Linux Analysis Report
BUBPZkk1Sm.elf

Overview

General Information

Sample name: BUBPZkk1Sm.elf
renamed because original name is a hash value
Original sample name: de08c0bddc645dc206651ba3bc4d0741.elf
Analysis ID: 1426697
MD5: de08c0bddc645dc206651ba3bc4d0741
SHA1: a832eff4d6f65a12a383876c6a7e356f8af9fc36
SHA256: c98a60efa952d5564a916184a575a2a524cb2c6aa3096abe842b5bb10cdb35a7
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Contains symbols with names commonly found in malware
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: BUBPZkk1Sm.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: BUBPZkk1Sm.elf ReversingLabs: Detection: 63%
Source: BUBPZkk1Sm.elf Virustotal: Detection: 63% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:48950 -> 190.167.186.217:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.23:33562 -> 124.10.16.50:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.23:58202 -> 221.181.236.76:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:37624 -> 181.129.40.78:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36348
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36356
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36398
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36446
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36482
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36504
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47100
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47106
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47110
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47112
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47116
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47168
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47176
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47190
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47194
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 80.1.48.32:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.121.163.59:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 85.164.2.120:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 5.11.102.207:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 41.85.125.76:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 88.86.120.92:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 87.16.223.9:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 187.23.101.59:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 31.74.12.3:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 106.8.129.77:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 63.232.80.149:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.38.70.179:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 160.237.251.186:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 253.204.136.195:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 42.150.170.240:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 54.109.195.206:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 187.62.245.170:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 136.116.40.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 218.75.21.117:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 75.3.195.86:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 175.147.77.10:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 17.247.192.252:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 5.253.242.205:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 113.231.153.195:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 144.22.97.168:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 186.68.58.215:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.152.230.227:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 90.110.201.98:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 170.212.179.220:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 35.70.128.4:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 161.186.134.127:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 99.118.184.169:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 20.184.205.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 103.87.98.235:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 125.242.34.4:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 1.224.8.60:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 119.253.246.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 5.82.25.183:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 40.40.126.226:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 246.174.159.253:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 121.186.35.75:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.244.145.254:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 80.24.129.94:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.30.135.61:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 157.188.164.66:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 124.194.200.53:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 194.202.158.131:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 191.78.205.71:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 70.106.238.5:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 71.205.115.3:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 210.60.37.28:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 79.165.95.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.173.0.85:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.128.238.119:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 82.5.221.11:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 101.153.188.143:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.99.145.182:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 88.157.183.97:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 179.220.217.156:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 145.160.196.140:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 24.114.19.143:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 12.57.237.136:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 23.87.14.15:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 85.102.126.23:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 243.1.114.25:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 246.127.20.71:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.52.173.32:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 44.139.253.65:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 204.234.165.145:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 32.90.176.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 145.171.221.161:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 124.86.37.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 149.240.240.16:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 250.101.169.202:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 195.194.144.61:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 62.213.243.125:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 165.186.208.67:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 47.224.232.122:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 252.96.108.122:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 120.24.102.190:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 90.115.14.88:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 245.21.13.233:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 78.24.57.15:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.32.189.154:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 16.49.1.186:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 177.99.205.192:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 121.161.232.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 100.178.229.137:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 191.253.17.152:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 242.146.38.91:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 195.164.210.156:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 247.155.91.171:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 80.196.185.129:2323
