Linux Analysis Report
sYlwfFFwFb.elf

Overview

General Information

Sample name: sYlwfFFwFb.elf
renamed because original name is a hash value
Original sample name: 954e3deebe9a4c80d0c77efd860c6ca2.elf
Analysis ID: 1426698
MD5: 954e3deebe9a4c80d0c77efd860c6ca2
SHA1: a633575ae42112c567aa0374448fbfcd62793e53
SHA256: 20e4d5fc1151694a4c95b2798325c64a46ce55420f333b81a9ec8b3854314a3b
Tags: 32elfmiraisparc
Infos:

Detection

Mirai
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sYlwfFFwFb.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: sYlwfFFwFb.elf ReversingLabs: Detection: 56%
Source: sYlwfFFwFb.elf Virustotal: Detection: 65% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.15:41140 -> 201.55.113.158:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33830
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33832
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33838
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33840
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33846
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33850
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33852
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33856
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43780
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43784
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43798
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43820
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43830
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43842
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43856
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43862
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46964
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46978
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46990
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47000
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47008
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47036
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47042
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47048
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.106.112.35:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.68.172.136:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 27.152.217.237:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.206.116.95:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 217.144.5.24:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 189.194.4.127:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 31.130.164.173:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 181.219.147.149:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 88.128.194.140:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 176.24.183.15:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 111.228.100.63:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 176.129.170.83:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 196.42.143.101:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 126.139.209.43:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 156.136.54.111:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 96.16.131.89:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 182.128.15.112:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 72.76.37.38:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 92.217.152.16:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 242.120.164.136:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 158.214.232.145:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 116.96.187.155:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 255.32.136.88:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.63.16.247:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 178.191.175.113:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 179.82.97.198:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 1.137.162.206:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 83.48.177.223:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 20.93.189.19:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 191.250.47.123:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 44.156.174.250:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 153.161.194.178:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 12.213.110.83:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 144.50.180.183:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.134.111.39:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 76.107.205.80:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 98.33.58.191:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.24.15.160:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 64.240.34.56:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 185.209.134.227:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 19.19.213.134:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 63.67.85.144:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 65.131.12.90:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 139.177.43.157:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 123.48.205.23:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 118.128.108.5:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 104.169.255.213:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 88.211.242.21:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 98.5.15.195:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 91.140.174.109:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 64.14.184.35:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 223.13.18.144:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.181.195.168:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 158.102.207.208:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 206.131.236.93:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 110.250.9.140:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 113.242.217.109:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 73.151.208.134:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 44.202.146.249:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 123.16.217.246:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 20.232.41.27:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 254.207.111.232:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 34.201.161.115:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 163.251.238.197:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 61.170.171.76:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 78.171.72.204:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 174.211.211.229:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 20.150.52.41:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 221.194.48.193:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 199.17.29.133:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.169.12.196:2323
