Linux Analysis Report
hiqWVuoNwf.elf

Overview

General Information

Sample name: hiqWVuoNwf.elf
renamed because original name is a hash value
Original sample name: 6b2a75284f0e5037b4aafdbe5dd7ffa2.elf
Analysis ID: 1426695
MD5: 6b2a75284f0e5037b4aafdbe5dd7ffa2
SHA1: 1d04fb8942c7865d6900cc381c8f78de36603823
SHA256: 7fc383af55f3a49e3de49a47268ce877de50f9074e9432d53788e55fbba98bb3
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: hiqWVuoNwf.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: hiqWVuoNwf.elf Virustotal: Detection: 64% Perma Link
Source: hiqWVuoNwf.elf ReversingLabs: Detection: 56%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:47838 -> 58.240.44.2:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:37432 -> 179.36.214.245:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.23:45460 -> 118.69.187.186:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:42116 -> 124.11.125.64:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51642
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51646
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51666
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51674
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51678
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51702
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51688
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51748
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45414
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45414
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45418
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45424
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45432
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45440
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45448
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45450
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45454
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42852
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42890
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42900
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42904
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42918
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 73.91.120.98:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 74.37.74.235:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 213.162.57.76:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 41.190.180.20:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 179.136.82.190:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.30.148.186:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 74.27.235.164:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 159.80.0.143:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 44.179.224.98:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 42.127.51.105:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 99.122.135.246:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 254.251.168.203:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 216.47.108.72:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 163.183.62.31:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 48.87.95.199:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 116.70.161.116:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 48.230.171.13:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.8.77.18:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 94.134.15.75:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 220.188.194.22:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 102.75.92.236:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 135.10.35.91:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 243.138.80.70:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 169.58.145.142:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 93.150.136.135:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 45.240.159.151:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 94.144.117.7:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 148.195.133.76:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 148.154.206.253:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 44.1.241.140:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.83.202.6:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 196.29.242.176:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 171.182.12.36:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 250.136.74.119:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 90.166.183.177:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 5.157.81.84:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 42.17.13.249:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 58.207.14.234:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 177.16.246.23:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.58.120.205:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.134.224.17:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 84.153.59.103:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 71.213.135.54:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 27.3.169.9:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 77.226.7.148:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 103.98.164.207:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 212.64.60.210:2323
Source: global traffic TCP traffic: 192.168.2.23:57648 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 45.238.76.190:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 81.16.24.62:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 160.249.79.208:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 72.50.90.102:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 123.111.31.220:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 205.133.57.33:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 101.101.24.208:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 177.186.35.121:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 89.162.155.118:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 120.85.131.235:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 59.224.248.43:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.134.92.134:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 209.87.211.219:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 128.26.70.248:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 197.235.178.139:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 184.24.192.102:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 185.101.25.97:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.179.93.85:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 194.32.166.107:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 211.4.150.19:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.35.237.222:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 2.238.181.206:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.52.118.244:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 187.44.179.145:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 152.221.96.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.80.139.88:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 69.160.36.239:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 62.2.39.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 167.221.140.59:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 37.194.230.26:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 246.145.35.191:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 67.71.201.22:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.74.138.