Source: global traffic TCP traffic: 192.168.2.23:57662 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.33.152.238:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 13.206.89.121:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 179.151.196.226:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 221.7.81.98:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.119.102.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 217.237.225.33:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 70.183.89.116:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 170.54.45.65:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 246.137.152.57:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 112.217.104.4:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 94.142.56.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 111.182.29.252:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 86.180.45.235:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 72.31.141.90:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 109.116.235.218:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 135.207.113.83:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 68.161.159.247:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 85.180.197.79:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 121.23.213.114:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 166.110.2.10:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 176.178.198.95:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.184.253.190:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.116.94.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 23.69.44.216:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 9.213.81.220:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.107.55.138:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 4.184.50.64:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 206.213.67.24:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 42.220.81.236:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 84.86.96.18:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 177.239.182.205:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 19.60.56.207:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 39.108.165.110:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 8.170.175.186:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 119.246.107.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 221.227.5.59:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 161.207.75.130:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 82.122.3.41:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 134.235.75.219:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 249.184.115.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 95.173.47.11:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 204.98.191.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 205.222.3.101:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 31.211.184.17:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 89.32.128.164:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.154.122.228:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.58.222.67:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 188.240.157.191:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 169.79.103.37:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 176.162.24.27:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 27.223.190.91:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 37.227.175.157:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 188.111.254.22:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 91.239.148.175:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 200.141.113.247:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 182.22.251.141:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 101.254.56.12:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 123.0.36.238:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 117.195.128.67:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 73.217.22.188:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.8.29.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 20.14.140.106:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.47.140.68:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 95.157.195.251:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 73.182.90.112:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 125.151.158.249:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 169.162.78.184:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 79.128.184.133:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.49.85.188:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 160.63.159.184:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 41.222.82.109:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.155.240.149:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 53.129.170.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 67.39.76.154:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 61.108.56.219:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 111.149.2.220:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 178.150.53.55:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 100.165.31.29:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 27.209.155.66:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 174.31.94.120:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 123.168.38.113:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 169.84.89.207:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 213.107.34.135:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 241.64.120.116:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 9.43.170.204:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 121.18.251.161:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.29.169.6:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.20.30.222:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 119.156.68.185:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 90.83.54.177:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 241.186.76.51:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 223.70.156.117:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 153.92.45.182:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 62.185.214.61:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.147.221.206:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 203.232.247.221:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 156.128.151.106:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 176.109.73.205:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 111.213.28.72:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 109.3.146.221:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 105.179.101.99:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 32.63.79.43:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 17.11.81.126:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 36.91.130.58:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 168.168.148.115:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.87.128.62:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 1.47.114.54:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 190.67.159.