Linux Analysis Report
mpsl.elf

Overview

General Information

Sample name: mpsl.elf
Analysis ID: 1417382
MD5: 9de40ef40b2d3bbc2836d2006b03e19e
SHA1: 204914b5fbb82e0daf70e1efa693b29c056a7104
SHA256: 5fdf25ec0d063d0bbea1ee5407d24d82a889a89a082cfe0977938ccae42b93ff
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Executes the "systemctl" command used for controlling the systemd system and service manager
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: mpsl.elf ReversingLabs: Detection: 62%
Source: mpsl.elf Virustotal: Detection: 63% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36716
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36724
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36736
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36750
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36776
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36788
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:51192 -> 67.217.60.78:7854
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 207.49.94.245:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 73.87.205.15:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.93.51.10:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 162.146.206.213:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 138.243.186.33:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 50.2.113.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 17.201.60.244:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.192.100.59:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 198.43.149.121:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 217.77.181.129:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 140.58.9.136:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 5.177.60.174:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 143.215.70.65:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 134.39.126.31:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.255.211.78:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 126.245.78.118:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 101.152.132.49:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.86.133.187:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 44.140.153.126:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 49.208.72.127:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 52.114.66.207:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 50.35.18.58:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 209.180.15.251:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 41.91.77.173:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 36.180.57.190:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 67.21.160.6:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 63.8.45.104:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 76.98.188.181:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 24.83.25.212:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 194.148.53.253:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 101.147.154.229:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 181.145.120.204:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 134.255.24.155:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 155.225.134.194:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.230.118.28:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 166.196.216.106:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.13.140.128:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 202.111.184.194:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.169.59.200:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 101.28.61.102:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 105.228.118.174:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 8.196.148.188:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 37.171.192.50:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 19.62.208.153:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 38.227.172.65:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 141.135.217.227:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 31.220.65.20:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 27.141.9.130:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 59.241.175.179:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 121.155.247.134:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 84.111.231.158:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.88.159.131:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 122.31.167.17:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 49.155.128.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.13.72.79:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 146.207.53.174:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 31.19.209.185:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 173.69.254.211:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 5.91.41.177:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 2.239.67.83:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 219.158.232.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 101.95.180.130:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 217.79.191.251:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 178.65.92.195:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 198.206.103.124:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 184.78.58.58:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 99.153.11.79:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 14.133.121.164:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 24.59.127.160:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.110.4.175:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 155.29.202.197:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 117.158.213.190:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 94.149.61.187:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 181.33.133.67:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 18.216.165.237:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 175.112.222.29:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 24.19.89.68:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 25.246.89.204:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 53.11.186.103:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 196.12.32.181:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 19.204.235.64:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 119.167.203.97:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 184.152.17.240:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 64.179.22.243:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 31.104.19.115:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 81.79.28.95:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 41.193.149.168:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 119.226.92.5:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 182.24.137.64:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 163.9.17.194:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 157.222.26.145:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 92.87.245.60:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 165.167.138.216:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 141.96.137.197:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 122.211.84.170:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 195.16.194.22:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.201.79.0:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.180.249.161:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 2.88.101.207:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 85.140.250.55:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 157.18.117.99:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 167.101.90.70:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 106.111.146.32:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 