffic detected without corresponding DNS query: 88.119.163.60
Source: unknown TCP traffic detected without corresponding DNS query: 48.234.242.244
Source: unknown TCP traffic detected without corresponding DNS query: 43.234.221.29
Source: unknown TCP traffic detected without corresponding DNS query: 136.98.149.207
Source: unknown TCP traffic detected without corresponding DNS query: 158.72.36.53
Source: unknown TCP traffic detected without corresponding DNS query: 52.180.12.54
Source: unknown TCP traffic detected without corresponding DNS query: 148.112.71.67
Source: unknown TCP traffic detected without corresponding DNS query: 140.206.79.83
Source: unknown TCP traffic detected without corresponding DNS query: 96.240.249.229
Source: unknown TCP traffic detected without corresponding DNS query: 59.240.199.124
Source: unknown TCP traffic detected without corresponding DNS query: 86.151.12.250
Source: unknown TCP traffic detected without corresponding DNS query: 193.20.120.222
Source: unknown TCP traffic detected without corresponding DNS query: 9.35.245.178
Source: unknown TCP traffic detected without corresponding DNS query: 219.71.45.4
Source: unknown TCP traffic detected without corresponding DNS query: 186.143.45.164
Source: unknown TCP traffic detected without corresponding DNS query: 79.0.88.11
Source: unknown TCP traffic detected without corresponding DNS query: 53.121.69.90
Source: unknown Network traffic detected: HTTP traffic on port 37902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 37902
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: arm7.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5495.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5503.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: ELF static info symbol of initial sample Name: attack_method_ovh
Source: ELF static info symbol of initial sample Name: attack_method_psh
Source: ELF static info symbol of initial sample Name: attack_method_raw
Source: ELF static info symbol of initial sample Name: attack_method_std
Sample and/or dropped files contains symbols with suspicious names
Source: arm7.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Source: arm7.elf ELF static info symbol of initial sample: scanner.c
Source: arm7.elf ELF static info symbol of initial sample: scanner_init
Source: arm7.elf ELF static info symbol of initial sample: scanner_pid
Source: arm7.elf ELF static info symbol of initial sample: scanner_rawpkt
Yara signature match
Source: arm7.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5495.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5503.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 5495, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal76.troj.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5545) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FWHqUVv3zk /tmp/tmp.ph3teLOcm2 /tmp/tmp.kjt5sJ4knS Jump to behavior
Source: /usr/bin/dash (PID: 5546) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FWHqUVv3zk /tmp/tmp.ph3teLOcm2 /tmp/tmp.kjt5sJ4knS Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7.elf (PID: 5495) Queries kernel information via 'uname': Jump to behavior
Source: arm7.elf, 5495.1.000055c1bc75d000.000055c1bc8ac000.rw-.sdmp, arm7.elf, 5503.1.000055c1bc75d000.000055c1bc8ac000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 5495.1.000055c1bc75d000.000055c1bc8ac000.rw-.sdmp, arm7.elf, 5503.1.000055c1bc75d000.000055c1bc8ac000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 5495.1.00007ffd7e206000.00007ffd7e227000.rw-.sdmp, arm7.elf, 5503.1.00007ffd7e206000.00007ffd7e227000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 5495.1.00007ffd7e206000.00007ffd7e227000.rw-.sdmp, arm7.elf, 5503.1.00007ffd7e206000.00007ffd7e227000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: arm7.elf, type: SAMPLE
Source: Yara match File source: 5495.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5503.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: arm7.elf, type: SAMPLE
Source: Yara match File source: 5495.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5503.1.00007faae0017000.00007faae002a000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
122.95.192.215
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
86.195.213.247
 unknown France
3215 FranceTelecom-OrangeFR false
49.202.86.31
 unknown India
4804 MPX-ASMicroplexPTYLTDAU false
37.32.176.163
 unknown Greece
5408 GR-NEThttpwwwgrnetgrGR false
78.6.11.147
 unknown Italy
8968 BT-ITALIAIT false
100.212.201.50
 unknown United States
21928 T-MOBILE-AS21928US false
48.20.69.151
 unknown United States
2686 ATGS-MMD-ASUS false
97.94.57.164
 unknown United States
20115 CHARTER-20115US false
47.54.191.181
 unknown Canada
855 CANET-ASN-4CA false
9.17.119.232
 unknown United States
3356 LEVEL3US false
86.103.138.140
 unknown Germany
13101 TNG-ASTNGStadtnetzGmbHDE false
92.33.27.112
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
210.117.246.82
 unknown Korea Republic of
1237 KREONET-AS-KRKISTIKR false
172.38.191.113
 unknown United States
21928 T-MOBILE-AS21928US false
91.132.114.147
 unknown Poland
15537 PL-NETPL false
217.101.183.25
 unknown Netherlands
33915 TNF-ASNL false
23.114.206.54
 unknown United States
7018 ATT-INTERNET4US false
198.110.160.61
 unknown United States
237 MERIT-AS-14US false
1.70.131.58
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