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 176.8.92.223:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 221.225.184.82:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 195.37.44.165:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 162.1.144.202:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 188.105.138.77:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.152.49.119:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 112.81.231.245:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 158.30.111.192:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 32.199.201.108:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 5.231.148.4:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 106.23.34.94:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 148.205.33.170:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.121.148.154:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 16.15.134.0:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 156.113.215.206:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.231.248.247:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 40.45.47.253:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 100.216.161.195:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 48.242.130.250:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.100.179.86:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 34.155.62.23:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 145.109.161.35:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 190.6.193.56:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.250.68.22:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 45.240.47.29:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.136.104.198:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 79.57.232.135:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 12.37.227.217:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 162.145.162.206:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 154.49.148.181:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.188.2.2:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 165.183.122.201:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 205.225.216.213:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 143.20.175.99:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 46.104.108.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 242.239.153.90:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 216.22.18.188:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 203.233.43.149:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 250.232.185.223:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 23.1.45.31:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 162.171.85.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.191.176.81:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 211.88.154.0:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 173.199.185.224:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 222.148.175.151:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 173.114.8.190:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 180.71.142.153:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 187.147.211.0:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 14.25.61.229:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 74.198.62.68:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 158.122.144.197:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 149.27.162.61:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 44.170.101.10:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 59.140.44.199:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 133.221.48.189:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 244.38.81.229:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 124.0.78.43:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 184.225.39.150:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.53.55.25:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 43.251.226.115:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 141.216.53.25:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 23.52.55.72:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 13.192.232.244:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 168.143.12.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 53.237.106.157:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 43.239.201.250:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 146.138.146.127:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.243.244.210:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 244.202.40.183:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 254.46.54.165:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 163.50.66.168:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 35.191.88.142:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 249.23.223.21:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 77.5.161.82:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 89.55.58.69:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 84.32.89.155:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 244.60.215.30:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 1.23.222.238:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 154.218.198.212:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 2.96.252.240:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 119.101.87.207:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 113.203.17.201:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 149.18.168.24:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.32.172.89:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.83.109.190:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 204.32.49.237:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 124.3.155.175:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.47.33.173:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 190.230.86.244:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 168.45.37.68:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 77.213.213.184:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 200.71.254.12:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.116.85.77:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 106.133.34.26:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 153.224.140.35:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.105.205.151:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 43.64.168.161:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 126.216.184.238:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 145.12.1.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 241.172.33.71:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 246.161.150.79:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 183.5.156.172:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.26.69.172:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 183.130.230.123:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.221.210.166:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 249.6.215.194:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 118.118.111.186:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 208.12.240.46:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 176.127.158.52:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 149.198.104.84:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 167.232.130.39:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 119.249.132.72:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 88.133.51.224:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 198.129.115.118:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.3.75.81:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.164.50.233:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 17.86.81.11:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.240.123.213:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 39.254.84.235:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 169.58.161.127:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 144.3.254.1:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 16.33.57.8:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 38.175.29.218:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 212.12.109.102:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 217.163.248.220:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 175.37.11.99:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 20.180.40.44:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 69.166.50.79:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 161.236.27.139:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 244.154.4.198:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.233.181.6:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 155.246.42.164:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 36.247.10.