Source: global traffic TCP traffic: 192.168.2.15:55554 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 204.129.240.176:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 200.192.200.26:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 151.220.146.181:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 185.110.227.124:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 72.176.200.90:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 254.4.159.20:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.122.205.202:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 162.237.145.24:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 91.180.175.89:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 202.127.125.207:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 94.165.30.150:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 152.34.146.104:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 12.50.88.136:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 184.25.172.36:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 221.27.160.242:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 162.47.188.89:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 146.213.175.232:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 125.178.155.68:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 251.123.216.204:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 65.64.156.212:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 243.211.101.253:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 211.61.10.113:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 96.30.157.146:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 12.252.49.15:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 61.95.101.180:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 194.130.49.67:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 184.5.184.228:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 53.76.60.148:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 47.220.35.230:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 181.194.66.12:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 92.146.147.120:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 202.201.237.118:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 175.132.246.102:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 253.42.192.106:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 111.115.163.162:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 146.150.100.79:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 70.184.136.20:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 205.236.47.5:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 41.248.146.50:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 96.61.42.3:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 84.31.13.123:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.126.33.165:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 176.112.89.217:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 109.90.118.107:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.10.116.69:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 79.106.211.33:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 121.217.7.61:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 171.214.104.224:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 240.7.199.229:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 83.108.204.210:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.201.32.42:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 40.197.243.131:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 103.109.166.163:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 102.136.61.1:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 220.131.56.96:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 41.159.153.63:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 34.80.154.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 65.242.66.103:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 43.162.4.158:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.45.127.8:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 184.157.93.47:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 86.186.204.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 104.143.115.84:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 211.97.7.80:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 59.212.78.91:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 95.237.21.117:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 241.86.158.223:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 4.0.87.153:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.231.41.125:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.225.89.116:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 182.238.160.138:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 211.230.184.37:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.248.192.137:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 87.199.120.91:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 106.118.179.223:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 43.156.51.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 61.146.222.190:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 85.27.226.226:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 109.122.174.190:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 125.163.212.230:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 151.239.238.120:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 151.15.212.199:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 71.13.123.226:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 113.146.1.232:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 32.52.137.213:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 177.161.113.208:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 116.171.200.35:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 47.28.142.72:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 61.168.249.146:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.226.197.51:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.84.91.61:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 210.64.108.22:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 211.197.171.224:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 176.91.105.99:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.2.125.72:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 155.72.159.74:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 39.93.142.189:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 208.83.179.241:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 251.255.48.45:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 162.129.202.101:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 18.34.16.66:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 60.11.81.108:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 247.185.213.162:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 164.116.115.243:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 178.211.44.174:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 107.95.121.6:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 146.218.186.98:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 94.218.218.155:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.143.209.45:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 80.96.28.165:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 168.24.191.130:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 221.204.21.0:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 194.163.173.212:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 90.186.59.111:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 198.34.37.61:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 34.92.248.223:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 85.196.244.246:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 153.104.254.134:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 153.12.157.54:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 175.209.172.146:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 122.11.202.29:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 152.61.58.153:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 67.130.155.189:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 38.158.113.147:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 149.47.156.121:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 217.90.249.165:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.200.133.214:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 20.156.252.68:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 66.11.63.222:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 1.213.61.49:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.75.227.42:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.214.92.170:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 120.89.66.141:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 194.120.15.158:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 46.228.102.