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 65.48.16.3:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 96.100.80.42:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 96.3.188.98:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 32.233.191.36:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 152.227.102.183:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 171.143.128.252:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 92.14.119.170:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 156.60.32.115:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 126.200.203.20:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 82.144.35.190:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 105.241.1.201:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 198.254.240.220:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 68.110.149.253:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 166.173.101.64:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.130.161.221:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 48.181.205.45:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 194.40.136.29:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 221.232.171.253:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 149.122.53.178:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 4.144.238.236:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 58.84.208.250:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 107.147.172.172:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 147.228.252.75:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 183.65.76.155:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 204.117.50.146:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 44.179.132.81:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 37.20.192.210:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 112.101.47.124:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 248.197.199.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 149.183.2.171:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 179.173.11.204:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 39.53.51.125:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 97.77.244.160:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 118.88.218.120:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.210.220.76:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 200.215.83.194:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 61.142.30.137:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 16.168.35.43:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 77.131.28.71:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 121.69.106.9:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 167.38.109.179:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 169.16.233.210:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 152.100.244.29:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 53.21.112.99:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 223.249.57.78:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 86.217.133.48:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 62.167.112.146:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 58.255.241.34:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 40.123.187.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 187.150.246.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 221.5.237.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 180.194.122.18:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 77.82.126.248:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 76.237.92.223:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 217.100.139.0:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 208.26.128.124:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 69.156.137.43:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 219.174.119.116:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 100.204.95.170:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 9.85.242.189:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 2.31.2.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 142.161.156.18:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 103.48.165.171:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 126.25.209.163:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 119.142.186.169:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 37.224.195.234:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 221.176.42.62:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 85.200.5.235:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 63.221.44.83:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 78.111.34.154:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 160.234.58.5:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.199.182.250:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 161.15.69.142:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 223.45.63.162:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 119.222.167.225:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 213.198.177.235:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 35.42.28.190:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 211.80.181.23:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 208.50.96.44:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 101.100.10.184:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 223.32.97.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 104.3.11.129:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.109.245.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 111.119.167.207:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 159.80.242.24:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 84.32.252.226:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 89.202.119.51:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 165.92.203.17:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 243.25.33.138:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 24.176.245.243:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 74.238.185.154:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 61.41.169.52:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 96.65.85.45:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 64.243.45.207:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 71.73.237.209:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 84.177.166.208:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 91.158.170.183:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 193.13.120.207:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 148.230.233.247:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 217.97.206.229:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 43.107.84.141:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 204.5.147.112:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 99.88.146.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 171.238.66.116:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.171.127.20:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 245.209.248.88:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.132.36.114:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 216.12.63.41:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 204.134.199.214:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 97.54.213.101:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 58.127.83.90:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.55.228.225:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 61.248.121.252:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 152.204.76.142:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 254.43.219.51:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.69.198.125:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 163.125.119.173:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 81.18.228.32:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 114.37.13.194:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 125.40.122.94:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.190.165.68:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 144.41.192.77:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 73.52.241.216:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 158.120.221.77:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.119.215.116:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 66.89.64.47:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 86.250.173.