Linux Analysis Report
2jQHythw1E.elf

Overview

General Information

Sample name: 2jQHythw1E.elf
renamed because original name is a hash value
Original sample name: c5d42f3e029744f0a8b02680d19f4851.elf
Analysis ID: 1426696
MD5: c5d42f3e029744f0a8b02680d19f4851
SHA1: 346d4b30d6e093f8bbda816a17f8372fc8e75dd3
SHA256: 80e6d71e1f9eb9b4f5b791bd2b2e382768c1fa99838d7fed5edefb13a6e86709
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 2jQHythw1E.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 2jQHythw1E.elf ReversingLabs: Detection: 57%
Source: 2jQHythw1E.elf Virustotal: Detection: 63% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:36076 -> 191.85.224.37:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:53580 -> 92.207.153.204:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:60548 -> 85.105.209.238:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:40606 -> 190.105.69.141:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:57316 -> 201.16.220.238:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53624
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53630
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53670
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53708
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53778
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53824
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38440
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38444
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38478
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38484
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38534
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38620
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:37836 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 150.239.246.22:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 94.203.204.89:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 19.210.47.144:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 92.69.84.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 167.52.140.130:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 200.96.246.36:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 136.119.189.96:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 93.248.252.91:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 106.9.119.180:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 85.240.240.216:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 158.47.246.188:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 182.25.245.198:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 181.114.205.90:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 23.154.188.217:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 246.255.119.116:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 204.223.235.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 100.162.127.111:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 75.190.88.104:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 107.252.254.173:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 182.221.27.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 63.62.156.245:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 58.205.48.224:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 243.194.146.97:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 135.0.198.198:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 76.108.132.87:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 147.189.184.9:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 153.222.185.207:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 113.255.36.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 2.160.22.168:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 187.102.46.101:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 17.18.87.45:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 248.25.121.149:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 184.72.85.60:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 74.211.179.60:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.175.61.88:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 61.241.10.17:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 170.120.64.11:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 193.143.46.248:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 23.246.53.27:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 35.31.106.16:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 138.249.151.169:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 158.189.224.51:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 252.31.91.49:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 141.57.80.134:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.139.112.73:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 188.218.113.90:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 112.103.77.98:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 169.22.4.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 165.97.28.39:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 156.69.39.175:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 185.74.56.214:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 18.72.167.199:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 173.25.127.47:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 210.118.58.0:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 183.77.235.20:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 48.32.139.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 83.73.214.150:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 253.15.186.29:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 217.214.125.114:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 9.107.214.119:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 118.173.103.126:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 212.168.78.208:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 136.250.174.197:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 71.9.221.77:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 88.210.47.41:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 240.77.119.93:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 166.202.195.173:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 248.152.62.172:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 148.232.255.21:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 16.174.171.120:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 165.231.195.58:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 106.34.223.9:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 69.189.212.169:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 154.138.76.134:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 171.156.185.69:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 177.143.88.82:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 19.107.50.170:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 254.106.241.118:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.238.39.56:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 142.243.126.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 147.140.194.112:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 156.17.86.183:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.210.63.50:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 105.59.210.156:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 182.168.167.251:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 170.250.131.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 119.135.155.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 119.185.82.208:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 82.124.185.75:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.167.47.88:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 183.216.158.242:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 121.87.63.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.213.10.4:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.76.118.54:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 92.196.84.15:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 162.205.108.23:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.230.157.47:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 76.66.225.207:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.40.24.36:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 53.23.109.169:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.55.69.62:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 16.18.55.30:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 110.81.106.