222.11.221.124:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.203.203.133:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 69.193.130.80:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 98.63.12.158:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 126.180.142.126:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 69.147.8.125:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 75.52.196.30:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 135.87.66.32:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 73.123.137.49:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 71.174.59.7:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 186.230.198.202:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 94.196.167.102:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 76.12.107.85:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 112.77.27.245:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 76.201.147.253:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 147.17.3.92:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 34.192.158.148:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 223.159.4.37:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 204.91.67.224:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 118.250.209.236:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 48.154.29.81:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 217.186.204.150:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 210.82.244.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 158.192.92.56:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 131.0.52.155:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 84.228.12.68:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 81.43.213.197:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 54.178.177.191:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 108.228.19.249:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 208.38.203.154:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 14.161.247.32:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 13.75.10.197:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 57.72.167.229:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 17.12.0.164:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 162.249.18.174:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 79.34.55.41:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 164.96.148.255:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 52.234.250.39:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 223.60.133.134:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 134.46.128.152:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 165.102.98.181:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 142.27.135.79:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 190.23.28.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 159.153.148.41:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 209.95.29.133:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 118.20.182.5:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 109.161.156.33:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 34.181.241.184:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 187.163.47.254:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 164.116.169.143:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 141.44.53.182:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 99.2.15.205:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 51.234.117.43:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 153.190.18.124:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 88.142.150.99:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 167.203.108.32:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.183.138.91:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 82.18.153.87:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 95.28.12.67:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 19.152.174.154:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 109.164.7.56:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 65.252.90.173:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 179.83.199.2:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 204.94.32.50:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 149.78.50.221:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 167.54.122.220:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 200.236.131.12:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 41.209.205.135:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 1.50.190.196:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 160.87.160.91:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 191.255.237.185:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 221.24.188.7:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 2.179.193.211:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 120.34.76.50:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 34.149.251.42:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 134.125.113.252:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 47.208.157.209:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 219.29.21.139:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.244.37.80:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 57.20.72.4:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 105.57.35.74:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 71.204.23.43:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 195.68.220.210:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 212.5.35.94:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 54.118.76.151:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 54.99.74.61:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 194.235.242.137:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 54.105.181.53:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 210.159.68.126:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 151.221.218.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 43.116.55.230:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 97.103.106.42:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 90.199.255.18:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.75.76.122:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 99.194.1.180:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 107.87.180.104:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 156.183.19.44:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 137.38.168.251:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 131.65.243.88:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 171.48.124.255:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 85.94.180.45:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 136.33.88.31:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 34.98.181.190:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 104.125.181.102:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 209.167.70.237:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 109.35.64.229:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 17.56.42.83:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 200.96.130.37:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 173.132.236.60:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 206.106.188.187:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 4.98.8.151:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 37.251.63.99:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 27.81.62.44:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 150.126.106.1:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 5.206.14.216:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 170.35.166.157:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.226.17.104:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 165.165.35.188:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 144.162.178.7:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 