Linux Analysis Report
mips.elf

Overview

General Information

Sample name: mips.elf
Analysis ID: 1417381
MD5: 7f7903a935b4d2b4370c189e6e636151
SHA1: 0f1dcba4fb182526e39398ba591f1ec28e84d373
SHA256: e0aaf01b459cbf11b2b0426c0fd9f2cd08cdbf10dd6551178dd805321eae61e9
Infos:

Detection

Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: mips.elf ReversingLabs: Detection: 62%
Source: mips.elf Virustotal: Detection: 62% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2023449 ET TROJAN Possible Linux.Mirai Login Attempt (vizxv) 192.168.2.23:39178 -> 118.69.78.88:23
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:47356 -> 67.217.60.78:7854
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 13.126.109.85:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 77.134.84.112:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 195.134.42.38:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 65.15.2.231:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 144.161.49.43:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 195.232.124.159:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 93.250.40.49:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 95.112.72.134:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 78.158.143.19:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 102.201.224.112:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 47.51.36.122:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 44.50.240.129:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 143.237.144.69:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 209.196.31.79:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 142.227.239.60:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 65.159.243.200:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.40.215.251:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.242.52.17:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 66.16.63.213:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 44.85.190.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 161.160.174.14:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.95.33.41:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 49.121.101.90:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 63.170.66.133:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 80.6.149.105:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 138.235.117.46:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 112.184.190.217:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 124.185.213.209:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 132.251.48.191:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 117.65.245.77:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 188.0.235.96:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 221.62.254.173:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 221.207.185.50:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 204.103.98.96:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 43.61.143.235:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 145.31.179.247:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 162.247.240.6:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 157.183.193.145:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 117.118.167.24:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 141.172.60.169:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 160.54.38.94:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 155.166.4.206:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.166.61.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 39.240.234.186:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 47.28.171.246:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.64.109.28:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 125.188.154.27:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.63.168.151:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 91.84.66.14:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 35.47.210.87:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 167.121.19.37:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 64.31.139.146:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 79.206.241.16:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 200.188.199.146:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 152.4.47.74:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 17.4.184.125:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 59.154.31.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 154.198.202.127:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 175.248.66.222:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 182.70.37.85:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 77.61.8.227:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.72.96.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 164.164.151.80:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 222.171.119.171:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 222.63.130.58:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 202.80.167.1:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 135.189.225.78:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 60.49.130.43:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 196.105.247.208:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 31.6.158.15:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 147.144.60.254:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 121.171.169.145:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.27.149.0:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 134.135.253.109:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.162.67.34:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 66.104.81.144:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 165.131.126.176:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 180.38.8.124:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 86.45.255.226:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 52.3.115.224:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 42.104.78.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 133.236.234.192:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 88.240.179.197:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 76.243.74.113:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 35.156.164.189:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 107.72.247.103:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 175.34.165.193:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 181.117.199.101:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 166.187.189.216:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 181.6.112.198:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 147.104.167.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 165.51.48.173:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 217.122.113.218:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 118.96.226.98:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 150.166.42.196:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 205.166.137.250:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 48.60.114.1:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 17.3.233.113:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 191.59.82.106:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 211.46.69.245:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 166.76.100.136:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 162.196.251.79:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 178.163.171.171:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 90.255.30.