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 207.174.185.72:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 135.51.138.252:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 41.205.179.53:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 149.98.27.56:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 61.85.212.53:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 83.120.153.201:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 24.176.74.56:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 120.136.116.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 163.154.225.38:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 161.237.166.22:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 39.73.10.53:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 124.132.199.232:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 193.134.7.32:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 186.249.6.110:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 27.219.100.9:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 102.119.54.41:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.198.99.94:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 100.10.74.174:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 155.35.212.121:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 100.134.13.225:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 91.106.3.157:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 81.30.124.148:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 249.182.7.24:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 180.252.144.247:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 213.0.162.236:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 14.6.121.240:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 186.148.48.25:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 164.95.138.220:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 250.121.6.55:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 70.87.62.152:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 1.128.131.17:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 202.99.161.178:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 73.161.90.232:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 135.250.59.202:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 143.243.166.246:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 94.34.68.135:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 146.233.149.126:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 133.253.205.239:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 193.73.157.166:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 204.154.80.16:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 142.5.10.207:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 60.90.107.14:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 62.126.102.156:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 112.34.225.61:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.36.165.71:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 78.218.47.122:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 38.105.206.180:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 31.157.220.173:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 48.136.30.233:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 139.250.210.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.242.127.154:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 200.216.45.253:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 103.255.172.22:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.247.157.40:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 166.209.14.95:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 12.184.174.182:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 118.97.194.144:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 243.86.208.74:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 90.27.112.97:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 91.123.183.186:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 247.134.219.130:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 71.148.233.20:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 193.144.146.153:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 74.70.208.33:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 173.227.36.78:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 115.234.118.110:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 2.26.123.191:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 208.107.5.74:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 177.126.195.44:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.43.235.116:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 220.62.68.255:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 184.255.111.224:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 160.28.60.237:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 67.33.196.110:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 206.56.141.119:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.118.127.241:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 66.66.156.79:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 171.76.85.7:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 178.216.237.230:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 155.177.165.87:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 183.193.130.184:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.207.111.148:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 87.109.82.173:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 245.30.27.140:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 141.73.217.1:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 106.216.170.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 188.116.131.86:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 179.156.130.132:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 166.204.72.28:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 85.151.184.75:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.171.239.219:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 203.250.27.247:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 205.182.8.97:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 73.31.167.