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 183.173.45.176:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 87.158.219.54:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 97.38.74.14:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 73.200.43.215:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 252.153.177.13:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 206.226.129.163:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 72.24.55.151:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 41.227.251.190:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 152.111.11.162:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 95.14.205.197:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 209.221.23.229:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.64.12.235:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.126.126.195:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 85.23.236.180:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 109.96.157.251:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 61.222.76.48:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 153.132.30.27:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 185.50.145.163:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 135.13.227.161:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 62.10.6.72:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 85.22.213.79:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 115.110.166.14:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.81.225.55:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 32.161.1.75:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 18.107.75.24:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 166.117.246.191:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.134.185.124:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 206.207.63.16:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 164.118.206.44:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 66.181.55.127:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 115.13.182.232:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 150.54.223.152:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 18.156.196.80:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 151.237.234.55:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 124.215.6.126:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 158.83.127.53:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 182.100.133.105:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 68.89.167.20:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 75.17.162.94:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 119.245.116.62:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 108.98.128.227:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.223.235.53:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 171.91.13.6:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 243.181.18.90:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 102.115.139.184:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 168.125.235.68:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 38.138.17.60:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 53.245.199.166:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 125.214.177.236:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 253.126.238.178:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 163.29.11.122:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 207.181.74.29:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 82.119.130.57:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 157.128.111.230:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 124.146.64.19:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 170.188.83.192:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 222.159.102.78:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 250.142.130.228:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 5.33.53.108:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 222.64.69.18:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 201.218.189.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 95.20.138.236:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 34.26.96.106:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 210.239.137.249:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.92.37.4:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 160.189.125.1:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 123.190.234.66:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 1.34.223.66:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.195.57.222:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 141.159.3.110:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 123.47.177.230:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 75.205.207.225:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 203.47.35.219:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 16.32.155.76:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 71.230.41.90:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 89.236.238.45:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 191.116.83.109:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.150.72.68:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 79.100.10.49:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 63.90.196.237:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 1.47.237.168:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 24.203.202.159:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 14.43.226.88:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 133.154.82.138:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 212.106.200.83:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 242.199.116.94:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 109.41.25.131:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 188.202.234.143:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 44.22.235.208:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.170.12.134:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 177.20.119.179:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 65.154.27.204:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 103.228.34.20:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 107.162.41.136:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 94.202.144.218:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.29.102.134:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.44.93.146:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 164.18.126.251:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 46.114.92.73:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 117.194.106.72:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.20.74.94:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 194.106.180.86:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 203.253.118.63:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 161.73.138.238:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 105.117.134.75:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 203.52.203.21:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 149.49.56.56:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 82.146.72.161:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 123.25.180.74:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 167.203.138.180:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 240.95.69.47:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 188.61.45.175:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 197.161.132.135:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 113.63.41.2:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 163.138.46.101:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 156.155.134.86:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 39.2.78.238:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 