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 221.12.125.255:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 193.246.237.114:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 179.222.223.105:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 62.34.17.202:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 157.226.50.211:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 79.162.244.110:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 146.149.124.140:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 146.201.18.60:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 180.255.214.219:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.108.197.179:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 69.65.12.212:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 69.122.206.251:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 24.28.149.66:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 132.253.93.43:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.107.243.7:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 18.230.63.190:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.65.127.75:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 79.55.71.170:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 114.116.176.190:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 18.35.87.35:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 199.90.125.174:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 36.2.128.21:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 40.18.107.244:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 92.68.41.6:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 46.249.59.153:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 50.117.100.254:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 73.234.4.17:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 200.62.223.0:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.192.13.129:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 141.201.207.239:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 77.54.222.209:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 112.76.142.133:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 207.251.32.20:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 76.55.234.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 80.247.182.212:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 40.200.121.164:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 128.17.180.173:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.79.47.15:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 35.120.238.204:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 81.224.4.237:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 101.35.91.43:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 32.22.100.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.208.63.99:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 163.34.103.215:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 174.89.76.58:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 209.197.100.6:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 152.37.176.7:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 102.17.231.166:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.51.44.85:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 75.255.54.87:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 23.218.47.194:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 107.162.178.159:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 63.175.189.168:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.21.15.182:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 8.253.68.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 207.26.77.227:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 80.1.208.74:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 219.146.175.178:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 66.135.145.4:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 97.23.212.147:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 221.23.128.7:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 118.6.181.155:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 43.255.78.64:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 31.126.141.23:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 70.243.182.172:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 203.32.196.101:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 50.58.232.224:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 112.157.22.112:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 96.195.102.87:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 52.149.20.158:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 46.219.205.12:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 96.71.210.65:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 65.57.180.186:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.88.105.195:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.53.86.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 213.221.74.50:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.110.58.206:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 57.229.21.30:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 91.164.60.173:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.10.137.207:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 79.218.174.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 142.187.117.107:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 140.241.252.104:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 25.235.50.85:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 44.236.94.11:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 71.40.7.143:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 155.181.171.136:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 120.3.11.84:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.241.132.77:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 59.223.128.155:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 88.248.112.225:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 169.234.127.134:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 4.24.225.104:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.92.61.43:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.184.66.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 199.12.151.14:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 121.75.242.94:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 37.100.5.72:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 37.172.210.203:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 38.227.87.166:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 129.8.3.221:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 199.76.68.206:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 92.180.122.5:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 14.168.45.153:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 144.167.6.217:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.167.12.108:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 201.134.124.208:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 19.224.4.226:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 173.229.39.70:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 196.184.201.89:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 138.209.221.252:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 160.81.229.29:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 24.108.150.140:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.141.154.213:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 52.89.99.231:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 178.109.223.