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 92.88.201.56:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 8.153.253.138:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 163.0.226.80:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 13.253.69.24:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 47.3.183.152:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 89.69.34.65:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 146.183.253.209:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 14.30.118.167:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.135.206.77:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 101.178.237.122:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 184.206.139.151:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 254.18.215.114:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 163.130.57.135:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 211.14.237.93:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 203.233.57.45:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 74.210.100.96:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 252.19.177.231:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 158.115.169.153:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 37.172.37.19:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 121.97.228.251:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 99.157.146.30:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 72.43.48.197:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 57.23.213.13:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 159.114.69.111:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 161.179.206.17:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 78.73.14.29:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 117.95.147.248:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 201.47.195.0:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 160.122.122.57:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 189.26.191.166:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 81.59.111.233:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 208.102.1.157:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 16.241.10.203:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 196.157.13.64:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 255.130.19.39:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 37.127.125.150:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 59.118.177.238:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 248.168.174.150:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 139.189.200.178:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 165.144.187.162:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 24.2.121.35:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 19.188.39.235:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 108.129.107.228:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 59.200.252.234:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 151.85.220.126:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 206.199.235.243:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 133.64.138.44:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 148.47.233.64:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 243.147.6.153:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 78.168.85.213:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 251.80.15.8:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 94.57.222.26:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 70.22.226.249:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 207.210.184.27:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 191.182.237.103:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 114.223.141.35:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 57.99.205.206:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 179.48.11.59:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 174.56.0.147:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.140.19.134:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 65.41.91.189:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 122.192.238.183:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 51.5.50.98:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 243.156.208.235:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 185.61.227.64:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 223.167.204.144:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 240.79.124.200:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 96.180.85.140:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 218.212.113.114:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 89.153.198.35:2323
Source: global traffic TCP traffic: 192.168.2.23:43024 -> 180.169.152.31:2323
Sample listens on a socket
Source: /tmp/BUBPZkk1Sm.elf (PID: 6259) Socket: 127.0.0.1::20905 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 80.1.48.32
Source: unknown TCP traffic detected without corresponding DNS query: 246.80.165.32
Source: unknown TCP traffic detected without corresponding DNS query: 46.174.190.35
Source: unknown TCP traffic detected without corresponding DNS query: 195.101.14.35
Source: unknown TCP traffic detected without corresponding DNS query: 173.30.176.194
Source: unknown TCP traffic detected without corresponding DNS query: 250.101.94.204
Source: unknown TCP traffic detected without corresponding DNS query: 197.232.23.107
Source: unknown TCP traffic detected without corresponding DNS query: 182.195.53.179
Source: unknown TCP traffic detected without corresponding DNS query: 136.48.102.205
Source: unknown TCP traffic detected without corresponding DNS query: 159.107.139.97
Source: unknown TCP traffic detected without corresponding DNS query: 85.54.242.145
Source: unknown TCP traffic detected without corresponding DNS query: 189.250.148.125
Source: unknown TCP traffic detected without corresponding DNS query: 212.121.222.32
Source: unknown TCP traffic detected without corresponding DNS query: 166.225.19.193
Source: unknown TCP traffic detected without corresponding DNS query: 1.143.188.59
Source: unknown TCP traffic detected without corresponding DNS query: 212.33.105.199
Source: unknown TCP traffic detected without corresponding DNS query: 115.121.163.59
Source: unknown TCP traffic detected without corresponding DNS query: 167.166.29.61
Source: unknown TCP traffic detected without corresponding DNS query: 204.76.84.246
Source: unknown TCP traffic detected without corresponding DNS query: 85.164.2.120
Source: unknown TCP traffic detected without corresponding DNS query: 105.28.70.189
Source: unknown TCP traffic detected without corresponding DNS query: 216.249.152.135
Source: unknown TCP traffic detected without corresponding DNS query: 36.225.20.191
Source: unknown TCP traffic detected without corresponding DNS query: 93.150.12.26
Source: unknown TCP traffic detected without corresponding DNS query: 90.133.130.223
Source: unknown TCP traffic detected without corresponding DNS query: 16.133.59.126
Source: unknown TCP traffic detected without corresponding DNS query: 35.243.153.140
Source: unknown TCP traffic detected without corresponding DNS query: 157.11.61.187
Source: unknown TCP traffic detected without corresponding DNS query: 8.252.17.235
Source: unknown TCP traffic detected without corresponding DNS query: 5.11.102.207
Source: unknown TCP traffic detected without corresponding DNS query: 150.148.211.27
Source: unknown TCP traffic detected without corresponding DNS query: 154.151.51.143
Source: unknown TCP traffic detected without corresponding DNS query: 220.197.146.77
Source: unknown TCP traffic detected without corresponding DNS query: 115.25.239.178
Source: unknown TCP traffic detected without corresponding DNS query: 249.209.87.32
Source: unknown TCP traffic detected without corresponding DNS query: 79.48.250.207
Source: unknown TCP traffic detected without corresponding DNS query: 223.56.213.236
Source: unknown TCP traffic detected without corresponding DNS query: 105.167.161.138
Source: unknown TCP traffic detected without corresponding DNS query: 212.50.148.91
Source: unknown TCP traffic detected without corresponding DNS query: 209.33.255.194
Source: unknown TCP traffic detected without corresponding DNS query: 82.233.199.221
Source: unknown TCP traffic detected without corresponding DNS query: 223.74.21.239
Source: unknown TCP traffic detected without corresponding DNS query: 170.88.51.21
Source: unknown TCP traffic detected without corresponding DNS query: 185.122.106.174
Source: unknown TCP traffic detected without corresponding DNS query: 86.113.100.189
Source: unknown TCP traffic detected without corresponding DNS query: 211.94.6.139
Source: unknown TCP traffic detected without corresponding DNS query: 196.77.250.61