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 106.78.60.19:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 206.60.212.91:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 188.173.11.13:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 72.55.233.29:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 163.149.158.144:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.42.34.74:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.200.93.202:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 73.123.49.56:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 80.3.79.149:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 89.28.163.47:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 243.83.242.88:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 150.166.96.18:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 101.100.158.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.73.109.251:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 71.214.51.76:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 203.144.137.214:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 39.106.117.51:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 139.10.72.7:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 165.63.87.252:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 147.69.11.174:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 162.229.201.155:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 218.52.228.45:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 189.81.160.217:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 78.20.100.183:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 13.115.47.108:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 12.17.9.97:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 166.223.178.107:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 152.184.238.24:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.80.21.171:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 95.85.97.22:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.254.30.224:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 139.252.147.48:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 180.53.139.221:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 160.252.188.114:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 163.10.230.92:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 5.143.62.242:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 183.109.56.36:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.27.98.66:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 63.212.5.10:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.4.250.243:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 17.88.85.52:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 78.27.50.208:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 122.100.150.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 72.238.22.42:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 160.168.111.13:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.75.231.178:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 243.225.119.171:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 197.66.13.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 197.243.103.208:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.50.253.180:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 223.65.133.40:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 122.76.19.36:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.14.184.234:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 114.145.90.190:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 253.21.149.196:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 209.42.121.27:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 38.185.154.27:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 57.37.176.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 106.68.115.184:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 54.106.195.222:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 58.30.193.148:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 178.240.209.66:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 24.222.167.131:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.151.134.53:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 35.44.184.72:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 142.177.220.5:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 23.35.22.210:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 185.189.131.15:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 90.16.40.30:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 100.63.156.82:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 150.72.46.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 198.69.55.214:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 207.255.72.144:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.77.167.55:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 105.250.165.108:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.194.203.87:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 177.78.40.73:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 103.120.73.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 123.25.109.185:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 104.97.193.0:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 8.32.146.206:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 99.90.19.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 38.243.145.140:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 16.182.59.187:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 168.5.224.132:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 136.2.214.183:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 84.130.127.201:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.213.177.13:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 64.238.56.187:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.179.122.3:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.134.230.195:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 253.42.193.4:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 27.20.150.163:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 162.5.223.180:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 176.122.144.129:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 118.200.179.7:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 84.90.223.255:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.239.75.4:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 76.2.146.157:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 88.3.192.169:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 208.180.172.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 2.205.58.146:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 153.222.110.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 166.97.5.243:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 179.5.214.57:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 60.194.21.224:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 69.77.63.41:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 210.179.152.237:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 169.120.241.20:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 116.60.229.221:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 148.167.173.96:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 46.251.160.222:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 251.59.100.60:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 158.94.101.14:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 212.126.130.214:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 38.168.193.164:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 181.142.220.110:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 244.236.182.102:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 92.222.212.237:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 208.91.250.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 93.87.148.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 188.62.166.26:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 42.219.178.152:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.168.165.174:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 110.85.90.162:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 211.213.28.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 205.246.13.58:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 122.178.225.33:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 222.106.221.28:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 88.153.241.