96.13.226.194:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 68.44.35.144:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 87.41.182.202:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 92.212.173.117:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 66.2.113.81:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 131.250.140.250:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 58.153.222.65:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 97.130.40.231:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 212.106.132.112:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 58.116.85.140:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 136.99.222.70:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 122.177.2.248:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 191.117.154.86:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.104.239.66:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 135.223.129.188:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 166.0.246.255:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 17.249.38.69:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.85.131.98:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 125.140.103.76:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 46.189.54.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 198.61.162.14:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 157.204.193.51:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 159.184.90.105:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 144.255.10.99:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 132.79.130.152:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 97.248.160.245:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 183.20.223.86:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 100.39.245.141:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 95.77.1.101:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 98.45.150.214:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 210.95.217.31:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 38.62.212.234:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 19.241.53.85:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.25.166.229:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 51.251.7.114:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 49.226.98.208:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 72.67.184.100:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 52.136.129.210:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 97.217.248.157:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 204.46.35.12:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 95.161.25.99:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 111.232.198.65:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 203.92.3.147:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 124.36.149.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 196.180.84.21:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 148.147.171.105:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.93.52.172:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 42.28.56.2:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 148.204.145.67:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 161.99.137.2:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 68.115.81.193:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 68.93.167.23:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 125.111.197.76:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 121.141.223.134:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 85.27.151.208:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 66.6.88.42:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 206.168.234.217:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 212.209.102.4:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 161.115.24.34:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 210.236.247.10:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 60.240.25.59:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 121.83.142.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 169.8.118.248:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 74.113.80.14:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 147.107.175.190:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 25.233.99.147:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 221.220.187.14:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 12.59.188.108:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 1.22.128.83:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 130.128.123.35:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.43.32.54:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 174.71.212.166:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 183.104.165.189:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 47.204.191.30:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 116.154.187.64:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 97.237.184.28:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 185.149.121.127:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 64.53.245.119:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 187.221.162.121:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 209.100.159.219:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 67.182.36.141:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 113.25.202.58:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 91.172.5.161:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 86.140.9.131:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 208.99.225.113:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 32.244.194.116:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 137.27.184.243:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 196.102.95.31:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 197.128.188.255:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 67.220.142.249:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 184.5.188.48:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 155.153.220.201:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 47.221.180.247:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 19.61.253.188:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 58.28.192.108:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 204.172.109.170:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 50.78.178.37:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 2.249.235.39:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 191.244.105.223:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 86.82.155.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 109.72.182.227:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 178.90.212.58:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.129.0.248:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 133.210.138.113:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 137.189.7.181:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 114.109.67.246:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 220.241.21.181:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 174.216.92.78:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 61.252.98.199:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 45.21.13.43:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 177.64.163.245:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 82.173.130.17:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 78.47.136.91:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 50.12.46.178:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 88.196.245.146:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 140.224.44.203:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 187.227.5.233:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 61.90.239.115:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 195.213.96.180:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 