Source: unknown TCP traffic detected without corresponding DNS query: 109.61.129.121
Source: unknown TCP traffic detected without corresponding DNS query: 53.90.69.193
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: BUBPZkk1Sm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: BUBPZkk1Sm.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: BUBPZkk1Sm.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: BUBPZkk1Sm.elf PID: 6263, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_app_http
Source: ELF static info symbol of initial sample Name: attack_app_https
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_gre_eth
Source: ELF static info symbol of initial sample Name: attack_gre_ip
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Sample and/or dropped files contains symbols with suspicious names
Source: BUBPZkk1Sm.elf ELF static info symbol of initial sample: __gnu_unwind_execute
Sample tries to kill a process (SIGKILL)
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) SIGKILL sent: pid: 6081, result: successful Jump to behavior
Yara signature match
Source: BUBPZkk1Sm.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: BUBPZkk1Sm.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: BUBPZkk1Sm.elf PID: 6259, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: BUBPZkk1Sm.elf PID: 6263, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2033/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2275/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/3088/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1612/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1699/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1698/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2028/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2302/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/3236/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2025/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2146/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/910/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4444/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4445/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/912/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4446/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/517/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/759/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2307/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/918/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/6245/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/6244/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1594/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2285/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/6081/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2281/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1349/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1623/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/761/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1622/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/884/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1983/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2038/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1344/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1465/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1586/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1860/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1463/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2156/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/800/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/801/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1629/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1627/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1900/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/3021/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/491/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2294/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2050/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1877/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/772/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1633/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1599/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1632/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/774/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1477/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/654/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/896/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1476/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1872/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2048/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/655/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1475/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2289/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/656/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/777/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/657/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/658/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4501/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/419/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/936/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1639/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1638/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4505/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2208/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2180/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/6265/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1809/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1494/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1890/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2063/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2062/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/6261/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1888/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1886/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/420/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1489/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/785/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1642/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/788/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/667/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/789/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/1648/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/4497/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2078/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2077/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2074/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2195/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/670/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/2746/maps Jump to behavior
Source: /tmp/BUBPZkk1Sm.elf (PID: 6267) File opened: /proc/793/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36348
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36356
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36398
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36446
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36482
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36504
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47100
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47106
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47110
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47112
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47116
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47168