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 135.127.253.234:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 195.74.254.101:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 219.99.194.97:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.200.144.93:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 81.27.103.202:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 145.94.189.198:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 135.111.168.112:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 165.124.13.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 198.84.33.42:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 191.254.36.22:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.39.80.26:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 128.248.92.77:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 157.143.112.179:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 69.223.41.219:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 169.214.128.158:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 241.150.43.30:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 243.110.96.104:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 65.53.88.55:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.242.218.91:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 209.252.80.155:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 202.98.67.172:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 199.34.85.168:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 65.42.35.103:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 85.56.223.127:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 218.196.232.228:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 38.169.184.60:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 126.105.50.6:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 145.214.23.53:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 186.147.85.105:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 241.30.157.176:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 136.18.25.136:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 209.202.249.140:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.217.55.209:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 152.41.138.118:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 20.4.254.249:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 191.41.230.130:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 72.218.50.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 141.96.221.80:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 41.232.91.176:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 143.20.6.2:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 106.239.163.185:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 218.178.45.127:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 184.12.233.95:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 156.144.149.242:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 171.31.204.11:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 206.12.16.103:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 98.210.166.125:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 85.16.79.38:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 160.97.243.132:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 222.123.131.28:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 97.200.108.38:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 18.149.237.176:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 188.79.107.108:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 223.100.116.111:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 141.97.109.95:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 159.39.165.227:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 143.40.210.149:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 20.30.188.179:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 62.134.220.154:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 158.105.219.136:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 89.238.216.47:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 185.142.45.149:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 43.63.77.138:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 181.141.27.236:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 136.159.48.34:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 170.77.46.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 34.141.230.41:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 47.102.209.80:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 206.77.95.133:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 58.73.49.19:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 184.85.66.28:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 108.179.245.166:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 175.121.200.60:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 241.237.163.115:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 61.141.250.237:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 103.126.178.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.225.127.30:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 220.103.223.23:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.64.215.223:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 243.128.52.51:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 36.171.251.76:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 161.108.8.175:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 75.21.138.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 31.162.74.126:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 105.118.95.167:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 246.70.189.199:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 88.121.29.193:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 173.182.146.216:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 106.74.36.69:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 149.41.211.113:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 249.53.180.178:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 110.221.14.217:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 63.191.127.243:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 206.160.184.114:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 166.79.107.64:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 189.251.213.198:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 205.159.193.158:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 166.134.119.177:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 14.236.29.18:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 113.146.117.43:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 106.115.112.27:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 175.182.239.229:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 88.175.5.163:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.164.17.9:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 221.36.61.79:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 222.116.206.117:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 78.212.174.52:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 153.101.141.62:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 156.145.134.111:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 115.23.173.6:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 84.75.110.196:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 194.141.37.245:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 98.112.181.178:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 157.254.31.85:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 89.102.206.248:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 208.173.245.210:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 117.183.96.111:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 196.136.106.232:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.159.124.240:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 