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 122.45.116.248:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 141.148.156.66:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 249.240.135.203:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 139.12.99.47:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 13.21.205.80:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 71.122.21.238:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 72.82.102.155:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.154.211.227:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 133.249.174.96:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 180.50.119.152:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 85.6.255.223:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 101.107.185.185:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 73.109.197.33:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 105.40.133.1:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.110.196.7:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 57.246.74.97:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 188.70.166.223:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 167.129.222.227:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 162.217.90.112:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.196.42.75:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 196.71.175.71:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 174.142.51.128:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 84.203.82.20:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 153.64.192.110:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 245.142.14.151:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 117.189.34.112:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 32.225.198.50:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 101.119.115.232:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 58.195.82.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.182.113.33:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 108.37.193.224:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 183.193.243.222:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 136.115.74.4:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 8.22.80.124:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 195.145.233.5:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 174.10.245.145:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 39.4.52.143:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 198.145.122.183:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 27.7.185.35:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 150.208.147.51:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 102.24.66.229:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 133.73.218.201:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.60.22.81:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 47.85.88.60:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 20.113.247.30:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 67.29.56.250:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 95.247.18.248:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 90.71.218.250:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 78.147.89.250:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 240.108.215.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 206.162.4.76:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 133.161.173.80:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 42.122.224.227:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 71.40.158.240:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.102.221.169:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 206.162.40.17:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 37.251.243.244:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 159.241.133.70:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 100.44.158.243:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 184.234.158.185:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 141.161.241.188:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 83.91.132.158:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 145.30.161.101:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 191.118.235.51:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 80.126.121.170:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.182.2.132:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 180.151.202.236:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 101.52.68.2:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 18.1.118.89:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 36.222.103.188:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 61.24.252.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 146.79.204.63:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 241.69.54.164:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 163.252.89.252:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 76.199.91.65:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 123.191.16.247:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 65.56.246.229:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.168.141.150:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 91.154.242.233:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 218.247.207.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 165.167.5.160:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.24.190.89:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 38.172.129.129:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 154.80.244.139:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 179.209.243.198:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 44.122.85.16:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 220.82.76.5:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 75.29.25.111:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 196.140.208.229:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 87.103.96.228:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 23.116.198.15:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 90.94.174.201:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.116.106.214:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 209.72.20.115:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 208.35.93.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 115.4.20.178:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.220.242.156:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 160.190.130.229:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 83.2.93.141:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 40.91.110.197:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 150.172.23.77:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 240.235.78.240:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 111.126.213.115:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 218.88.44.120:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 103.169.26.22:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 24.178.200.178:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 149.156.82.192:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 202.233.209.240:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 2.185.131.163:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 45.85.228.172:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 93.186.154.24:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 144.88.46.102:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 48.148.158.187:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 23.153.17.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 201.36.249.147:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 91.211.118.141:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.54.13.239:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 164.92.113.253:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 156.58.117.30:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 65.115.207.230:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 13.44.250.54:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 176.127.132.172:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 209.71.195.16:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 119.187.188.13:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 13.83.162.116:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 75.166.48.151:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 211.142.86.6:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 180.19.47.101:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 58.11.121.81:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 187.224.83.217:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 195.26.250.113:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 58.16.112.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 96.77.0.19:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 135.124.204.83:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 48.0.173.4:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 252.127.108.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.63.45.11:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.116.81.0:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 91.121.101.167:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 163.113.61.16:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 171.231.98.106:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 179.10.8.204:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 208.35.81.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 76.165.34.205:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 86.9.153.219:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 88.197.223.161:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.59.101.