253.32.137.207:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.65.62.122:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 46.101.135.231:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.75.153.48:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.58.86.152:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 106.194.116.196:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 144.96.68.42:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 110.66.66.249:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 207.132.230.1:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 178.245.109.13:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 247.12.167.208:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.202.34.229:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 119.39.203.138:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 105.19.137.151:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 79.61.188.119:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.123.44.186:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 243.201.37.202:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 161.250.248.163:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 216.147.232.81:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 83.76.125.231:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 201.50.106.53:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 60.208.44.19:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 124.40.130.184:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.18.180.82:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 241.86.77.222:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 113.169.230.241:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 221.91.185.53:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.192.186.63:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 164.195.131.72:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 252.48.251.231:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.228.50.125:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 209.74.180.245:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.143.209.209:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 115.87.26.187:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.5.148.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.186.179.78:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 76.191.18.1:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 58.247.240.220:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 2.120.93.205:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 143.10.215.127:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 204.177.50.133:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 151.172.90.99:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 196.125.239.227:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 85.193.218.121:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 202.40.116.171:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 122.169.81.93:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.0.242.213:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 66.205.57.37:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.172.85.11:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 68.167.150.138:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 90.187.77.141:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 84.229.136.98:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 169.141.173.18:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 60.254.214.224:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 80.144.87.148:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 197.20.39.250:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.115.27.233:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 104.238.124.5:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 104.94.246.110:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 207.221.33.56:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 247.169.245.228:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.239.235.114:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 102.122.22.104:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 173.78.105.237:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 4.132.76.47:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 93.164.134.199:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 170.95.59.17:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 107.128.56.246:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 141.138.41.190:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 1.47.65.195:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 95.26.161.126:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.115.223.235:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 155.55.209.30:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 145.74.167.117:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 40.128.86.153:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 13.199.244.123:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.66.145.188:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 199.111.82.113:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 113.159.206.187:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 202.5.25.208:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 202.110.97.82:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 175.189.99.59:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 167.204.174.162:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.66.100.4:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 120.133.46.43:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 204.71.12.81:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 142.231.228.15:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 133.244.241.88:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 125.30.244.76:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 59.75.111.235:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 162.202.157.183:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 116.197.203.133:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 58.245.27.30:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 217.93.188.182:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 254.158.104.104:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 39.194.130.98:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 218.11.204.225:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 243.135.215.211:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 74.229.236.239:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 78.157.110.58:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 44.141.188.56:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 191.156.144.113:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 126.41.55.13:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 212.2.29.50:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 9.188.62.22:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 241.7.213.181:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 141.96.66.16:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 205.212.104.65:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 107.209.174.44:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 197.49.206.102:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 120.188.225.228:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 130.236.200.133:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 180.46.34.47:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 34.163.141.37:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 148.115.93.174:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 88.123.12.95:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 161.182.131.154:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 171.43.194.133:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 150.48.0.95:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 218.252.99.94:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 