71.228.41.206:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 97.163.8.56:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 121.111.246.85:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 90.149.217.50:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 73.20.101.123:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 240.132.190.205:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 185.230.247.114:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 109.123.95.144:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 47.105.26.103:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.238.78.106:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 141.107.149.142:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 13.24.153.136:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 161.62.237.218:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 4.200.115.201:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 68.85.186.122:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 89.117.59.41:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 105.187.115.169:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 169.99.4.195:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.89.42.107:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 202.1.157.247:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 113.71.230.191:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 42.141.200.140:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 247.94.172.249:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 141.111.212.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 110.237.253.140:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 46.35.160.175:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 154.205.137.117:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.121.110.131:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.102.242.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 113.240.240.246:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 119.218.1.36:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 97.88.175.79:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.11.95.175:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.218.69.199:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 197.80.137.150:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 70.1.20.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 207.116.244.1:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 119.149.195.143:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.78.147.117:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 157.35.233.38:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 184.157.237.181:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 170.246.30.1:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 86.8.8.191:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 212.105.105.146:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 193.46.120.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 8.169.120.200:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 72.243.117.211:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 173.206.104.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 174.48.95.86:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 44.89.87.229:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 149.110.45.43:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 18.38.250.114:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 167.42.88.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 87.108.232.64:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.109.87.102:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 210.55.155.26:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 135.171.89.118:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.253.3.242:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 45.143.41.66:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 5.71.52.10:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 189.216.15.122:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 114.245.105.11:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 197.4.90.152:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 73.88.157.66:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 53.175.132.172:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 38.149.1.99:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 197.95.87.41:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 199.72.218.180:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 78.76.126.93:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 62.1.0.220:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 88.25.32.56:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 212.52.3.64:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 154.227.126.66:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 148.111.13.102:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 111.243.194.208:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 188.217.113.172:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 59.111.102.202:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 112.125.157.109:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 188.61.192.104:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 1.29.173.16:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 94.200.228.112:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 31.113.167.67:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 248.248.103.236:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 180.226.85.201:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 188.21.21.164:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 149.232.57.84:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 221.226.163.248:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 251.39.180.132:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 9.227.83.29:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 75.169.143.172:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 98.63.54.97:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 153.18.170.46:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 53.226.27.100:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 95.121.252.226:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 114.175.104.171:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 124.171.176.141:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 213.41.90.249:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 174.181.47.165:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 249.199.239.13:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 84.234.183.111:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 107.228.234.186:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 71.106.75.134:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 146.70.224.23:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 106.87.216.75:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 121.95.170.123:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 167.211.216.109:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 67.58.103.45:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 189.54.217.232:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 206.201.231.69:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 86.234.117.4:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 195.126.179.