Linux Analysis Report
arm.elf

Overview

General Information

Sample name: arm.elf
Analysis ID: 1417383
MD5: f97d189a62b676492e6701b36c6a36c9
SHA1: b89e5d8e4a3f4c5a9a69398a2895da002f9024b6
SHA256: 7e2e0930d1712b55709c89ecaa253832e68a359073603c6d4a541f7089f1001a
Infos:

Detection

Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: arm.elf ReversingLabs: Detection: 64%
Source: arm.elf Virustotal: Detection: 61% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2023449 ET TROJAN Possible Linux.Mirai Login Attempt (vizxv) 192.168.2.14:51214 -> 85.95.102.188:23
Source: Traffic Snort IDS: 2023449 ET TROJAN Possible Linux.Mirai Login Attempt (vizxv) 192.168.2.14:51500 -> 85.95.102.188:23
Source: Traffic Snort IDS: 2023449 ET TROJAN Possible Linux.Mirai Login Attempt (vizxv) 192.168.2.14:38298 -> 196.13.223.241:23
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:48390 -> 67.217.60.78:7854
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 9.94.109.85:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 223.94.164.228:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 162.192.68.164:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 25.152.17.113:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 112.221.155.56:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 35.51.51.60:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 216.108.112.7:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 174.59.32.183:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 54.18.81.141:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 60.109.172.190:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 167.234.3.178:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 121.242.137.228:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 213.93.252.244:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 38.111.55.61:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 198.76.212.0:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 108.180.164.198:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 27.186.71.136:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 44.90.154.227:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 81.131.110.108:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 90.172.140.135:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 144.241.188.162:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 32.124.142.233:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 40.184.193.159:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 62.209.166.231:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 183.22.213.0:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 35.70.31.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 117.12.121.96:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 115.228.56.76:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 223.22.254.160:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 91.148.38.144:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 95.70.73.95:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 181.213.155.248:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 202.53.255.157:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 107.79.62.247:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 181.83.45.10:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 25.202.223.129:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 61.184.183.66:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 86.247.136.163:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 93.46.199.112:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 222.131.7.148:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.158.2.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 155.237.214.42:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 25.227.109.116:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 70.74.251.9:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 106.198.34.159:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 137.178.205.99:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 154.90.166.241:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 43.233.219.240:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 210.251.5.106:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.112.223.210:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 107.91.50.234:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 144.23.83.209:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 223.221.193.47:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 94.208.6.169:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 74.127.31.178:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 115.172.123.231:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.181.13.62:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 170.99.87.235:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 194.107.213.253:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 60.216.77.120:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 190.89.124.188:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 161.209.59.236:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 4.137.29.204:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 143.142.95.253:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 169.104.53.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 182.122.7.50:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.84.52.147:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 2.51.205.161:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 204.64.139.223:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 197.175.177.154:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 204.210.20.130:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 110.75.150.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 147.22.190.170:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 142.248.38.102:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 32.225.44.37:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 71.117.109.195:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 177.153.114.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 181.100.98.24:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 116.51.85.26:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 59.109.173.83:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 88.2.13.31:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 207.168.77.204:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 202.142.126.122:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 203.142.53.180:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 196.193.218.209:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.167.201.200:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 119.65.115.21:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 41.237.165.233:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 124.11.7.118:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 133.19.13.58:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 142.20.69.69:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 81.207.20.90:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 42.212.104.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 216.198.72.67:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 53.192.251.165:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 122.244.137.53:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 145.43.104.247:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 113.155.239.50:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 41.34.182.5:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 203.109.46.180:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 74.152.21.33:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 53.174.142.