20.218.88.63:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 173.245.62.37:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 197.50.127.242:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 124.136.155.171:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.117.6.226:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.42.67.235:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 125.44.182.148:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 163.74.169.243:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 210.171.147.183:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.94.103.110:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 81.251.158.124:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 69.129.108.181:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 148.126.112.155:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 203.143.207.139:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 65.26.50.188:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 110.21.73.75:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 42.152.164.128:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 130.29.72.252:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 107.73.253.203:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 78.30.130.90:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 64.252.161.186:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 135.65.184.199:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 104.243.64.247:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 164.105.172.212:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 220.191.144.149:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 76.16.56.205:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 14.72.58.18:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 115.106.57.156:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 209.149.183.174:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 111.227.254.71:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 186.253.79.149:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 66.215.122.237:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 103.99.195.202:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 245.250.50.13:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 86.157.148.55:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 101.48.29.171:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 106.94.178.175:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 18.218.200.140:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 179.231.160.255:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 188.203.97.13:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 71.218.159.69:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 67.242.144.165:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 156.133.93.78:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 48.128.165.210:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 78.241.45.206:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 187.32.180.102:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 159.3.126.103:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 165.130.199.225:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 103.175.65.243:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 154.218.139.189:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 180.249.153.94:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 195.189.5.50:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 35.85.69.28:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 130.223.249.142:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 17.114.70.75:2323
Source: global traffic TCP traffic: 192.168.2.15:30925 -> 18.115.239.74:2323
Sample listens on a socket
Source: /tmp/sYlwfFFwFb.elf (PID: 5538) Socket: 127.0.0.1::20905 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 16.106.112.35
Source: unknown TCP traffic detected without corresponding DNS query: 222.59.229.35
Source: unknown TCP traffic detected without corresponding DNS query: 87.178.68.53
Source: unknown TCP traffic detected without corresponding DNS query: 206.151.220.150
Source: unknown TCP traffic detected without corresponding DNS query: 161.100.4.213
Source: unknown TCP traffic detected without corresponding DNS query: 183.86.71.211
Source: unknown TCP traffic detected without corresponding DNS query: 44.144.64.128
Source: unknown TCP traffic detected without corresponding DNS query: 220.33.24.240
Source: unknown TCP traffic detected without corresponding DNS query: 187.216.20.113
Source: unknown TCP traffic detected without corresponding DNS query: 81.68.172.136
Source: unknown TCP traffic detected without corresponding DNS query: 246.21.66.37
Source: unknown TCP traffic detected without corresponding DNS query: 211.143.107.42
Source: unknown TCP traffic detected without corresponding DNS query: 96.23.120.97
Source: unknown TCP traffic detected without corresponding DNS query: 114.1.137.150
Source: unknown TCP traffic detected without corresponding DNS query: 125.31.176.186
Source: unknown TCP traffic detected without corresponding DNS query: 180.249.119.9
Source: unknown TCP traffic detected without corresponding DNS query: 185.83.194.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.189.196.73
Source: unknown TCP traffic detected without corresponding DNS query: 27.152.217.237
Source: unknown TCP traffic detected without corresponding DNS query: 218.104.169.134
Source: unknown TCP traffic detected without corresponding DNS query: 244.102.159.211
Source: unknown TCP traffic detected without corresponding DNS query: 98.203.25.230
Source: unknown TCP traffic detected without corresponding DNS query: 142.71.209.6
Source: unknown TCP traffic detected without corresponding DNS query: 253.125.19.136
Source: unknown TCP traffic detected without corresponding DNS query: 2.137.84.125
Source: unknown TCP traffic detected without corresponding DNS query: 38.4.7.158
Source: unknown TCP traffic detected without corresponding DNS query: 109.216.48.158
Source: unknown TCP traffic detected without corresponding DNS query: 159.206.116.95
Source: unknown TCP traffic detected without corresponding DNS query: 37.228.215.63
Source: unknown TCP traffic detected without corresponding DNS query: 17.39.181.242
Source: unknown TCP traffic detected without corresponding DNS query: 206.173.176.194
Source: unknown TCP traffic detected without corresponding DNS query: 63.240.32.128
Source: unknown TCP traffic detected without corresponding DNS query: 251.128.69.254
Source: unknown TCP traffic detected without corresponding DNS query: 211.112.103.195
Source: unknown TCP traffic detected without corresponding DNS query: 73.186.70.20
Source: unknown TCP traffic detected without corresponding DNS query: 217.144.5.24
Source: unknown TCP traffic detected without corresponding DNS query: 165.129.228.74
Source: unknown TCP traffic detected without corresponding DNS query: 246.248.207.113
Source: unknown TCP traffic detected without corresponding DNS query: 241.38.215.192
Source: unknown TCP traffic detected without corresponding DNS query: 211.66.48.10
Source: unknown TCP traffic detected without corresponding DNS query: 36.38.38.237
Source: unknown TCP traffic detected without corresponding DNS query: 19.77.67.217
Source: unknown TCP traffic detected without corresponding DNS query: 189.194.4.127
Source: unknown TCP traffic detected without corresponding DNS query: 153.206.101.2
Source: unknown TCP traffic detected without corresponding DNS query: 184.13.81.50
Source: unknown TCP traffic detected without corresponding DNS query: 114.145.44.114
Source: unknown TCP traffic detected without corresponding DNS query: 94.46.15.106
Source: unknown TCP traffic detected without corresponding DNS query: 54.17.71.246
Source: unknown TCP traffic detected without corresponding DNS query: 184.179.186.177
Source: unknown TCP traffic detected without corresponding DNS query: 169.16.71.231