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 65.209.198.35:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 44.177.91.65:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 105.54.187.33:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 24.209.119.36:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 186.158.160.241:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 254.32.116.120:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 24.81.73.219:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 146.116.142.3:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 19.228.247.128:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 95.209.185.7:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 67.88.159.245:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 168.95.56.134:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 138.214.98.136:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 57.185.161.208:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 91.196.35.227:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 211.243.44.253:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 187.183.125.149:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 37.105.117.246:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 216.229.47.156:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 70.115.255.154:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 109.9.246.252:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 160.71.88.166:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 202.40.233.111:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 115.24.119.77:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.214.220.13:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.219.52.55:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 245.31.42.209:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 111.50.240.217:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 115.8.97.45:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 95.47.95.20:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 76.137.226.95:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 150.228.51.34:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 173.131.45.147:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 139.229.233.25:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 187.199.145.191:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 86.168.27.1:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.147.204.254:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 191.253.187.239:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 59.148.88.29:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 53.94.252.14:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 208.150.159.4:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 75.53.97.231:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 48.177.46.242:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 195.4.17.48:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 216.24.204.238:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 41.123.130.255:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 38.78.44.247:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 112.236.62.187:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 242.255.213.24:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 113.121.236.149:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 187.249.69.80:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 252.43.155.52:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 167.112.210.204:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 176.211.15.125:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 188.12.109.232:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 121.104.98.54:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 244.223.94.151:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 148.195.29.246:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 61.56.201.176:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 42.191.195.151:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 27.250.151.33:2323
Source: global traffic TCP traffic: 192.168.2.23:20963 -> 102.185.163.179:2323
Sample listens on a socket
Source: /tmp/hiqWVuoNwf.elf (PID: 6216) Socket: 127.0.0.1::20905 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 73.91.120.98
Source: unknown TCP traffic detected without corresponding DNS query: 155.117.146.105
Source: unknown TCP traffic detected without corresponding DNS query: 176.240.2.148
Source: unknown TCP traffic detected without corresponding DNS query: 190.73.78.44
Source: unknown TCP traffic detected without corresponding DNS query: 217.5.223.223
Source: unknown TCP traffic detected without corresponding DNS query: 142.47.138.1
Source: unknown TCP traffic detected without corresponding DNS query: 95.106.169.22
Source: unknown TCP traffic detected without corresponding DNS query: 74.37.74.235
Source: unknown TCP traffic detected without corresponding DNS query: 131.253.200.165
Source: unknown TCP traffic detected without corresponding DNS query: 119.122.199.188
Source: unknown TCP traffic detected without corresponding DNS query: 32.126.223.229
Source: unknown TCP traffic detected without corresponding DNS query: 240.218.35.141
Source: unknown TCP traffic detected without corresponding DNS query: 71.30.101.231
Source: unknown TCP traffic detected without corresponding DNS query: 17.230.223.173
Source: unknown TCP traffic detected without corresponding DNS query: 145.39.30.181
Source: unknown TCP traffic detected without corresponding DNS query: 2.124.235.158
Source: unknown TCP traffic detected without corresponding DNS query: 244.113.68.130
Source: unknown TCP traffic detected without corresponding DNS query: 80.52.128.60
Source: unknown TCP traffic detected without corresponding DNS query: 213.162.57.76
Source: unknown TCP traffic detected without corresponding DNS query: 166.255.131.250
Source: unknown TCP traffic detected without corresponding DNS query: 60.23.119.2
Source: unknown TCP traffic detected without corresponding DNS query: 87.216.36.11
Source: unknown TCP traffic detected without corresponding DNS query: 156.208.112.58
Source: unknown TCP traffic detected without corresponding DNS query: 240.133.138.202
Source: unknown TCP traffic detected without corresponding DNS query: 194.103.235.115
Source: unknown TCP traffic detected without corresponding DNS query: 223.139.8.48
Source: unknown TCP traffic detected without corresponding DNS query: 206.46.80.202
Source: unknown TCP traffic detected without corresponding DNS query: 163.27.123.209
Source: unknown TCP traffic detected without corresponding DNS query: 41.190.180.20
Source: unknown TCP traffic detected without corresponding DNS query: 171.16.123.113
Source: unknown TCP traffic detected without corresponding DNS query: 247.214.92.125
Source: unknown TCP traffic detected without corresponding DNS query: 207.223.173.81
Source: unknown TCP traffic detected without corresponding DNS query: 180.68.35.37
Source: unknown TCP traffic detected without corresponding DNS query: 162.97.157.141
Source: unknown TCP traffic detected without corresponding DNS query: 17.196.189.49
Source: unknown TCP traffic detected without corresponding DNS query: 219.98.197.37
Source: unknown TCP traffic detected without corresponding DNS query: 211.52.62.68
Source: unknown TCP traffic detected without corresponding DNS query: 139.0.206.161
Source: unknown TCP traffic detected without corresponding DNS query: 179.136.82.190
Source: unknown TCP traffic detected without corresponding DNS query: 192.238.188.111
Source: unknown TCP traffic detected without corresponding DNS query: 169.192.229.179
Source: unknown TCP traffic detected without corresponding DNS query: 188.94.219.190
Source: unknown TCP traffic detected without corresponding DNS query: 20.24.128.124
Source: unknown TCP traffic detected without corresponding DNS query: 147.152.76.229
Source: unknown TCP traffic detected without corresponding DNS query: 91.192.231.147
Source: unknown TCP traffic detected without corresponding DNS query: 199.13.156.163
Source: unknown TCP traffic detected without corresponding DNS query: 160.107.2.182
Source: unknown TCP traffic detected without corresponding DNS query: 158.197.205.173
Source: unknown TCP traffic detected without corresponding DNS query: 252.30.148.186
Source: unknown TCP traffic detected without corresponding DNS query: 85.128.61.109
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39394