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 133.217.32.194:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 70.77.177.116:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.179.178.104:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 209.229.207.115:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 212.83.88.35:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 84.27.7.10:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 142.154.114.83:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 19.208.2.185:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 220.97.212.206:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 19.224.210.26:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 208.48.34.65:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 85.210.236.31:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 53.33.247.226:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 202.110.162.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 253.203.68.173:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 194.66.221.248:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 152.227.54.46:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 191.28.239.250:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 243.150.3.125:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.133.43.197:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 14.19.13.146:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 161.181.42.93:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 126.62.8.219:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 63.163.32.99:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.255.78.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 77.231.115.206:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 252.220.184.142:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 219.133.164.33:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.85.5.118:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 62.32.104.84:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 37.195.12.144:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 37.196.182.244:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 247.233.70.197:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 213.139.0.148:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 120.156.81.95:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 124.29.165.122:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 98.87.239.34:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 217.31.77.25:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 74.168.57.163:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 152.4.165.210:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 78.102.176.164:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 88.173.44.77:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 178.117.185.231:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 32.72.50.80:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 133.224.174.106:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 167.18.175.167:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.9.208.69:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 194.77.5.105:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 82.90.206.70:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 103.138.137.245:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 24.46.192.12:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 78.207.246.119:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 187.249.93.174:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 156.60.4.150:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 210.179.180.38:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 75.232.40.44:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 142.91.118.202:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 155.151.68.210:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 87.129.242.11:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 32.99.47.134:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 168.240.37.92:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 67.250.171.41:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 198.230.130.134:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 77.244.131.16:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 122.123.15.205:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 110.54.216.37:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 152.44.130.94:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 164.156.101.202:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 85.55.193.73:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 65.181.83.216:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 115.209.102.68:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 44.190.77.83:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 158.220.133.136:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 148.80.170.97:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 41.89.130.32:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 87.8.252.43:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 31.227.120.133:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 125.121.224.250:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 35.89.14.114:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 34.240.101.160:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 166.50.143.203:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 14.191.255.1:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 242.219.196.107:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 240.92.22.166:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 250.246.102.165:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 43.213.59.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 211.56.7.36:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 136.234.51.176:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 171.76.81.133:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 46.151.73.171:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 35.212.62.164:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 89.109.41.237:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 96.225.234.116:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 246.129.52.212:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 107.229.195.15:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 42.178.56.6:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 82.131.194.132:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 9.51.10.94:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 36.13.176.190:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 152.176.44.30:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 206.44.201.185:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 155.181.137.123:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 57.29.231.32:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 141.47.206.241:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 98.212.55.225:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 212.200.43.82:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 2.135.78.143:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 71.189.153.140:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 24.180.137.134:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 66.114.183.73:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 179.231.206.215:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 32.154.213.84:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 156.246.102.149:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 112.184.43.195:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 161.97.127.152:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 190.61.24.245:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 19.60.51.38:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 38.46.81.253:2323
Source: global traffic TCP traffic: 192.168.2.14:43982 -> 1.221.223.117:2323
Sample listens on a socket
Source: /tmp/2jQHythw1E.elf (PID: 5493) Socket: 127.0.0.1::20905 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 93.123.85.167
Source: unknown TCP traffic detected without corresponding DNS query: 150.239.246.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.27.233.52
Source: unknown TCP traffic detected without corresponding DNS query: 174.33.218.150
Source: unknown TCP traffic detected without corresponding DNS query: 43.245.41.76
Source: unknown TCP traffic detected without corresponding DNS query: 165.196.42.141
Source: unknown TCP traffic detected without corresponding DNS query: 192.33.213.78
Source: unknown TCP traffic detected without corresponding DNS query: 2.252.174.84
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.241.37
Source: unknown TCP traffic detected without corresponding DNS query: 94.203.204.89
Source: unknown TCP traffic detected without corresponding DNS query: 41.213.229.89
Source: unknown TCP traffic detected without corresponding DNS query: 12.183.156.129