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sYlwfFFwFb.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: sYlwfFFwFb.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: sYlwfFFwFb.elf PID: 5538, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sYlwfFFwFb.elf PID: 5542, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) SIGKILL sent: pid: 850, result: successful Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) SIGKILL sent: pid: 5369, result: successful Jump to behavior
Yara signature match
Source: sYlwfFFwFb.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: sYlwfFFwFb.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: sYlwfFFwFb.elf PID: 5538, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sYlwfFFwFb.elf PID: 5542, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal92.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/5540/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3881/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/5542/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1185/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3241/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3483/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1732/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1730/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1333/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1695/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3234/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/911/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/515/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/914/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1617/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1615/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/917/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3255/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3253/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1591/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3252/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3251/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3250/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1623/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3249/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/764/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3368/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1585/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3488/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/766/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/800/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/888/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/5544/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/802/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1509/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/803/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/804/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3800/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3801/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1867/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3407/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3802/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1484/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/490/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1514/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1634/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1479/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1875/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/654/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3379/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/655/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/656/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/777/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/931/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1595/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/657/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/812/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/779/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/658/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/933/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/418/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/419/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3419/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3310/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3275/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3274/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3273/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3394/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3272/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/782/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3303/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1762/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3027/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1486/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/789/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1806/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1660/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3044/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3440/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/793/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/794/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3316/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/674/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/796/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/675/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/676/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1498/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1497/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1496/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3157/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3278/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3399/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3799/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3712/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/1659/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/5474/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3332/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3210/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3298/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3055/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/3052/maps Jump to behavior
Source: /tmp/sYlwfFFwFb.elf (PID: 5545) File opened: /proc/680/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33830
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33832
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33834
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33838
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33840
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33844
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33846
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33850
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33852
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33856
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43780
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43784
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43798
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43820
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43830
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43842
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43856
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43862
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46964
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46978
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46990
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47000