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 77.7.251.140:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 130.120.241.207:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 74.50.81.186:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 209.80.32.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 93.154.78.75:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 92.173.167.210:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 191.205.226.23:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 51.152.71.248:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 218.152.111.232:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 207.12.202.3:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 147.10.101.195:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 37.85.155.203:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 153.229.145.65:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 42.174.100.224:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 105.32.194.20:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 213.67.7.166:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 221.145.41.4:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 43.55.220.230:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 140.247.224.51:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 198.32.142.177:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 45.185.124.162:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 134.84.62.51:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 199.220.68.139:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 138.76.242.102:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.123.73.56:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 13.204.36.195:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 203.88.44.250:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 150.172.124.241:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 1.184.135.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 183.33.151.243:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 150.112.113.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 8.237.148.155:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 52.252.40.64:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 53.191.151.142:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.23.162.152:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 216.198.38.156:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 32.230.147.209:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 164.98.253.55:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 23.242.242.187:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 37.80.69.134:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 45.32.120.87:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 179.143.16.203:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 5.116.242.176:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 98.79.162.21:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 81.252.14.127:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 222.149.118.170:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 72.200.254.189:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 107.7.83.105:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 179.162.159.228:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 220.32.173.93:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 18.165.138.164:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 156.128.185.181:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 108.28.19.173:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 97.31.104.96:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.130.97.255:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 175.150.183.181:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 138.206.197.62:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 157.216.182.70:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 71.80.125.181:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 115.103.196.167:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 158.211.81.95:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 176.46.222.159:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 220.101.239.145:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 14.25.203.252:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 199.28.189.152:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 164.151.35.71:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 12.166.255.183:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 97.148.230.138:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 86.204.195.92:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 101.163.93.198:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 168.219.50.209:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 111.226.28.179:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 36.245.125.59:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 42.8.189.114:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 217.15.143.60:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 189.180.201.38:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 104.250.216.106:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 88.221.199.57:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 146.100.179.251:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 119.201.4.99:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 141.254.185.240:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 123.60.45.96:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 122.229.163.115:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 45.176.87.49:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 85.120.8.198:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 68.6.182.29:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 143.13.84.83:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 98.7.95.59:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 4.226.156.177:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 45.96.106.113:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 92.198.220.138:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 70.57.218.100:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 24.188.65.139:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 45.84.215.38:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 180.211.12.53:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 20.229.113.64:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 156.155.71.104:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 176.0.90.242:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 169.216.242.109:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 112.149.94.210:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 98.153.239.26:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 195.60.112.116:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 119.57.218.135:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.242.93.110:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 120.109.61.143:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 133.126.214.98:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 70.136.8.228:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 46.12.175.74:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 20.113.180.184:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 121.25.106.13:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 162.165.251.31:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 124.129.119.29:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.210.15.27:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 137.18.80.236:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 144.163.27.134:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 