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.103.75.50:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 115.11.142.49:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 177.245.93.106:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 174.94.127.135:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 48.225.4.101:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 25.90.204.64:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 201.170.154.164:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 220.145.93.3:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 154.178.92.135:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 49.27.148.49:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 218.76.219.58:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 68.29.88.50:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 88.119.31.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 139.87.207.3:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 74.34.53.250:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 217.1.85.234:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 71.37.176.108:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 157.40.143.114:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 34.134.116.24:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.71.213.2:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 163.2.66.236:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 24.190.102.33:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 85.170.70.115:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 222.26.2.150:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 37.215.230.109:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 206.155.49.177:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 218.140.44.86:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 1.143.100.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 107.193.22.218:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 46.249.67.30:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 93.78.239.52:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 43.1.182.155:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 204.202.50.60:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 209.158.21.179:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 110.213.77.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 205.78.158.242:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 159.176.223.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 222.107.94.104:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 115.204.140.165:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 193.228.225.0:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 195.201.47.55:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 19.149.91.205:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 111.200.30.131:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 93.234.244.107:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 32.8.147.46:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 74.179.92.4:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 69.245.187.134:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 168.158.46.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 42.232.41.157:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 150.138.218.39:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 179.219.92.97:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 39.225.218.136:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 128.179.153.161:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 105.51.113.26:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 114.155.50.214:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 54.200.79.178:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 66.47.83.169:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 148.16.158.124:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 23.114.119.38:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 87.184.42.83:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 135.127.66.193:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 103.85.35.168:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 185.251.233.5:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 148.134.76.67:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 101.108.68.246:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 138.69.175.75:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 32.59.195.8:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 38.10.103.66:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 211.26.160.64:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 154.247.175.179:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 166.100.40.116:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.158.164.52:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 94.124.255.232:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 77.193.252.118:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 18.1.24.55:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.131.252.153:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 8.84.26.176:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 69.255.95.144:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 83.194.64.243:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 59.222.35.185:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 93.17.0.167:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 134.133.41.174:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 203.153.231.191:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 19.119.44.50:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 93.152.63.34:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 190.141.197.228:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 94.205.158.76:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 100.234.243.28:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.25.52.91:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 180.2.90.18:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 173.9.209.212:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 136.211.73.192:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 130.200.232.237:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 181.155.46.132:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 1.95.176.64:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 198.143.245.12:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 220.136.246.162:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 66.174.138.78:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 162.55.91.179:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 105.59.86.104:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 212.2.60.67:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 46.25.165.108:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 106.150.107.136:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 1.25.247.161:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 14.170.178.102:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 153.96.51.200:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 94.93.194.133:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 200.106.230.154:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 98.1.39.69:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 108.19.81.192:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 39.28.213.236:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 194.64.65.35:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 207.123.128.198:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 63.159.204.18:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 132.188.109.176:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 133.98.43.215:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 63.119.16.40:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.138.146.215:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 