189.191.213.214
 unknown Mexico
8151 UninetSAdeCVMX false
45.244.171.67
 unknown Egypt
24863 LINKdotNET-ASEG false
128.155.43.210
 unknown United States
1254 AS1254US false
209.228.59.40
 unknown United States
7029 WINDSTREAMUS false
107.23.89.177
 unknown United States
14618 AMAZON-AESUS false
54.171.188.185
 unknown United States
16509 AMAZON-02US false
190.61.202.165
 unknown Colombia
18747 IFX18747US false
221.241.65.184
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
104.209.83.205
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
204.176.82.232
 unknown United States
701 UUNETUS false
128.157.96.185
 unknown United States
270 AS270US false
213.77.71.10
 unknown Poland
5617 TPNETPL false
188.136.182.158
 unknown Iran (ISLAMIC Republic Of)
48309 AGS-ASIR false
41.71.246.29
 unknown Nigeria
37053 RSAWEB-ASZA false
27.64.175.231
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
180.32.145.92
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
183.193.97.82
 unknown China
24400 CMNET-V4SHANGHAI-AS-APShanghaiMobileCommunicationsCoLt false
76.88.196.113
 unknown United States
20001 TWC-20001-PACWESTUS false
58.191.38.99
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
186.134.221.143
 unknown Argentina
22927 TelefonicadeArgentinaAR false
81.31.165.213
 unknown Iran (ISLAMIC Republic Of)
12660 SHARIF-EDU-NETIR false
168.66.130.8
 unknown United States
265240 ULTRANETSERVICOSEMINTERNETLTDABR false
129.90.16.239
 unknown Venezuela
1942 FR-TIGREToileInformatiqueGREnobloiseEU false
149.125.64.172
 unknown United States
4190 BINGHAMTON-UUS false
131.95.69.205
 unknown United States
16430 USMUS false
219.249.64.80
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
61.149.80.165
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
72.183.14.196
 unknown United States
11427 TWC-11427-TEXASUS false
4.156.73.5
 unknown United States
3356 LEVEL3US false
146.211.245.105
 unknown Finland
16086 DNAFI false
191.184.52.81
 unknown Brazil
28573 CLAROSABR false
135.51.93.42
 unknown United States
54614 CIKTELECOM-CABLECA false
57.105.102.22
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
101.133.99.219
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
2.28.99.70
 unknown United Kingdom
12576 EELtdGB false
201.197.211.112
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
82.31.170.251
 unknown United Kingdom
5089 NTLGB false
133.88.6.118
 unknown Japan 18068 ACROSSDreamWaveShizuokaCoLtdJP false
136.125.182.31
 unknown United States
15169 GOOGLEUS false
57.111.236.160
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
209.225.114.194
 unknown United States
7341 VELOCITYUS false
165.219.151.105
 unknown United States
3136 STATE-OF-WISCONSIN-AS1US false
173.249.148.226
 unknown United States
40819 VPSDATACENTERUS false
93.103.14.16
 unknown Slovenia
34779 T-2-ASASsetpropagatedbyT-2dooSI false
144.29.5.42
 unknown United States
26258 BASF-CORPUS false
182.51.85.143
 unknown China
63590 HEBBTNHebeiBroadcastingTVNetworkCN false
162.82.139.58
 unknown United States
46620 WBH-ISC-ROUS false
9.255.18.233
 unknown United States
3356 LEVEL3US false
46.225.224.151
 unknown Iran (ISLAMIC Republic Of)
56402 DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIran false
206.198.155.23
 unknown United States
46160 SKYTAP-TUKUS false
159.62.185.200
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
217.69.134.17
 unknown Russian Federation
47764 MAILRU-ASMailRuRU false
223.207.126.132
 unknown Thailand
45758 TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH false
209.10.58.6
 unknown United States
40913 QTS-SJCUS false
97.77.97.60
 unknown United States
11427 TWC-11427-TEXASUS false
153.116.124.254
 unknown United States
5501 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe false
216.62.133.5
 unknown United States
7018 ATT-INTERNET4US false
116.102.89.206
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
211.17.6.147
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
189.132.53.207
 unknown Mexico
8151 UninetSAdeCVMX false
134.131.195.67
 unknown United States
132 WPAFB-CSD-NET-ASUS false
40.160.92.139
 unknown United States
4249 LILLY-ASUS false
63.48.75.250
 unknown United States
701 UUNETUS false
42.193.122.107
 unknown China
4249 LILLY-ASUS false
116.63.190.114
 unknown China
134542 UNICOM-GUIANChinaUnicomIPnetworkCN false
13.62.27.239
 unknown United States
16509 AMAZON-02US false
170.131.57.36
 unknown United States
13954 STAPLESUS false
74.169.151.162
 unknown United States
7018 ATT-INTERNET4US false
125.232.234.196
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
135.44.88.130
 unknown United States
54614 CIKTELECOM-CABLECA false
84.39.109.148
 unknown Germany
48200 OPTEAMAX-ASDE false
61.4.213.42
 unknown Korea Republic of
18313 PCN-AS-KRLGHelloVisionCorpKR false
135.254.127.188
 unknown United States
10455 LUCENT-CIOUS false
223.238.234.135
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
47.208.215.55
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
53.11.240.98
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
65.59.41.70
 unknown United States
3356 LEVEL3US false
207.71.32.246
 unknown United States
13993 MOTIVE-COMMUS false
131.62.151.213
 unknown United States
385 AFCONC-BLOCK1-ASUS false
86.145.254.172
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
8.144.211.179
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false