9.27.209.32:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 135.73.174.86:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 27.36.52.87:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 200.65.22.55:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 24.21.79.147:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 118.87.3.2:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 82.210.31.85:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 104.168.207.132:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 90.202.24.164:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 117.193.244.5:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 174.165.89.143:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 120.27.13.186:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 169.234.118.2:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 131.152.100.62:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 198.135.208.216:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 164.247.172.108:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 118.192.128.84:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 96.160.114.230:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 77.183.189.18:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 195.9.43.35:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 79.24.35.212:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 177.113.171.120:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 169.5.142.136:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 134.213.130.168:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 149.48.80.0:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 58.118.20.12:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 185.9.174.202:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 200.166.228.175:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 195.197.202.19:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 58.173.57.24:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 193.210.226.69:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 164.1.55.92:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 32.84.160.126:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 38.108.182.15:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 1.158.174.165:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 8.196.32.14:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 35.34.208.117:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 101.246.168.24:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 41.215.246.249:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 69.121.98.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 120.111.80.54:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 94.212.3.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 116.193.239.76:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 189.79.153.0:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 79.10.85.179:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 217.97.93.109:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 41.173.223.208:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 210.197.194.44:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 80.211.70.96:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 174.54.231.77:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 90.220.57.48:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 216.40.147.244:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.145.44.126:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 205.176.155.234:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.147.196.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 129.19.249.160:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 110.150.14.225:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 62.110.242.199:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 155.148.175.248:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 206.133.55.155:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 52.29.59.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 39.72.42.76:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 195.49.70.140:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 135.24.239.201:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 76.243.250.130:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 162.53.210.179:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 153.22.189.200:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 110.146.253.95:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 77.64.147.249:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 43.219.105.153:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 78.100.5.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 59.191.197.39:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 201.28.250.137:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 198.106.107.38:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 131.231.98.96:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 31.72.242.38:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 106.250.169.92:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 43.190.120.50:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 193.97.14.221:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 202.24.94.49:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 203.223.239.209:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 221.164.200.94:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 79.122.61.194:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 156.234.45.19:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 219.199.48.85:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.50.84.170:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 207.59.68.66:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 38.4.20.77:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 5.86.68.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 140.226.246.21:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 151.100.118.221:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 35.183.115.50:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 123.47.36.146:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.126.118.20:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 164.209.248.99:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 4.115.149.104:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 177.36.198.234:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 115.13.159.66:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 176.221.35.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 154.44.53.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 145.245.82.192:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 142.111.156.168:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 48.123.114.44:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 203.107.32.150:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 98.45.73.51:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 47.122.195.215:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 25.18.127.227:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 137.237.134.27:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 166.207.226.217:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 177.252.130.92:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 136.167.143.67:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 222.89.107.111:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 38.175.84.84:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 90.112.204.255:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 61.4.166.206:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 66.51.80.94:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 108.217.19.207:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 143.142.60.228:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 183.211.130.56:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 20.214.174.121:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.189.67.44:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 156.65.114.61:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 85.28.150.182:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 169.117.6.2:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.243.163.149:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 19.8.217.93:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 9.178.184.244:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 190.13.224.227:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 25.145.14.