53.239.222.66:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 199.203.94.77:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 98.104.80.69:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 199.147.42.163:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 118.244.79.237:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 93.192.124.120:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 44.56.237.195:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 121.13.57.254:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 36.215.151.73:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 58.186.169.97:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 112.250.91.221:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 145.82.177.247:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.89.69.226:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 124.169.172.121:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 208.107.252.138:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 218.113.247.202:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 207.34.175.163:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.49.106.93:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 183.97.187.93:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 46.28.66.48:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 222.118.11.79:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 35.1.110.125:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 31.182.227.78:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 104.135.213.193:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 8.115.223.105:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.42.128.16:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 60.236.11.218:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 148.232.18.51:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 176.198.243.239:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 210.117.161.25:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 61.224.158.104:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 1.201.226.193:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 117.126.238.183:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 198.48.193.231:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 78.128.167.114:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 154.124.235.124:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 202.255.174.252:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 152.91.65.107:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 24.108.24.127:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 116.45.120.221:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 164.174.140.251:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 50.198.13.172:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 142.139.224.169:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 102.77.95.231:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 71.88.135.129:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 126.97.208.239:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 95.149.51.4:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 173.153.44.172:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 59.0.1.207:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 70.176.200.125:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 116.87.139.65:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 82.24.176.36:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 87.52.165.57:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 135.142.78.237:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 47.133.10.24:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 90.84.21.98:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 42.93.140.176:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 51.95.176.145:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 156.117.205.118:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 141.145.93.100:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 78.37.168.159:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 14.148.183.29:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 25.100.161.188:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 42.249.3.75:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 59.17.6.13:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 217.155.123.5:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 23.32.23.228:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 130.7.203.182:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 79.0.154.38:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 4.13.196.210:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 73.225.208.144:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 159.159.100.64:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 38.90.8.55:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 121.217.31.1:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 37.73.159.171:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 133.192.206.223:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 178.35.181.97:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 131.126.107.253:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 89.63.1.151:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 124.25.116.109:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 70.30.62.29:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 14.134.97.39:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 112.30.204.217:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 196.244.113.44:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 169.193.236.76:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 147.108.192.187:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 158.212.76.198:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 73.254.208.223:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 176.61.74.80:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 209.158.212.98:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 133.200.147.175:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 17.73.177.172:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 103.15.90.114:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 149.203.93.133:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 27.249.154.26:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 38.174.13.49:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 93.235.197.18:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.71.194.45:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.5.98.164:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 174.111.89.178:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 20.48.64.205:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 46.33.145.42:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 123.8.208.247:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 61.78.169.4:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 152.194.174.137:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 106.50.134.47:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 144.81.203.195:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 77.225.27.223:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 156.18.253.29:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 195.167.197.173:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 189.101.35.245:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 199.158.193.163:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 68.192.122.6:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 47.85.8.231:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 169.254.251.134:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 57.35.109.249:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 199.103.8.139:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 106.35.244.93:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 