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39394 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: hiqWVuoNwf.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hiqWVuoNwf.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: hiqWVuoNwf.elf PID: 6216, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hiqWVuoNwf.elf PID: 6220, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) SIGKILL sent: pid: 6040, result: successful Jump to behavior
Yara signature match
Source: hiqWVuoNwf.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hiqWVuoNwf.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: hiqWVuoNwf.elf PID: 6216, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hiqWVuoNwf.elf PID: 6220, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal92.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4331/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2033/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2275/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/3088/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1612/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1699/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1698/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2028/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2302/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/3236/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2025/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2146/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/910/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/912/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/517/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/759/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2307/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/918/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4460/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1594/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2285/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2281/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1349/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1623/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/761/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1622/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/884/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1983/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2038/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1344/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1465/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1586/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1860/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1463/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2156/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/800/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/801/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4457/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1629/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4458/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4459/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1627/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1900/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/3021/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/491/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2294/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2050/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1877/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/772/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1633/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1599/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1632/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/774/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1477/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/654/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/896/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1476/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1872/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2048/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/655/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1475/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2289/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/656/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/777/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/657/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/658/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/419/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/936/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1639/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1638/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2208/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2180/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4481/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4484/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1809/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/4487/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1494/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1890/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2063/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2062/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1888/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1886/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/420/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1489/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/785/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1642/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/788/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/667/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/789/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1648/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/6154/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2078/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2077/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2074/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2195/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/670/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/2746/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/793/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1656/maps Jump to behavior
Source: /tmp/hiqWVuoNwf.elf (PID: 6224) File opened: /proc/1654/maps Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6288) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.PcyzsBo2Pr /tmp/tmp.62ZAaHclFT /tmp/tmp.Umb0tYZ2DL Jump to behavior
Source: /usr/bin/dash (PID: 6289) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.PcyzsBo2Pr /tmp/tmp.62ZAaHclFT /tmp/tmp.Umb0tYZ2DL Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51642
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51646
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51666
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51674
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51678
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51702
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51688
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51720
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51738
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51744
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51748
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51758
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51760
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 51770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45414
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45414
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45418
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45424
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45432
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45440
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45448
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45450