Source: unknown TCP traffic detected without corresponding DNS query: 181.238.98.64
Source: unknown TCP traffic detected without corresponding DNS query: 223.26.218.6
Source: unknown TCP traffic detected without corresponding DNS query: 84.160.36.194
Source: unknown TCP traffic detected without corresponding DNS query: 195.181.251.161
Source: unknown TCP traffic detected without corresponding DNS query: 126.66.244.244
Source: unknown TCP traffic detected without corresponding DNS query: 222.166.150.77
Source: unknown TCP traffic detected without corresponding DNS query: 207.240.249.244
Source: unknown TCP traffic detected without corresponding DNS query: 172.253.23.30
Source: unknown TCP traffic detected without corresponding DNS query: 70.59.125.244
Source: unknown TCP traffic detected without corresponding DNS query: 221.216.196.66
Source: unknown TCP traffic detected without corresponding DNS query: 189.111.73.65
Source: unknown TCP traffic detected without corresponding DNS query: 219.240.202.30
Source: unknown TCP traffic detected without corresponding DNS query: 60.186.120.164
Source: unknown TCP traffic detected without corresponding DNS query: 245.19.249.241
Source: unknown TCP traffic detected without corresponding DNS query: 92.69.84.147
Source: unknown TCP traffic detected without corresponding DNS query: 125.189.247.108
Source: unknown TCP traffic detected without corresponding DNS query: 244.91.112.74
Source: unknown TCP traffic detected without corresponding DNS query: 221.182.87.141
Source: unknown TCP traffic detected without corresponding DNS query: 200.58.144.121
Source: unknown TCP traffic detected without corresponding DNS query: 159.105.243.194
Source: unknown TCP traffic detected without corresponding DNS query: 83.95.175.139
Source: unknown TCP traffic detected without corresponding DNS query: 186.221.118.54
Source: unknown TCP traffic detected without corresponding DNS query: 192.134.90.94
Source: unknown TCP traffic detected without corresponding DNS query: 167.52.140.130
Source: unknown TCP traffic detected without corresponding DNS query: 8.166.169.222
Source: unknown TCP traffic detected without corresponding DNS query: 41.162.168.99
Source: unknown TCP traffic detected without corresponding DNS query: 190.82.160.94
Source: unknown TCP traffic detected without corresponding DNS query: 157.42.117.236
Source: unknown TCP traffic detected without corresponding DNS query: 98.176.234.158
Source: unknown TCP traffic detected without corresponding DNS query: 195.165.79.66
Source: unknown TCP traffic detected without corresponding DNS query: 73.157.136.32
Source: unknown TCP traffic detected without corresponding DNS query: 53.3.87.48
Source: unknown TCP traffic detected without corresponding DNS query: 69.255.141.237
Source: unknown TCP traffic detected without corresponding DNS query: 200.96.246.36
Source: unknown TCP traffic detected without corresponding DNS query: 217.135.148.117
Source: unknown TCP traffic detected without corresponding DNS query: 77.140.80.76
Source: unknown TCP traffic detected without corresponding DNS query: 24.163.68.229
Source: unknown TCP traffic detected without corresponding DNS query: 105.82.23.158

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2jQHythw1E.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 2jQHythw1E.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: 2jQHythw1E.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2jQHythw1E.elf PID: 5497, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/2jQHythw1E.elf (PID: 5500) SIGKILL sent: pid: 853, result: successful Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) SIGKILL sent: pid: 5333, result: successful Jump to behavior
Yara signature match
Source: 2jQHythw1E.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 2jQHythw1E.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: 2jQHythw1E.elf PID: 5493, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2jQHythw1E.elf PID: 5497, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal92.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2672/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1583/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3244/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3120/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3361/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3239/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1577/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1610/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/512/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1299/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/514/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/519/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2946/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/917/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1593/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3011/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3094/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2955/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3406/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1589/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3129/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3402/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3125/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3245/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/767/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/800/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/888/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/801/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/769/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/803/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/806/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/807/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/928/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2956/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/490/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3142/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1635/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1633/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1599/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3139/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1873/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1630/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3412/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/657/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/658/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/659/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/418/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/419/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1639/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1638/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/5439/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3659/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/5333/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3398/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1371/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3392/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/780/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/660/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/661/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/782/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1369/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3304/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3425/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/785/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1642/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/940/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/941/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1640/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3147/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3268/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1364/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3784/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/548/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3785/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3786/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3787/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1647/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2991/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1383/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1382/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1381/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/791/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/671/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/794/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1655/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2986/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/795/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/674/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1653/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/797/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/2983/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3159/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/678/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1650/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3157/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/679/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/1659/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/3319/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/5475/maps Jump to behavior