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 73.56.61.252:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 77.230.7.104:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 31.191.144.25:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 46.231.160.129:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 129.235.195.171:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 37.132.45.251:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 81.145.186.176:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 35.249.247.41:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 173.38.49.22:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 59.153.0.121:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.115.128.24:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.134.170.35:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.209.55.177:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 97.8.25.45:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.83.155.251:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 170.242.87.196:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 85.173.250.160:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 84.78.234.208:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 111.89.114.250:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 220.7.19.76:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 4.96.110.175:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 186.226.168.194:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 100.237.214.120:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 133.215.210.237:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 171.86.235.157:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 101.77.161.219:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 125.175.201.114:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 176.60.170.192:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 183.72.203.210:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 205.20.145.72:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 199.18.121.243:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 64.188.35.120:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 94.34.183.135:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 167.228.24.133:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 103.87.115.63:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 159.236.39.29:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 163.110.53.202:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 163.225.5.155:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 201.75.156.3:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 144.148.81.214:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 131.11.134.211:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 160.60.190.25:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 194.218.109.32:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 147.16.65.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 97.68.206.7:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 113.219.157.98:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 206.55.104.187:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 207.21.202.120:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.236.2.32:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 155.92.247.61:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 183.205.127.104:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 112.38.76.197:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 218.254.198.230:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 132.51.23.50:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 167.220.145.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 185.216.247.79:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 205.212.182.80:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 213.82.147.243:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 58.52.74.3:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 221.147.169.195:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 135.135.215.124:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 67.141.194.46:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 176.100.127.89:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.140.190.88:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 51.67.6.127:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 204.118.73.1:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.70.93.28:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 83.207.239.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 64.237.175.166:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.164.41.13:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 138.111.209.211:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 194.135.41.10:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 218.130.25.126:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 145.45.98.178:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 193.58.16.173:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 105.27.158.129:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 100.146.71.191:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 44.195.183.248:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 92.240.171.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 12.115.52.163:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 79.220.164.39:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.122.220.141:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 88.52.103.240:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 94.106.125.107:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 75.231.239.37:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 18.129.165.8:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 14.132.43.223:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 85.129.80.249:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 1.177.181.79:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 168.58.253.212:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 168.50.117.193:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 36.62.224.