42.176.182.223:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 141.85.179.210:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 161.120.39.124:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 111.202.218.158:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 128.22.229.140:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 110.174.250.235:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 122.37.61.115:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 206.32.193.75:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 48.13.192.170:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 144.186.38.123:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 153.139.21.206:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 176.119.244.10:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 156.120.77.2:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 203.150.135.93:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 123.81.237.200:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 211.3.186.5:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 43.99.240.71:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 39.185.60.39:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 155.228.178.54:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 193.38.185.67:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 187.188.12.74:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 153.127.202.232:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 36.190.209.69:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 125.82.65.26:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 94.13.3.141:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 212.221.252.50:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 137.156.2.114:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 161.255.33.107:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 18.161.162.133:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 158.169.62.86:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 197.217.114.54:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 25.206.100.133:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 130.97.64.70:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 43.52.123.61:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 107.141.10.11:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 23.228.175.254:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 42.136.71.40:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 43.109.95.162:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 2.225.49.96:2323
Source: global traffic TCP traffic: 192.168.2.13:61119 -> 187.85.180.159:2323
Sample listens on a socket
Source: /tmp/mpsl.elf (PID: 5722) Socket: 192.168.2.13::10345 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 67.217.60.78
Source: unknown TCP traffic detected without corresponding DNS query: 207.49.94.245
Source: unknown TCP traffic detected without corresponding DNS query: 9.164.241.251
Source: unknown TCP traffic detected without corresponding DNS query: 184.39.106.80
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.87.53
Source: unknown TCP traffic detected without corresponding DNS query: 52.231.29.91
Source: unknown TCP traffic detected without corresponding DNS query: 99.48.41.206
Source: unknown TCP traffic detected without corresponding DNS query: 165.144.160.249
Source: unknown TCP traffic detected without corresponding DNS query: 40.227.235.228
Source: unknown TCP traffic detected without corresponding DNS query: 73.87.205.15
Source: unknown TCP traffic detected without corresponding DNS query: 13.206.109.129
Source: unknown TCP traffic detected without corresponding DNS query: 106.207.142.117
Source: unknown TCP traffic detected without corresponding DNS query: 54.208.230.109
Source: unknown TCP traffic detected without corresponding DNS query: 145.81.16.221
Source: unknown TCP traffic detected without corresponding DNS query: 148.226.248.155
Source: unknown TCP traffic detected without corresponding DNS query: 42.95.26.106
Source: unknown TCP traffic detected without corresponding DNS query: 156.155.146.77
Source: unknown TCP traffic detected without corresponding DNS query: 211.27.165.44
Source: unknown TCP traffic detected without corresponding DNS query: 195.236.227.42
Source: unknown TCP traffic detected without corresponding DNS query: 107.188.79.213
Source: unknown TCP traffic detected without corresponding DNS query: 162.80.0.132
Source: unknown TCP traffic detected without corresponding DNS query: 213.40.175.164
Source: unknown TCP traffic detected without corresponding DNS query: 128.93.51.10
Source: unknown TCP traffic detected without corresponding DNS query: 155.112.158.201
Source: unknown TCP traffic detected without corresponding DNS query: 68.248.100.239
Source: unknown TCP traffic detected without corresponding DNS query: 188.88.108.71
Source: unknown TCP traffic detected without corresponding DNS query: 68.207.206.145
Source: unknown TCP traffic detected without corresponding DNS query: 162.146.206.213
Source: unknown TCP traffic detected without corresponding DNS query: 171.230.183.16
Source: unknown TCP traffic detected without corresponding DNS query: 133.59.75.223
Source: unknown TCP traffic detected without corresponding DNS query: 97.99.206.243
Source: unknown TCP traffic detected without corresponding DNS query: 14.106.80.20
Source: unknown TCP traffic detected without corresponding DNS query: 2.93.159.209
Source: unknown TCP traffic detected without corresponding DNS query: 38.104.238.54
Source: unknown TCP traffic detected without corresponding DNS query: 48.151.218.65
Source: unknown TCP traffic detected without corresponding DNS query: 156.233.202.166
Source: unknown TCP traffic detected without corresponding DNS query: 216.144.160.180
Source: unknown TCP traffic detected without corresponding DNS query: 183.201.228.108
Source: unknown TCP traffic detected without corresponding DNS query: 12.156.226.146
Source: unknown TCP traffic detected without corresponding DNS query: 138.243.186.33
Source: unknown TCP traffic detected without corresponding DNS query: 54.236.109.198
Source: unknown TCP traffic detected without corresponding DNS query: 50.236.220.143
Source: unknown TCP traffic detected without corresponding DNS query: 20.239.204.223
Source: unknown TCP traffic detected without corresponding DNS query: 68.99.192.41
Source: unknown TCP traffic detected without corresponding DNS query: 102.215.150.217
Source: unknown TCP traffic detected without corresponding DNS query: 119.42.1.228
Source: unknown TCP traffic detected without corresponding DNS query: 47.120.80.61
Source: unknown TCP traffic detected without corresponding DNS query: 162.76.215.60
Source: unknown TCP traffic detected without corresponding DNS query: 144.221.157.36
Source: unknown TCP traffic detected without corresponding DNS query: 147.37.36.118

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: mpsl.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5722.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5731.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mpsl.elf PID: 5722, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mpsl.elf PID: 5731, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: mpsl.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5722.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5731.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mpsl.elf PID: 5722, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mpsl.elf PID: 5731, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal76.troj.linELF@0/0@0/0
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /usr/lib/snapd/snap-failure (PID: 5776) Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socket Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36716
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36724
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36732
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36736