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47176
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47190
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47194
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/BUBPZkk1Sm.elf (PID: 6259) Queries kernel information via 'uname': Jump to behavior
Source: BUBPZkk1Sm.elf, 6259.1.000055dde3e6e000.000055dde3fbf000.rw-.sdmp, BUBPZkk1Sm.elf, 6263.1.000055dde3e6e000.000055dde3f9c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: BUBPZkk1Sm.elf, 6259.1.000055dde3e6e000.000055dde3fbf000.rw-.sdmp, BUBPZkk1Sm.elf, 6263.1.000055dde3e6e000.000055dde3f9c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: BUBPZkk1Sm.elf, 6259.1.00007ffcf3675000.00007ffcf3696000.rw-.sdmp, BUBPZkk1Sm.elf, 6263.1.00007ffcf3675000.00007ffcf3696000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/BUBPZkk1Sm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/BUBPZkk1Sm.elf
Source: BUBPZkk1Sm.elf, 6259.1.00007ffcf3675000.00007ffcf3696000.rw-.sdmp, BUBPZkk1Sm.elf, 6263.1.00007ffcf3675000.00007ffcf3696000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: BUBPZkk1Sm.elf, type: SAMPLE
Source: Yara match File source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: BUBPZkk1Sm.elf, type: SAMPLE
Source: Yara match File source: 6259.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6263.1.00007f1c00017000.00007f1c00032000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
136.10.104.178
 unknown United States
10146 FORD-MOTOR-CO-SG-APFordMotorCompanySG false
67.2.4.168
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
35.246.40.11
 unknown United States
15169 GOOGLEUS false
37.224.192.128
 unknown Saudi Arabia
39891 ALJAWWALSTC-ASSA false
191.61.217.78
 unknown Brazil
53037 NEXTELTELECOMUNICACOESLTDABR false
213.133.113.77
 unknown Germany
24940 HETZNER-ASDE false
108.18.118.21
 unknown United States
701 UUNETUS false
74.184.166.189
 unknown United States
7018 ATT-INTERNET4US false
171.101.102.203
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
35.154.4.106
 unknown United States
16509 AMAZON-02US false
168.34.188.203
 unknown United States
1761 TDIR-CAPNETUS false
71.191.111.247
 unknown United States
701 UUNETUS false
80.31.124.75
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
191.68.118.38
 unknown Colombia
26611 COMCELSACO false
244.233.186.202
 unknown Reserved
unknown unknown false
91.243.108.248
 unknown Russian Federation
61360 NOVOCHEK-ASISPOrbitaJSCRU false
125.143.219.125
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
149.169.215.65
 unknown United States
2900 WN-AZ-ASUS false
92.193.186.66
 unknown Germany
20676 PLUSNETDE false
164.115.25.244
 unknown Thailand
9835 GITS-TH-AS-APGovernmentInformationTechnologyServicesTH false
221.119.175.148
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
105.43.54.4
 unknown Egypt
37069 MOBINILEG false
97.113.94.147
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
165.180.64.115
 unknown South Africa
7046 RFC2270-UUNET-CUSTOMERUS false
247.193.26.47
 unknown Reserved
unknown unknown false
1.148.236.75
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
194.96.72.126
 unknown Austria
1901 EUNETAT-ASA1TelekomAustriaAGAT false
157.95.204.132
 unknown United States
29700 CYPRESS-SEMICONDUCTORUS false
125.189.10.17
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
27.126.160.236
 unknown Japan 18136 CTAJupiterTelecommunicationsCoLtdJP false
125.105.111.128
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.212.152.73
 unknown Singapore
55430 STARHUB-NGNBNStarhubLtdSG false
12.83.35.107
 unknown United States
7018 ATT-INTERNET4US false
182.62.29.31
 unknown Malaysia
4818 DIGIIX-APDiGiTelecommunicationsSdnBhdMY false
173.30.73.119
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false
84.85.120.97
 unknown Netherlands
1136 KPNKPNNationalEU false
85.38.92.134
 unknown Italy
3269 ASN-IBSNAZIT false
86.204.26.139
 unknown France
3215 FranceTelecom-OrangeFR false
157.126.102.222
 unknown United States
1738 OKOBANK-ASEU false
70.0.88.160
 unknown United States
10507 SPCSUS false
173.153.110.18
 unknown United States
10507 SPCSUS false
86.138.72.231
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
34.80.217.29
 unknown United States
15169 GOOGLEUS false
149.152.25.225
 unknown United States
22742 CT-EDU-NETUS false
201.89.27.84
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
198.111.174.137
 unknown United States
237 MERIT-AS-14US false
209.19.202.125
 unknown United States
2828 XO-AS15US false
176.136.170.74
 unknown France
5410 BOUYGTEL-ISPFR false
72.4.0.61
 unknown United States
7029 WINDSTREAMUS false
41.85.136.14
 unknown South Africa
37525 BYTES-CON-1ZA false
27.98.188.49
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
20.176.214.53
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
27.85.177.197
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
161.166.182.193
 unknown United States
10695 WAL-MARTUS false
218.2.240.55
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
101.27.113.88
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
206.29.47.13
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
2.86.93.253
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
217.59.234.9
 unknown Italy
3269 ASN-IBSNAZIT false
12.229.3.165
 unknown United States
7018 ATT-INTERNET4US false
174.32.80.4
 unknown United States
6621 HNS-DIRECPCUS false
197.9.222.7
 unknown Tunisia
5438 ATI-TN false
241.103.213.179
 unknown Reserved
unknown unknown false
27.253.160.136
 unknown Japan 55387 RMGR-MIXJapanCommunicationIncJP false
14.26.78.22
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
94.34.63.199
 unknown Italy
8612 TISCALI-IT false
87.249.39.194
 unknown Russian Federation
31323 UNNET-ASRU false
123.91.142.243
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
70.37.100.35
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
176.59.149.92
 unknown Russian Federation
41330 T2-NOVOSIBIRSK-ASTele2RussiaNetworkRU false
14.181.118.215
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
24.227.187.181
 unknown United States
11427 TWC-11427-TEXASUS false
253.80.95.169
 unknown Reserved
unknown unknown false
42.138.239.74
 unknown China
4249 LILLY-ASUS false
152.89.14.42
 unknown Iran (ISLAMIC Republic Of)
12660 SHARIF-EDU-NETIR false
204.23.194.164
 unknown United States
13325 STOMIUS false
195.175.102.108
 unknown Turkey
9121 TTNETTR false
221.144.67.124
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
172.85.6.32
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
163.253.64.155
 unknown United States
210 WEST-NET-WESTUS false
199.119.115.200
 unknown United States
22925 ALLIED-TELECOMUS false
203.158.79.141
 unknown India
55545 SUT-AS-APSuranareeUniversityofTechnologyTH false
160.115.175.34
 unknown South Africa
6711 HUNGARNET-SZEGEDSzegedUniversityAssociationandHU false
23.203.64.50
 unknown United States
16625 AKAMAI-ASUS false
217.232.129.99
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
37.194.22.245
 unknown Russian Federation
31200 NTKIPv6customersRU false
88.157.82.184
 unknown Portugal
2860 NOS_COMUNICACOESPT false
19.246.207.218
 unknown United States
3 MIT-GATEWAYSUS false
76.251.0.188
 unknown United States
7018 ATT-INTERNET4US false
175.219.199.118
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
188.65.42.160
 unknown Poland
41421 AS-SNTStarNetTelecomSpzooPL false
80.166.215.166
 unknown Denmark
3292 TDCTDCASDK false
161.90.186.106
 unknown Netherlands
14298 EPA-NETUS false
175.137.162.222
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
138.226.133.168
 unknown Switzerland
12980 EMEAHostingAutonomousSystemEU false
2.100.29.172
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
151.100.244.6
 unknown Italy
137 ASGARRConsortiumGARREU false
158.107.84.200
 unknown United States
26423 DOMRESUS false
218.123.250.189
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
166.217.46.49
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false