Source: /tmp/2jQHythw1E.elf (PID: 5500) File opened: /proc/5476/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53624
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53630
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53670
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53708
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53734
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53778
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 53824
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38440
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38444
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38478
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38484
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38534
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38620
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/2jQHythw1E.elf (PID: 5493) Queries kernel information via 'uname': Jump to behavior
Source: 2jQHythw1E.elf, 5493.1.000056552bd76000.000056552bea4000.rw-.sdmp, 2jQHythw1E.elf, 5497.1.000056552bd76000.000056552bea4000.rw-.sdmp Binary or memory string: +UV!/etc/qemu-binfmt/arm
Source: 2jQHythw1E.elf, 5493.1.000056552bd76000.000056552bea4000.rw-.sdmp, 2jQHythw1E.elf, 5497.1.000056552bd76000.000056552bea4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: 2jQHythw1E.elf, 5493.1.00007fff9a9d9000.00007fff9a9fa000.rw-.sdmp, 2jQHythw1E.elf, 5497.1.00007fff9a9d9000.00007fff9a9fa000.rw-.sdmp Binary or memory string: Yx86_64/usr/bin/qemu-arm/tmp/2jQHythw1E.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/2jQHythw1E.elf
Source: 2jQHythw1E.elf, 5493.1.00007fff9a9d9000.00007fff9a9fa000.rw-.sdmp, 2jQHythw1E.elf, 5497.1.00007fff9a9d9000.00007fff9a9fa000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 2jQHythw1E.elf, type: SAMPLE
Source: Yara match File source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 2jQHythw1E.elf, type: SAMPLE
Source: Yara match File source: 5497.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5493.1.00007f81c8017000.00007f81c802d000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
168.185.136.55
 unknown United States
2386 INS-ASUS false
112.230.29.19
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
156.219.41.119
 unknown Egypt
8452 TE-ASTE-ASEG false
85.52.43.206
 unknown Spain
12479 UNI2-ASES false
108.84.118.228
 unknown United States
7018 ATT-INTERNET4US false
103.207.37.111
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
245.175.107.153
 unknown Reserved
unknown unknown false
241.143.37.83
 unknown Reserved
unknown unknown false
102.169.120.119
 unknown Tunisia
37693 TUNISIANATN false
199.69.145.222
 unknown United States
7018 ATT-INTERNET4US false
153.239.116.241
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
150.246.120.78
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
57.79.150.86
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
242.0.212.183
 unknown Reserved
unknown unknown false
94.87.100.191
 unknown Italy
3269 ASN-IBSNAZIT false
38.203.241.133
 unknown United States
9009 M247GB false
65.75.209.255
 unknown Reserved
62729 ASMALLORANGE1US false
90.97.75.209
 unknown France
28708 ORANGEFR-PORTAL-ASDSImutualizedinternetaccessFR false
61.127.125.153
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.7.117.97
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
152.65.72.40
 unknown Norway
34087 NTE-BREDBANDNIX1OsloNorwayNO false
14.204.13.195
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
204.77.136.146
 unknown United States
46760 DRURYHOTELSUS false
174.195.25.65
 unknown United States
22394 CELLCOUS false
14.178.224.42
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
133.157.235.40
 unknown Japan 38634 DWANGODWANGOCoLtdJP false
17.187.225.210
 unknown United States
714 APPLE-ENGINEERINGUS false
244.51.133.178
 unknown Reserved
unknown unknown false
181.250.254.195
 unknown Colombia
26611 COMCELSACO false
34.46.239.160
 unknown United States
2686 ATGS-MMD-ASUS false
166.215.178.144
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
76.35.101.230
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
126.206.156.71
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
160.44.233.43
 unknown Germany
6878 AS6878DE false
174.15.193.79
 unknown United States
6327 SHAWCA false
188.102.19.153
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
167.22.151.11
 unknown United States
11273 FDCSGNETUS false
47.99.152.34
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
243.151.185.17
 unknown Reserved
unknown unknown false
110.27.19.173
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
149.7.227.130
 unknown United States
201924 LERTAS-ASSK false
203.234.225.18
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
120.99.242.181
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
170.141.8.189
 unknown United States
4454 TNET-ASUS false
99.2.51.164
 unknown United States
7018 ATT-INTERNET4US false
23.30.230.74
 unknown United States
7922 COMCAST-7922US false
193.155.103.19
 unknown Germany
702 UUNETUS false
90.245.29.72
 unknown United Kingdom
5378 VodafoneGB false
176.20.136.9
 unknown Denmark
3292 TDCTDCASDK false
64.16.86.26
 unknown United States
7385 ALLSTREAMUS false
223.248.176.108
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
105.103.65.125
 unknown Algeria
36947 ALGTEL-ASDZ false
113.85.132.217
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
32.123.100.81
 unknown United States
7018 ATT-INTERNET4US false
109.48.20.15
 unknown Portugal
2860 NOS_COMUNICACOESPT false
117.184.54.141
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
244.28.0.28
 unknown Reserved
unknown unknown false
61.55.41.6
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
247.235.16.130
 unknown Reserved
unknown unknown false
205.154.200.90
 unknown United States
2920 LACOEUS false
74.168.57.163
 unknown United States
7018 ATT-INTERNET4US false
118.28.147.196
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
154.219.20.142
 unknown Seychelles
26484 IKGUL-26484US false
247.230.190.199
 unknown Reserved
unknown unknown false
23.233.122.2
 unknown Canada
5645 TEKSAVVYCA false
77.90.109.226
 unknown Lithuania
34120 VT-ASNLT false
94.120.196.224
 unknown Turkey
12978 DOGAN-ONLINETR false
130.16.84.7
 unknown United States
367 DNIC-ASBLK-00306-00371US false
170.149.217.163
 unknown United States
4152 USDA-1US false
142.223.68.171
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
45.255.132.148
 unknown China
135391 AOFEI-HKAOFEIDATAINTERNATIONALCOMPANYLIMITEDHK false
63.107.158.106
 unknown United States
701 UUNETUS false
217.142.237.245
 unknown Sweden
16253 BORDERLIGHT-ASVretgrand18SE false
151.195.172.84
 unknown United States
122 UPMC-AS122US false
122.211.182.84
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
140.210.113.55
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
216.102.77.38
 unknown United States
23369 SCOEUS false
24.69.97.56
 unknown Canada
6327 SHAWCA false
37.252.145.71
 unknown Switzerland
48885 NEOCARRIERNeocarrierCommunicationsSarlCH false
27.185.59.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
169.127.89.56
 unknown United States
37611 AfrihostZA false
75.90.52.124
 unknown United States
7029 WINDSTREAMUS false
169.6.171.168
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
73.186.51.24
 unknown United States
7922 COMCAST-7922US false
195.117.152.200
 unknown Poland
5617 TPNETPL false
170.106.77.26
 unknown Singapore
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
145.183.234.227
 unknown Netherlands
59524 KPN-IAASNL false
46.199.187.196
 unknown Cyprus
6866 CYTA-NETWORKInternetServicesCY false
173.139.107.39
 unknown United States
10507 SPCSUS false
37.119.136.109
 unknown Italy
30722 VODAFONE-IT-ASNIT false
114.106.161.35
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
57.238.111.90
 unknown Belgium
2686 ATGS-MMD-ASUS false
114.197.193.155
 unknown China
17968 DQTNETDaqingzhongjipetroleumtelecommunicationconstructi false
46.224.234.219
 unknown Iran (ISLAMIC Republic Of)
56402 DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIran false
170.166.148.195
 unknown United States
19739 COUNTY-SANBERNARDINOUS false
246.196.220.233
 unknown Reserved
unknown unknown false
152.143.77.46
 unknown Germany
50629 LWLCOMDE false
74.148.236.90
 unknown United States
7922 COMCAST-7922US false
174.230.185.84
 unknown United States
22394 CELLCOUS false
159.7.232.125
 unknown Sweden
1906 NORTHROP-GRUMMANUS false