119.156.57.233:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 92.105.107.4:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 112.154.216.69:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 111.138.77.236:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 115.179.76.131:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 152.108.245.82:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 176.160.39.173:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 166.151.141.189:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 160.97.110.98:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 107.201.99.128:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 2.244.86.5:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 152.38.210.111:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 95.87.214.175:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 169.90.64.206:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 129.60.192.13:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 205.5.246.25:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 119.26.208.220:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.181.252.123:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.34.162.117:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 139.253.196.178:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 200.45.241.144:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 122.104.57.54:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 175.72.207.98:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 156.95.102.25:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 90.59.65.216:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 186.147.105.138:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 135.19.211.19:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 153.242.92.137:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.60.0.170:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 132.197.125.193:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 129.176.133.217:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 105.104.31.181:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 206.192.68.131:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 202.9.88.119:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 165.228.127.33:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 12.226.157.135:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 209.122.224.123:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 167.102.239.189:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 168.191.209.130:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 76.147.156.206:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 179.51.29.250:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 149.201.115.250:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 61.110.231.214:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 19.104.33.241:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 57.91.91.190:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 179.218.132.116:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 173.1.30.244:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 13.212.80.124:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.149.194.89:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 190.162.127.105:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 173.9.203.47:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 18.86.173.220:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 152.153.246.136:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 128.246.121.107:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 161.185.163.158:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 139.187.54.188:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 44.41.227.15:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 39.252.69.70:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 217.223.5.98:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.187.0.126:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 190.184.129.143:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 180.192.137.146:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 102.58.165.49:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 101.51.113.118:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 140.142.39.77:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 18.229.93.248:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 112.127.36.148:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 32.190.129.231:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 139.187.157.21:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 153.183.229.217:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 151.107.163.248:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.139.213.226:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 177.227.193.196:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 81.226.27.34:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 169.6.93.5:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 202.81.108.130:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 189.83.139.101:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 106.221.132.146:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 78.185.34.241:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 201.163.149.134:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 179.46.219.165:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 138.214.38.174:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.240.66.222:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 137.234.91.123:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 38.90.250.166:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 153.66.201.62:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 47.239.183.94:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 156.21.192.83:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.99.183.192:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.174.182.160:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 184.35.222.84:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 134.184.51.64:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 70.147.106.161:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 163.76.106.248:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 14.88.1.34:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 181.61.38.9:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 41.249.140.155:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 40.101.172.161:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 60.103.117.88:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 45.133.26.135:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 13.112.255.232:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 164.184.22.160:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 46.229.195.114:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 99.155.149.57:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 193.187.176.194:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 64.177.174.94:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 9.93.22.167:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 2.219.214.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 155.227.84.252:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 88.143.218.