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47008
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47036
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47042
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47048
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sYlwfFFwFb.elf (PID: 5538) Queries kernel information via 'uname': Jump to behavior
Source: sYlwfFFwFb.elf, 5538.1.000055b2dcd99000.000055b2dce1e000.rw-.sdmp, sYlwfFFwFb.elf, 5542.1.000055b2dcd99000.000055b2dce1e000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: sYlwfFFwFb.elf, 5538.1.000055b2dcd99000.000055b2dce1e000.rw-.sdmp, sYlwfFFwFb.elf, 5542.1.000055b2dcd99000.000055b2dce1e000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: sYlwfFFwFb.elf, 5538.1.00007ffea3511000.00007ffea3532000.rw-.sdmp, sYlwfFFwFb.elf, 5542.1.00007ffea3511000.00007ffea3532000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sYlwfFFwFb.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sYlwfFFwFb.elf
Source: sYlwfFFwFb.elf, 5538.1.00007ffea3511000.00007ffea3532000.rw-.sdmp, sYlwfFFwFb.elf, 5542.1.00007ffea3511000.00007ffea3532000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: sYlwfFFwFb.elf, type: SAMPLE
Source: Yara match File source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: sYlwfFFwFb.elf, type: SAMPLE
Source: Yara match File source: 5542.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5538.1.00007f76f8011000.00007f76f8027000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
145.155.255.155
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
122.249.144.174
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
100.163.223.215
 unknown United States
21928 T-MOBILE-AS21928US false
212.168.154.122
 unknown Germany
5669 VIA-NET-WORKS-ASUS false
36.172.162.119
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
146.128.11.229
 unknown United States
197938 TRAVIANGAMESDE false
203.120.137.163
 unknown Singapore
4628 PACIFICINTERNET-AS-APPacificInternetPteLtdSG false
124.225.111.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.236.205.139
 unknown United States
7922 COMCAST-7922US false
175.36.0.196
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
208.105.0.121
 unknown United States
12271 TWC-12271-NYCUS false
146.248.56.174
 unknown Switzerland
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
24.255.166.25
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
144.22.49.239
 unknown Costa Rica
64102 OracleCorporationCR false
207.137.79.203
 unknown United States
174 COGENT-174US false
19.197.165.19
 unknown United States
3 MIT-GATEWAYSUS false
23.36.14.145
 unknown United States
35994 AKAMAI-ASUS false
147.162.189.27
 unknown Italy
137 ASGARRConsortiumGARREU false
57.147.55.149
 unknown Belgium
2686 ATGS-MMD-ASUS false
81.235.23.41
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
203.207.38.161
 unknown Taiwan; Republic of China (ROC)
24155 APBW-AS-TWAsiaPacificBroadbandWirelessCommunicationsIn false
216.40.58.2
 unknown United States
18523 CHEP-AS1US false
94.128.36.113
 unknown Kuwait
47589 KTC3GKW false
99.96.36.137
 unknown United States
7018 ATT-INTERNET4US false
39.106.110.74
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
91.223.243.40
 unknown Estonia
9130 HMS-ASRU false
19.94.30.244
 unknown United States
3 MIT-GATEWAYSUS false
119.67.50.131
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
136.32.207.14
 unknown United States
16591 GOOGLE-FIBERUS false
193.206.84.170
 unknown Italy
137 ASGARRConsortiumGARREU false
114.122.72.245
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
222.50.224.20
 unknown China
38370 CTTNETChinaTieTongTelecommunicationsCorporationCN false
189.233.26.127
 unknown Mexico
8151 UninetSAdeCVMX false
122.157.158.95
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
154.27.158.201
 unknown United States
32708 ROOTNETWORKSUS false
16.60.141.52
 unknown United States
unknown unknown false
9.64.243.95
 unknown United States
3356 LEVEL3US false
23.44.156.67
 unknown United States
16625 AKAMAI-ASUS false
105.167.98.144
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
90.228.7.14
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
111.24.180.241
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
35.68.160.54
 unknown United States
237 MERIT-AS-14US false
141.36.138.37
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
161.60.167.63
 unknown United States
28024 NuevatelPCSdeBoliviaSABO false
112.113.215.222
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
217.80.47.219
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
219.179.87.96
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
123.157.211.207
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
200.28.64.233
 unknown Chile
7418 TELEFONICACHILESACL false
108.135.99.95
 unknown United States
16509 AMAZON-02US false
115.13.178.126
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
250.51.125.65
 unknown Reserved
unknown unknown false
162.118.164.97
 unknown United States
54004 OPTIMUM-WIFI2US false
14.33.47.218
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
208.255.76.224
 unknown United States
11486 COLO-PREM-VZBUS false
162.114.123.192
 unknown United States
10921 KIHNETWORKUS false
117.46.46.117
 unknown Japan 4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
96.209.148.223
 unknown United States
7922 COMCAST-7922US false
44.114.179.252
 unknown United States
7377 UCSDUS false
190.0.12.246
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
66.0.222.71
 unknown United States
7029 WINDSTREAMUS false
13.219.95.246
 unknown United States
16509 AMAZON-02US false
222.4.245.75
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
198.15.50.168
 unknown Australia
53823 SMTAUS false
98.229.39.176
 unknown United States
7922 COMCAST-7922US false
155.135.68.72
 unknown United States
2152 CSUNET-NWUS false
179.158.195.248
 unknown Brazil
28573 CLAROSABR false
72.194.18.202
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
106.70.232.100
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
170.121.203.218
 unknown United States
17190 WMATAUS false
247.4.124.150
 unknown Reserved
unknown unknown false
65.243.5.148
 unknown United States
701 UUNETUS false
103.227.88.109
 unknown Hong Kong
134078 NETPLUZ-AS-APNETPLUZHOLDINGSPRIVATELIMITEDSG false
32.174.55.218
 unknown United States
2686 ATGS-MMD-ASUS false
136.67.15.243
 unknown United States
60311 ONEFMCH false
155.161.132.179
 unknown United States
7726 FITC-ASUS false
210.35.196.46
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
213.174.240.235
 unknown Austria
28760 INFOTECH-AT-ASSchaerdingerstr35AT false
122.148.156.35
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
150.60.198.82
 unknown Japan 9597 CPI-NETKDDIWebCommunicationsIncJP false
47.22.179.51
 unknown United States
6128 CABLE-NET-1US false
160.232.44.191
 unknown United States
11259 ANGOLATELECOMAO false
206.116.126.246
 unknown Canada
852 ASN852CA false
165.186.106.195
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
190.59.122.171
 unknown Trinidad and Tobago
5639 TelecommunicationServicesofTrinidadandTobagoTT false
166.30.87.36
 unknown United States
206 CSC-IGN-AMERUS false
194.91.203.62
 unknown Japan 9597 CPI-NETKDDIWebCommunicationsIncJP false
16.169.52.230
 unknown United States
unknown unknown false
13.76.64.165
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
213.7.29.116
 unknown Cyprus
6866 CYTA-NETWORKInternetServicesCY false
75.27.117.86
 unknown United States
7018 ATT-INTERNET4US false
180.166.5.102
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
157.105.38.113
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
218.71.71.211
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
212.10.113.188
 unknown Denmark
197288 STOFANETDK false
2.160.99.144
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
91.133.239.15
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
8.47.122.20
 unknown United States
13335 CLOUDFLARENETUS false
74.175.250.129
 unknown United States
7018 ATT-INTERNET4US false
79.184.13.208
 unknown Poland
5617 TPNETPL false