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 1.125.164.89:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 68.112.211.29:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 17.89.168.182:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 223.61.158.171:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 139.147.65.173:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 62.10.224.212:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 49.101.30.229:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 116.46.117.86:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 211.197.147.236:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 210.178.173.160:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 43.168.165.159:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 165.174.165.41:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 54.31.250.136:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 65.78.94.70:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 18.216.81.54:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 116.29.114.219:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 99.40.103.179:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 63.154.128.255:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 9.118.120.48:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 53.59.70.167:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 124.246.18.155:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 82.228.132.189:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 117.127.48.131:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 124.19.126.157:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 88.197.95.214:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 173.31.86.150:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 27.13.222.75:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 27.28.228.141:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 24.2.224.53:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 209.21.76.91:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 36.201.63.10:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 75.44.90.180:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 119.210.91.200:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 160.17.177.170:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 9.79.225.108:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 168.52.59.109:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 59.55.149.54:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 73.173.240.143:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 4.81.33.37:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 120.100.119.47:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 126.172.185.235:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 209.213.45.204:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 153.100.18.78:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 61.234.139.132:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 170.204.203.15:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 133.44.100.221:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 141.133.217.203:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 67.181.12.189:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.190.166.160:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 20.222.217.32:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 146.75.114.136:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 208.91.242.193:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 134.76.252.173:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 168.104.43.224:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 174.62.181.43:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 196.23.60.22:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 144.207.170.53:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 96.118.230.34:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 119.99.124.20:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 66.163.141.237:2323
Source: global traffic TCP traffic: 192.168.2.14:10656 -> 178.122.208.20:2323
Sample listens on a socket
Source: /tmp/arm.elf (PID: 5572) Socket: 192.168.2.14::10345 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 67.217.60.78
Source: unknown TCP traffic detected without corresponding DNS query: 9.94.109.85
Source: unknown TCP traffic detected without corresponding DNS query: 142.170.185.84
Source: unknown TCP traffic detected without corresponding DNS query: 139.143.14.97
Source: unknown TCP traffic detected without corresponding DNS query: 216.9.221.107
Source: unknown TCP traffic detected without corresponding DNS query: 129.117.128.70
Source: unknown TCP traffic detected without corresponding DNS query: 86.67.57.52
Source: unknown TCP traffic detected without corresponding DNS query: 48.248.159.64
Source: unknown TCP traffic detected without corresponding DNS query: 76.155.253.59
Source: unknown TCP traffic detected without corresponding DNS query: 139.161.219.104
Source: unknown TCP traffic detected without corresponding DNS query: 84.211.142.110
Source: unknown TCP traffic detected without corresponding DNS query: 223.94.164.228
Source: unknown TCP traffic detected without corresponding DNS query: 172.232.42.119
Source: unknown TCP traffic detected without corresponding DNS query: 12.139.249.27
Source: unknown TCP traffic detected without corresponding DNS query: 181.44.42.52
Source: unknown TCP traffic detected without corresponding DNS query: 218.157.92.221
Source: unknown TCP traffic detected without corresponding DNS query: 161.66.22.212
Source: unknown TCP traffic detected without corresponding DNS query: 19.56.173.238
Source: unknown TCP traffic detected without corresponding DNS query: 42.233.177.255
Source: unknown TCP traffic detected without corresponding DNS query: 149.139.135.6
Source: unknown TCP traffic detected without corresponding DNS query: 162.192.68.164
Source: unknown TCP traffic detected without corresponding DNS query: 186.97.153.232
Source: unknown TCP traffic detected without corresponding DNS query: 189.116.241.19
Source: unknown TCP traffic detected without corresponding DNS query: 134.30.125.117
Source: unknown TCP traffic detected without corresponding DNS query: 208.132.224.47
Source: unknown TCP traffic detected without corresponding DNS query: 90.33.41.143
Source: unknown TCP traffic detected without corresponding DNS query: 49.103.28.209
Source: unknown TCP traffic detected without corresponding DNS query: 75.23.197.27
Source: unknown TCP traffic detected without corresponding DNS query: 18.55.136.234
Source: unknown TCP traffic detected without corresponding DNS query: 87.190.6.175
Source: unknown TCP traffic detected without corresponding DNS query: 190.0.30.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.104.27.100
Source: unknown TCP traffic detected without corresponding DNS query: 191.54.91.252
Source: unknown TCP traffic detected without corresponding DNS query: 25.152.17.113
Source: unknown TCP traffic detected without corresponding DNS query: 99.112.220.46
Source: unknown TCP traffic detected without corresponding DNS query: 93.238.216.193
Source: unknown TCP traffic detected without corresponding DNS query: 45.181.247.176
Source: unknown TCP traffic detected without corresponding DNS query: 25.161.253.82
Source: unknown TCP traffic detected without corresponding DNS query: 112.221.155.56
Source: unknown TCP traffic detected without corresponding DNS query: 169.234.195.89
Source: unknown TCP traffic detected without corresponding DNS query: 133.246.51.157
Source: unknown TCP traffic detected without corresponding DNS query: 59.230.30.157
Source: unknown TCP traffic detected without corresponding DNS query: 45.159.156.113
Source: unknown TCP traffic detected without corresponding DNS query: 61.107.163.222
Source: unknown TCP traffic detected without corresponding DNS query: 85.106.207.25
Source: unknown TCP traffic detected without corresponding DNS query: 221.66.99.141
Source: unknown TCP traffic detected without corresponding DNS query: 164.172.85.21
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.141.158
Source: unknown TCP traffic detected without corresponding DNS query: 35.51.51.60
Source: unknown TCP traffic detected without corresponding DNS query: 18.119.217.202