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.50.35.197:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 76.144.162.95:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 194.98.64.140:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 89.104.196.223:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 65.133.141.224:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 185.198.84.107:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 100.205.131.86:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.60.154.66:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 24.12.205.31:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 85.76.95.245:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 31.55.241.113:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 42.74.57.166:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 198.55.143.21:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 208.26.179.4:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 47.24.230.28:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 194.91.129.170:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 156.40.160.45:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 211.148.30.131:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 134.48.186.229:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 1.231.149.106:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 32.47.125.121:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 213.83.101.237:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 170.15.140.70:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 62.27.235.210:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 197.148.229.243:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 139.122.7.90:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 2.147.219.49:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 37.36.128.203:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 193.215.1.170:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 67.2.91.71:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 201.79.43.223:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 170.98.0.181:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 114.146.130.58:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 147.85.232.72:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 90.16.185.213:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 50.11.92.68:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 171.186.220.91:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 8.242.223.148:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 168.135.147.177:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 34.213.209.168:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 116.51.251.22:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 69.231.205.224:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 220.135.103.159:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 9.87.206.86:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 168.26.135.159:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 71.54.188.20:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 78.205.226.53:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 52.163.54.149:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 154.198.59.169:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 124.75.111.234:2323
Source: global traffic TCP traffic: 192.168.2.23:32781 -> 165.39.97.245:2323
Sample listens on a socket
Source: /tmp/mips.elf (PID: 6268) Socket: 192.168.2.23::10345 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:39258 -> 34.249.145.219:443
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 67.217.60.78
Source: unknown TCP traffic detected without corresponding DNS query: 13.126.109.85
Source: unknown TCP traffic detected without corresponding DNS query: 139.134.7.96
Source: unknown TCP traffic detected without corresponding DNS query: 57.252.222.180
Source: unknown TCP traffic detected without corresponding DNS query: 170.138.185.84
Source: unknown TCP traffic detected without corresponding DNS query: 216.72.221.43
Source: unknown TCP traffic detected without corresponding DNS query: 44.71.219.143
Source: unknown TCP traffic detected without corresponding DNS query: 141.245.240.46
Source: unknown TCP traffic detected without corresponding DNS query: 146.105.111.63
Source: unknown TCP traffic detected without corresponding DNS query: 124.111.155.119
Source: unknown TCP traffic detected without corresponding DNS query: 18.105.31.85
Source: unknown TCP traffic detected without corresponding DNS query: 49.160.107.180
Source: unknown TCP traffic detected without corresponding DNS query: 156.209.9.53
Source: unknown TCP traffic detected without corresponding DNS query: 121.232.144.58
Source: unknown TCP traffic detected without corresponding DNS query: 77.134.84.112
Source: unknown TCP traffic detected without corresponding DNS query: 137.188.54.111
Source: unknown TCP traffic detected without corresponding DNS query: 34.16.94.161
Source: unknown TCP traffic detected without corresponding DNS query: 139.199.133.156
Source: unknown TCP traffic detected without corresponding DNS query: 53.218.129.96
Source: unknown TCP traffic detected without corresponding DNS query: 45.250.127.5
Source: unknown TCP traffic detected without corresponding DNS query: 195.134.42.38
Source: unknown TCP traffic detected without corresponding DNS query: 190.155.58.245
Source: unknown TCP traffic detected without corresponding DNS query: 107.197.112.149
Source: unknown TCP traffic detected without corresponding DNS query: 156.194.84.226
Source: unknown TCP traffic detected without corresponding DNS query: 221.233.212.29
Source: unknown TCP traffic detected without corresponding DNS query: 79.228.238.142
Source: unknown TCP traffic detected without corresponding DNS query: 39.161.134.233
Source: unknown TCP traffic detected without corresponding DNS query: 163.47.12.230
Source: unknown TCP traffic detected without corresponding DNS query: 142.64.27.100
Source: unknown TCP traffic detected without corresponding DNS query: 65.15.2.231
Source: unknown TCP traffic detected without corresponding DNS query: 92.254.0.51
Source: unknown TCP traffic detected without corresponding DNS query: 39.238.14.137
Source: unknown TCP traffic detected without corresponding DNS query: 32.13.98.185
Source: unknown TCP traffic detected without corresponding DNS query: 81.54.137.111
Source: unknown TCP traffic detected without corresponding DNS query: 39.193.232.62
Source: unknown TCP traffic detected without corresponding DNS query: 136.217.169.64
Source: unknown TCP traffic detected without corresponding DNS query: 8.46.180.84
Source: unknown TCP traffic detected without corresponding DNS query: 142.247.43.5
Source: unknown TCP traffic detected without corresponding DNS query: 38.35.143.97
Source: unknown TCP traffic detected without corresponding DNS query: 144.161.49.43
Source: unknown TCP traffic detected without corresponding DNS query: 145.194.71.0
Source: unknown TCP traffic detected without corresponding DNS query: 90.116.24.75
Source: unknown TCP traffic detected without corresponding DNS query: 96.233.165.248
Source: unknown TCP traffic detected without corresponding DNS query: 178.72.225.175
Source: unknown TCP traffic detected without corresponding DNS query: 67.84.67.5
Source: unknown TCP traffic detected without corresponding DNS query: 39.170.132.45
Source: unknown TCP traffic detected without corresponding DNS query: 144.249.22.131
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39258 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6276.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6268.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 6268, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mips.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: mips.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6276.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6268.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6268, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mips.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6322) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RTjKB4EdJK /tmp/tmp.FMFF7W69mf /tmp/tmp.cl11dZ0cCR Jump to behavior