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45454
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42852
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42890
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42900
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42904
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 42918
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/hiqWVuoNwf.elf (PID: 6216) Queries kernel information via 'uname': Jump to behavior
Source: hiqWVuoNwf.elf, 6216.1.000055f2d668b000.000055f2d6712000.rw-.sdmp, hiqWVuoNwf.elf, 6220.1.000055f2d668b000.000055f2d6712000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: hiqWVuoNwf.elf, 6216.1.000055f2d668b000.000055f2d6712000.rw-.sdmp, hiqWVuoNwf.elf, 6220.1.000055f2d668b000.000055f2d6712000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: hiqWVuoNwf.elf, 6216.1.00007ffd1c352000.00007ffd1c373000.rw-.sdmp, hiqWVuoNwf.elf, 6220.1.00007ffd1c352000.00007ffd1c373000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: hiqWVuoNwf.elf, 6216.1.00007ffd1c352000.00007ffd1c373000.rw-.sdmp, hiqWVuoNwf.elf, 6220.1.00007ffd1c352000.00007ffd1c373000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/hiqWVuoNwf.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hiqWVuoNwf.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: hiqWVuoNwf.elf, type: SAMPLE
Source: Yara match File source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: hiqWVuoNwf.elf, type: SAMPLE
Source: Yara match File source: 6220.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6216.1.00007f07dc400000.00007f07dc41a000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.105.199.252
 unknown United States
11351 TWC-11351-NORTHEASTUS false
111.221.0.131
 unknown Bangladesh
38031 OPTIMAX-BD-AS-APOptiMaxCommunicationLtdBD false
41.78.123.18
 unknown Central African Republic
22351 INTELSAT-1US false
195.253.107.84
 unknown Germany
50611 KNIPP-IRONDNS1-ASTechnologieparkDE false
181.167.249.31
 unknown Argentina
10318 TelecomArgentinaSAAR false
160.186.159.134
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
32.186.218.78
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
4.151.164.194
 unknown United States
3356 LEVEL3US false
32.73.220.109
 unknown United States
2686 ATGS-MMD-ASUS false
94.61.72.188
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
212.125.223.88
 unknown Norway
3292 TDCTDCASDK false
161.141.173.122
 unknown Canada
17311 ECMC-BGPUS false
125.191.73.196
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
177.240.1.113
 unknown Mexico
13999 MegaCableSAdeCVMX false
157.144.111.131
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
112.199.163.101
 unknown Singapore
4773 MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr false
101.73.71.166
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
156.129.84.136
 unknown United States
29975 VODACOM-ZA false
121.9.180.80
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
13.68.241.228
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
67.116.193.87
 unknown United States
7018 ATT-INTERNET4US false
145.253.86.68
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
65.62.1.103
 unknown United States
32475 SINGLEHOP-LLCUS false
250.133.122.177
 unknown Reserved
unknown unknown false
64.9.242.235
 unknown United States
36492 GOOGLEWIFIUS false
90.155.255.63
 unknown Russian Federation
29124 ISKRATELECOM-ASSEVEN-SKYRU false
36.40.5.83
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
14.129.24.175
 unknown Korea Republic of
45996 GNJ-AS-KRDAOUTECHNOLOGYKR false
177.228.4.63
 unknown Mexico
13999 MegaCableSAdeCVMX false
195.197.253.115
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
124.68.52.238
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
198.196.183.83
 unknown United States
292 ESNET-WESTUS false
175.153.54.148
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
121.252.68.36
 unknown Korea Republic of
24361 CNGI-NJ-IX-AS-APCERNET2IXatSoutheastUniversityCN false
41.97.193.141
 unknown Algeria
36947 ALGTEL-ASDZ false
62.248.16.12
 unknown Turkey
9121 TTNETTR false
61.15.226.124
 unknown Hong Kong
9908 HKCABLE2-HK-APHKCableTVLtdHK false
68.90.115.243
 unknown United States
7018 ATT-INTERNET4US false
80.196.122.118
 unknown Denmark
3292 TDCTDCASDK false
198.68.175.11
 unknown United States
1239 SPRINTLINKUS false
209.89.133.106
 unknown Canada
852 ASN852CA false
117.35.167.207
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
74.160.83.168
 unknown United States
10796 TWC-10796-MIDWESTUS false
221.74.240.1
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
185.33.83.161
 unknown Hungary
42205 NET-TVHU false
136.255.14.55
 unknown Romania
12302 VODAFONE_ROCharlesdeGaullenr15RO false
44.121.133.139
 unknown United States
7377 UCSDUS false
244.98.210.158
 unknown Reserved
unknown unknown false
67.77.234.207
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
86.225.92.48
 unknown France
3215 FranceTelecom-OrangeFR false
89.109.193.233
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
193.154.149.217
 unknown Austria
8562 LICPLUS-ASAT false
103.232.214.8
 unknown China
137443 ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK false
66.238.202.185
 unknown United States
2828 XO-AS15US false
80.142.41.89
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
44.236.80.254
 unknown United States
16509 AMAZON-02US false
186.212.104.111
 unknown Brazil
18881 TELEFONICABRASILSABR false
240.0.249.92
 unknown Reserved
unknown unknown false
111.18.30.54
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
206.41.128.206
 unknown United States
3549 LVLT-3549US false
121.14.247.89
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
133.237.234.242
 unknown Japan 23820 RAKUTENRakutenIncJP false
165.161.108.57
 unknown United States
2381 WISCNET1-ASUS false
192.147.201.93
 unknown United States
1313 ADOBE1-AS-ASUS false
63.10.46.80
 unknown United States
701 UUNETUS false
76.137.238.102
 unknown United States
7922 COMCAST-7922US false
57.141.65.2
 unknown Belgium
2686 ATGS-MMD-ASUS false
189.115.231.112
 unknown Brazil
18881 TELEFONICABRASILSABR false
14.176.36.223
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
244.55.26.163
 unknown Reserved
unknown unknown false
135.42.181.199
 unknown United States
8030 WORLDNET5-10US false
94.27.69.119
 unknown Ukraine
12530 GOLDENTELECOM-UKRAINEKyivstarPJSCUA false
164.31.153.239
 unknown Germany
29355 KCELL-ASKZ false
169.38.203.55
 unknown United States
36351 SOFTLAYERUS false
155.104.196.36
 unknown United States
1906 NORTHROP-GRUMMANUS false
24.38.214.208
 unknown United States
6128 CABLE-NET-1US false
77.207.52.247
 unknown France
15557 LDCOMNETFR false
62.12.150.173
 unknown Switzerland
15623 CYBERLINKCyberlinkAGCH false
88.153.130.40
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
210.1.238.183
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
36.61.141.59
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
149.131.179.157
 unknown United States
33022 WELLESLEY-COLLEGEUS false
170.221.160.93
 unknown United States
8103 STATE-OF-FLAUS false
202.96.32.93
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
252.133.167.168
 unknown Reserved
unknown unknown false
147.166.173.195
 unknown United States
1452 DNIC-ASBLK-01451-01456US false
208.116.54.243
 unknown United States
25653 FORTRESSITXUS false
126.180.125.18
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
201.39.67.154
 unknown Brazil
4230 CLAROSABR false
192.75.68.129
 unknown Canada
806 SSC-299-806CA false
93.123.30.242
 unknown Bulgaria
43561 NET1-ASBG false
118.34.246.161
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
121.30.41.240
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
12.215.91.48
 unknown United States
7018 ATT-INTERNET4US false
247.66.237.195
 unknown Reserved
unknown unknown false
156.124.100.110
 unknown United States
393504 XNSTGCA false
244.70.241.94
 unknown Reserved
unknown unknown false
93.56.246.197
 unknown Italy
12874 FASTWEBIT false
47.99.36.39
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
209.87.95.135
 unknown United States
11696 NBS11696US false