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5580.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5572.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm.elf PID: 5572, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm.elf PID: 5580, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: arm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5580.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5572.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 5572, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm.elf PID: 5580, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.elf (PID: 5572) Queries kernel information via 'uname': Jump to behavior
Source: arm.elf, 5572.1.000055cfe1fcf000.000055cfe2125000.rw-.sdmp, arm.elf, 5580.1.000055cfe1fcf000.000055cfe2125000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm.elf, 5572.1.00007fff24ac6000.00007fff24ae7000.rw-.sdmp, arm.elf, 5580.1.00007fff24ac6000.00007fff24ae7000.rw-.sdmp Binary or memory string: ,x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 5572.1.000055cfe1fcf000.000055cfe2125000.rw-.sdmp, arm.elf, 5580.1.000055cfe1fcf000.000055cfe2125000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 5572.1.00007fff24ac6000.00007fff24ae7000.rw-.sdmp, arm.elf, 5580.1.00007fff24ac6000.00007fff24ae7000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 5580.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5572.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: arm.elf, type: SAMPLE
Source: Yara match File source: 5580.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5572.1.00007f7770017000.00007f7770025000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
101.20.53.8
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
120.56.184.10
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
107.128.100.25
 unknown United States
7018 ATT-INTERNET4US false
169.15.171.115
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
156.207.10.192
 unknown Egypt
8452 TE-ASTE-ASEG false
74.255.184.104
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
221.60.33.213
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
122.4.146.46
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
89.67.99.85
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
57.62.52.31
 unknown Belgium
2686 ATGS-MMD-ASUS false
99.2.51.122
 unknown United States
7018 ATT-INTERNET4US false
129.251.163.86
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
222.182.181.175
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
193.31.36.69
 unknown Spain
200738 INTERFIBRA-ASES false
141.245.25.129
 unknown United Kingdom
1117 BOKUUniversitaetfuerBodenkulturWienEU false
66.86.96.232
 unknown United States
4283 CENTURYLINK-TSDS-LSVGUS false
83.181.59.254
 unknown Sweden
1257 TELE2EU false
196.197.164.102
 unknown Seychelles
37518 FIBERGRIDSC false
98.23.53.167
 unknown United States
7029 WINDSTREAMUS false
74.167.235.120
 unknown United States
7018 ATT-INTERNET4US false
147.100.61.68
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
67.132.97.50
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
83.45.76.123
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
44.123.224.246
 unknown United States
7377 UCSDUS false
208.176.67.1
 unknown United States
2828 XO-AS15US false
180.149.122.2
 unknown Mongolia
45204 GEMNET-MNGEMNETLLCMN false
97.91.221.106
 unknown United States
20115 CHARTER-20115US false
120.38.28.206
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.251.164.46
 unknown United States
3 MIT-GATEWAYSUS false
206.192.60.204
 unknown United States
3356 LEVEL3US false
8.97.199.216
 unknown United States
3356 LEVEL3US false
17.39.231.107
 unknown United States
714 APPLE-ENGINEERINGUS false
200.36.215.247
 unknown Mexico
10847 PodernetSAdeCVMX false
24.181.154.89
 unknown United States
20115 CHARTER-20115US false
24.109.19.133
 unknown Canada
6327 SHAWCA false
78.153.176.90
 unknown Denmark
28717 ZENSYSTEMS-ASDK false
138.64.16.149
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
113.174.188.229
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
17.187.31.173
 unknown United States
714 APPLE-ENGINEERINGUS false
199.241.230.22
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
35.212.201.21
 unknown United States
19527 GOOGLE-2US false
191.228.127.22
 unknown Brazil
26615 TIMSABR false
38.46.59.85
 unknown United States
174 COGENT-174US false
201.242.22.66
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
112.120.216.144
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
222.33.117.142
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
188.74.214.83
 unknown Romania
208068 AGO-ASNRO false
222.66.152.70
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
35.142.46.240
 unknown United States
33363 BHN-33363US false
9.70.108.133
 unknown United States
3356 LEVEL3US false
98.227.120.14
 unknown United States
7922 COMCAST-7922US false
125.19.44.30
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
67.51.9.90
 unknown United States
7385 ALLSTREAMUS false
164.98.253.55
 unknown Chile
14235 STATE-NM-US false
97.231.152.185
 unknown United States
6167 CELLCO-PARTUS false
108.27.194.59
 unknown United States
701 UUNETUS false
169.164.65.84
 unknown United States
37611 AfrihostZA false
77.60.19.68
 unknown Netherlands
1136 KPNKPNNationalEU false
60.31.115.219
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
223.27.89.39
 unknown Bangladesh
38071 AFTABIT-BD-AS-APAftabITLimitedBD false
122.127.241.33
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
74.214.32.112
 unknown United States
36790 BERWICKUS false
97.138.129.212
 unknown United States
6167 CELLCO-PARTUS false
84.189.216.102
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
36.14.189.0
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
112.125.47.139
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
216.11.121.52
 unknown United States
14241 ONE-ASUS false
99.192.78.209
 unknown Canada
855 CANET-ASN-4CA false
115.80.121.30
 unknown Taiwan; Republic of China (ROC)
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
124.125.212.181
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
101.91.135.103
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
185.216.48.170
 unknown Russian Federation
9009 M247GB false
148.70.47.131
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
69.124.145.78
 unknown United States
6128 CABLE-NET-1US false
133.74.59.92
 unknown Japan 3488 JAXANETInformationSystemsDepartmentJapanAerospaceExpl false
71.52.219.64
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
105.20.188.2
 unknown Mauritius
37100 SEACOM-ASMU false
147.3.92.98
 unknown United States
10753 LVLT-10753US false
134.89.165.181
 unknown United States
14706 MBARI-MAINUS false
112.155.167.22
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
213.140.222.3
 unknown Cyprus
35432 CABLENET-ASCY false
131.109.72.102
 unknown United States
14464 RINETUS false
62.89.133.222
 unknown United Kingdom
8419 HOTCHILLIGB false
60.141.104.245
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
156.110.22.164
 unknown United States
5078 ONENET-AS-1US false
189.72.69.249
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
202.15.194.231
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
102.59.105.245
 unknown Egypt
36992 ETISALAT-MISREG false
85.57.45.43
 unknown Spain
12479 UNI2-ASES false
217.31.52.68
 unknown Czech Republic
29134 IGNUM-ASCzechRepublicCZ false
41.11.66.91
 unknown South Africa
29975 VODACOM-ZA false
54.86.71.115
 unknown United States
14618 AMAZON-AESUS false
100.50.24.96
 unknown United States
701 UUNETUS false
140.245.130.147
 unknown United States
22488 CENGAGE-NYALBUS false
200.38.31.27
 unknown Mexico
6332 TelefonosdelNoroesteSAdeCVMX false
108.41.159.22
 unknown United States
701 UUNETUS false
9.223.206.197
 unknown United States
3356 LEVEL3US false
181.86.228.152
 unknown Argentina
7303 TelecomArgentinaSAAR false
125.233.212.211
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
117.33.127.23
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false