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36750
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36776
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36788
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/mpsl.elf (PID: 5722) Queries kernel information via 'uname': Jump to behavior
Source: mpsl.elf, 5722.1.000055be67eff000.000055be67faa000.rw-.sdmp, mpsl.elf, 5731.1.000055be67eff000.000055be67faa000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5722.1.00007ffc6aa29000.00007ffc6aa4a000.rw-.sdmp, mpsl.elf, 5731.1.00007ffc6aa29000.00007ffc6aa4a000.rw-.sdmp Binary or memory string: vx86_64/usr/bin/qemu-mipsel/tmp/mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mpsl.elf
Source: mpsl.elf, 5722.1.000055be67eff000.000055be67faa000.rw-.sdmp, mpsl.elf, 5731.1.000055be67eff000.000055be67faa000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5722.1.00007ffc6aa29000.00007ffc6aa4a000.rw-.sdmp, mpsl.elf, 5731.1.00007ffc6aa29000.00007ffc6aa4a000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: mpsl.elf, type: SAMPLE
Source: Yara match File source: 5722.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5731.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: mpsl.elf, type: SAMPLE
Source: Yara match File source: 5722.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5731.1.00007fec38400000.00007fec38411000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
96.119.69.54
 unknown United States
7922 COMCAST-7922US false
154.220.241.213
 unknown Seychelles
138392 CTC-HKColleaguesTechnologyCOLIMITEDHK false
108.40.59.196
 unknown United States
701 UUNETUS false
150.83.134.236
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
68.232.173.102
 unknown United States
20473 AS-CHOOPAUS false
163.105.78.213
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
45.104.124.61
 unknown Egypt
37069 MOBINILEG false
145.96.8.195
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
79.42.6.203
 unknown Italy
3269 ASN-IBSNAZIT false
164.110.237.196
 unknown United States
14827 WSDOT-ASNUS false
62.222.197.196
 unknown Ireland
8918 CARRIER1-ASIE false
59.115.141.30
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
207.80.210.3
 unknown United States
3354 THENET-AS-3354US false
218.170.175.230
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
102.6.17.201
 unknown unknown
36926 CKL1-ASNKE false
149.246.76.207
 unknown Germany
38943 KNORR-BREMSEDE false
31.186.168.32
 unknown Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL false
133.76.4.130
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
139.104.35.159
 unknown United States
3246 TDCSONGTele2BusinessTDCSwedenSE false
123.38.176.78
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
53.113.156.211
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
151.60.181.241
 unknown Italy
1267 ASN-WINDTREIUNETEU false
116.91.187.7
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
196.165.241.73
 unknown South Africa
328065 Vast-Networks-ASZA false
45.48.145.97
 unknown United States
20001 TWC-20001-PACWESTUS false
24.120.45.65
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
17.51.65.115
 unknown United States
714 APPLE-ENGINEERINGUS false
89.59.33.140
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
146.162.25.36
 unknown United Kingdom
9605 DOCOMONTTDOCOMOINCJP false
128.30.226.180
 unknown United States
3 MIT-GATEWAYSUS false
53.15.201.107
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
123.143.47.81
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
209.101.91.233
 unknown United States
4565 MEGAPATH2-US false
13.148.191.128
 unknown United States
7018 ATT-INTERNET4US false
209.101.91.234
 unknown United States
4565 MEGAPATH2-US false
167.210.19.133
 unknown United States
2897 GEORGIA-1US false
82.196.70.63
 unknown Russian Federation
20632 PETERSTAR-ASSaint-PetersburgRU false
93.22.145.148
 unknown France
15557 LDCOMNETFR false
160.62.95.149
 unknown Switzerland
25031 NOVARTIS-CH false
126.127.57.76
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
121.227.65.136
 unknown China
23650 CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba false
67.226.115.244
 unknown United States
25977 HCCSUS false
188.233.56.60
 unknown Russian Federation
39435 EVOLGOGRAD-ASRU false
69.98.16.21
 unknown United States
4261 BLUEGRASSNETUS false
8.159.197.140
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
158.176.92.90
 unknown United States
36351 SOFTLAYERUS false
170.219.209.177
 unknown United States
8103 STATE-OF-FLAUS false
195.213.98.40
 unknown Belgium
6871 PLUSNETUKInternetServiceProviderGB false
183.243.48.27
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
20.210.161.80
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
106.216.237.188
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
24.46.33.9
 unknown United States
6128 CABLE-NET-1US false
19.127.182.232
 unknown United States
3 MIT-GATEWAYSUS false
64.155.48.189
 unknown United States
3356 LEVEL3US false
184.115.196.103
 unknown United States
7922 COMCAST-7922US false
150.88.26.55
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
27.118.232.75
 unknown Korea Republic of
17877 NEXG-AS-KRNexGCoLTDKR false
5.228.51.255
 unknown Russian Federation
42610 NCNET-ASRU false
126.115.62.77
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
113.191.88.25
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
50.125.193.223
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
198.15.97.137
 unknown United States
20454 SSASN2US false
217.76.147.36
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE false
193.85.171.45
 unknown Czech Republic
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
94.68.67.104
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
8.17.39.246
 unknown United States
26967 DCSL-6-26967US false
109.171.7.39
 unknown Russian Federation
15774 TTK-RTLRetailRU false
134.254.252.204
 unknown United States
3562 SNLL-NET-ASUS false
111.80.81.106
 unknown Taiwan; Republic of China (ROC)
2510 INFOWEBFUJITSULIMITEDJP false
132.50.21.9
 unknown United States
385 AFCONC-BLOCK1-ASUS false
103.239.59.52
 unknown India
133320 INFOLAB-ASAlphaInfolabPrivatelimitedIN false
61.41.202.126
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
177.162.157.213
 unknown Brazil
26599 TELEFONICABRASILSABR false
188.137.159.48
 unknown Bahrain
35313 BH-INFONAS-ASNBH false
174.216.92.78
 unknown United States
22394 CELLCOUS false
163.146.167.206
 unknown Japan 17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
73.72.154.181
 unknown United States
7922 COMCAST-7922US false
132.250.112.127
 unknown United States
48 DNIC-AS-00048US false
197.9.222.7
 unknown Tunisia
5438 ATI-TN false
181.218.179.192
 unknown Brazil
21826 CorporacionTelemicCAVE false
194.174.201.206
 unknown Germany
702 UUNETUS false
158.86.240.78
 unknown United States
20379 NET-BAKERUS false
177.247.228.165
 unknown Mexico
13999 MegaCableSAdeCVMX false
87.142.8.66
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
219.213.77.88
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
67.120.77.65
 unknown United States
7018 ATT-INTERNET4US false
45.159.66.193
 unknown Italy
60917 TEDRATEDRABACKBONEES false
4.75.230.136
 unknown United States
3356 LEVEL3US false
78.14.179.145
 unknown Italy
8612 TISCALI-IT false
193.249.87.121
 unknown France
3215 FranceTelecom-OrangeFR false
163.160.157.61
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
182.85.189.61
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
1.168.10.101
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
188.233.56.42
 unknown Russian Federation
39435 EVOLGOGRAD-ASRU false
161.52.129.177
 unknown Sweden
43922 MALMOSE false
2.149.150.13
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
99.181.169.213
 unknown United States
7018 ATT-INTERNET4US false
147.250.155.54
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
44.182.95.232
 unknown United States
58247 NETVEILLANCERO false
88.75.6.108
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false