Source: /usr/bin/dash (PID: 6323) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RTjKB4EdJK /tmp/tmp.FMFF7W69mf /tmp/tmp.cl11dZ0cCR Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mips.elf (PID: 6268) Queries kernel information via 'uname': Jump to behavior
Source: mips.elf, 6268.1.000056035563d000.00005603556e8000.rw-.sdmp, mips.elf, 6276.1.000056035563d000.00005603556e8000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mips
Source: mips.elf, 6268.1.000056035563d000.00005603556e8000.rw-.sdmp, mips.elf, 6276.1.000056035563d000.00005603556e8000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 6268.1.00007ffe5c649000.00007ffe5c66a000.rw-.sdmp, mips.elf, 6276.1.00007ffe5c649000.00007ffe5c66a000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 6268.1.00007ffe5c649000.00007ffe5c66a000.rw-.sdmp, mips.elf, 6276.1.00007ffe5c649000.00007ffe5c66a000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6276.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6268.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: mips.elf, type: SAMPLE
Source: Yara match File source: 6276.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6268.1.00007f16ec400000.00007f16ec411000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
80.9.145.117
 unknown France
3215 FranceTelecom-OrangeFR false
13.175.244.102
 unknown United States
7018 ATT-INTERNET4US false
148.128.197.87
 unknown United States
2386 INS-ASUS false
189.176.245.237
 unknown Mexico
8151 UninetSAdeCVMX false
137.157.4.84
 unknown Australia
45128 ANSTO-AS-APAustralianNuclearScienceandTechnologyOrgani false
88.107.191.120
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
79.124.147.45
 unknown Ukraine
34058 LIFECELL-ASUA false
18.140.146.89
 unknown United States
16509 AMAZON-02US false
151.147.83.155
 unknown United States
6167 CELLCO-PARTUS false
112.13.216.46
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
121.141.121.164
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
12.73.93.103
 unknown United States
7018 ATT-INTERNET4US false
105.150.165.75
 unknown Morocco
6713 IAM-ASMA false
61.117.254.36
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
188.82.230.188
 unknown Portugal
3243 MEO-RESIDENCIALPT false
207.241.178.7
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
184.58.227.140
 unknown United States
10796 TWC-10796-MIDWESTUS false
142.220.242.248
 unknown Canada
13576 SDNW-13576US false
164.152.229.115
 unknown United States
27343 MONSANTO-INETUS false
39.32.166.4
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
176.66.187.77
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
99.99.232.121
 unknown United States
7018 ATT-INTERNET4US false
59.121.20.54
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
86.241.96.241
 unknown France
3215 FranceTelecom-OrangeFR false
66.145.91.54
 unknown United States
19902 NET-STATE-OHIOUS false
117.44.172.139
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
171.186.72.96
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
122.201.14.107
 unknown Viet Nam
38244 VINAGAME-AS-VNVNGCorporationVN false
74.55.36.195
 unknown United States
36351 SOFTLAYERUS false
218.223.148.250
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
113.148.165.225
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
51.231.242.133
 unknown United Kingdom
2686 ATGS-MMD-ASUS false
152.67.248.75
 unknown United States
31898 ORACLE-BMC-31898US false
96.71.70.97
 unknown United States
7922 COMCAST-7922US false
197.59.205.46
 unknown Egypt
8452 TE-ASTE-ASEG false
218.92.29.138
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
62.23.12.111
 unknown United Kingdom
8220 COLTCOLTTechnologyServicesGroupLimitedGB false
130.126.243.38
 unknown United States
38 UIUCUS false
65.114.18.94
 unknown United States
1742 HARVARD-UNIVUS false
81.160.139.221
 unknown Hungary
30904 KOZHALO-ASHU false
107.218.140.12
 unknown United States
7018 ATT-INTERNET4US false
196.226.189.45
 unknown Tunisia
37492 ORANGE-TN false
213.88.138.118
 unknown Sweden
3246 TDCSONGTele2BusinessTDCSwedenSE false
98.82.181.184
 unknown United States
11351 TWC-11351-NORTHEASTUS false
49.234.125.3
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
205.106.233.196
 unknown United States
721 DNIC-ASBLK-00721-00726US false
52.240.43.146
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
126.106.52.157
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
44.43.74.46
 unknown United States
7377 UCSDUS false
114.99.102.224
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
51.142.97.153
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.0.97.79
 unknown Ukraine
42430 HOMELANSeverodonetskUkraineUA false
222.56.120.5
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
103.24.5.94
 unknown Singapore
17547 M1NET-SG-APM1NETLTDSG false
39.230.117.168
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
171.183.41.212
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
38.147.162.198
 unknown United States
138576 CODECCLOUD-AS-APCodecCloudHKLimitedHK false
109.102.68.21
 unknown Romania
9050 RTDBucharestRomaniaRO false
180.87.26.118
 unknown India
6453 AS6453US false
153.144.127.30
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
160.177.107.254
 unknown Morocco
36903 MT-MPLSMA false
179.58.66.113
 unknown Bolivia
28024 NuevatelPCSdeBoliviaSABO false
35.66.33.142
 unknown United States
237 MERIT-AS-14US false
199.211.52.137
 unknown United States
721 DNIC-ASBLK-00721-00726US false
12.78.130.92
 unknown United States
7018 ATT-INTERNET4US false
149.112.233.196
 unknown Reserved
188 SAIC-ASUS false
63.231.105.255
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
12.42.150.29
 unknown United States
7018 ATT-INTERNET4US false
131.235.181.221
 unknown Canada
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
76.219.176.165
 unknown United States
7018 ATT-INTERNET4US false
139.59.86.211
 unknown Singapore
14061 DIGITALOCEAN-ASNUS false
153.5.125.180
 unknown Slovenia
2107 ARNES-NETAcademicandResearchNetworkofSloveniaSI false
187.179.227.92
 unknown Mexico
6503 AxtelSABdeCVMX false
77.70.181.180
 unknown Norway
5377 MARLINK-EMEANO false
37.68.12.101
 unknown France
15557 LDCOMNETFR false
41.101.160.235
 unknown Algeria
36947 ALGTEL-ASDZ false
37.76.55.79
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
36.228.227.72
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
188.148.132.186
 unknown Norway
39651 COMHEM-SWEDENSE false
45.250.127.5
 unknown China
23860 ALLIANCE-GATEWAY-AS-APAllianceBroadbandServicesPvtLtd false
186.30.233.48
 unknown Colombia
19429 ETB-ColombiaCO false
133.209.85.87
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
194.181.95.26
 unknown Poland
8308 NASK-COMMERCIALPL false
62.253.52.103
 unknown United Kingdom
5089 NTLGB false
179.34.244.168
 unknown Brazil
26615 TIMSABR false
160.34.204.141
 unknown United States
7160 NETDYNAMICSUS false
172.255.87.79
 unknown United States
394380 LEASEWEB-USA-DAL-10US false
178.17.132.28
 unknown Russian Federation
42514 SIGNAL-ASZheleznogorskRussiaRU false
110.90.127.76
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
223.165.161.152
 unknown Korea Republic of
38661 HCLC-AS-KRpurplestonesKR false
12.105.103.43
 unknown United States
7018 ATT-INTERNET4US false
115.203.215.44
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
148.62.184.7
 unknown United States
33070 RMH-14US false
23.21.227.47
 unknown United States
14618 AMAZON-AESUS false
161.186.38.148
 unknown United States
852 ASN852CA false
197.254.132.164
 unknown Lesotho
37057 VODACOM-LESOTHOLS false
172.128.48.85
 unknown United States
7018 ATT-INTERNET4US false
167.123.35.239
 unknown Australia
19275 INTERVALUS false
164.179.11.244
 unknown United States
37717 EL-KhawarizmiTN false
141.228.89.110
 unknown United Kingdom
44022 BARCLAYS-RETAILGB false