Linux Analysis Report
tL98mBWW8p.elf

Overview

General Information

Sample name: tL98mBWW8p.elf
renamed because original name is a hash value
Original sample name: 5c0a8a65c31299866102c45cac07a6a8.elf
Analysis ID: 1426700
MD5: 5c0a8a65c31299866102c45cac07a6a8
SHA1: 645610afc3217da7b6d28377c8b7de791af701f8
SHA256: 6473c4b0d9fc3edf5a6f0acdc38c8884e7ab598cdbe697e4ecc36b062e20e197
Tags: 32elfmirairenesas
Infos:

Detection

Mirai
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection

barindex
Source: tL98mBWW8p.elf Avira: detected
Source: tL98mBWW8p.elf ReversingLabs: Detection: 56%

Networking

barindex
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:54712 -> 69.1.13.38:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:56110 -> 118.32.19.69:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:45034 -> 186.7.17.32:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:45058 -> 186.7.17.32:23
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56044
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56064
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56084
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56088
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56094
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56108
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40542
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57890
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40554
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57906
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57916
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57924
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57934
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57952
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40586
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 77.152.110.209:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 248.181.200.215:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 120.37.126.193:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 171.104.1.185:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 93.7.24.227:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 5.58.69.180:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 175.194.115.41:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 211.150.149.158:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 193.183.69.103:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 174.28.153.247:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 178.207.57.195:2323
Source: global traffic TCP traffic: 192.168.2.13:57640 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.226.111.173:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 244.180.111.236:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 213.204.228.27:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 83.135.123.179:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 71.236.98.155:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 150.45.105.203:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 166.41.9.159:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 80.46.218.207:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 61.248.226.57:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 75.73.89.211:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 47.99.134.32:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 123.140.47.112:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 164.117.53.145:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 100.134.142.7:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 63.25.239.155:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 93.10.163.5:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 8.46.247.102:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 121.254.14.61:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 65.219.137.58:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 182.218.159.175:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 219.13.136.111:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 70.224.79.175:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 23.229.212.220:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 42.70.188.87:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 66.255.11.157:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 168.23.33.88:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 103.220.159.8:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 107.16.234.53:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 75.62.166.237:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 58.238.135.163:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 94.55.64.16:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 168.220.177.105:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 175.183.1.174:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 99.234.111.159:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.129.196.142:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 119.104.223.24:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 213.142.235.2:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 60.148.185.92:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 254.182.226.104:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 191.244.69.157:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 251.46.62.160:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 251.186.220.82:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 120.56.49.228:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 213.85.166.47:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 58.110.156.235:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.151.0.226:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 156.204.26.183:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 184.153.238.163:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 42.82.214.226:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 191.36.164.141:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 154.227.0.213:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.184.88.146:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 82.154.16.248:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 62.222.110.118:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 124.171.101.244:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 217.86.160.228:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 216.119.9.58:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 31.215.192.213:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 83.92.107.123:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.193.122.140:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 81.176.186.254:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 103.73.239.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 120.114.122.133:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 85.111.128.124:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.163.198.231:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.164.191.52:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 196.83.198.173:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 189.57.133.187:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 248.83.44.142:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 120.102.110.167:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 255.136.67.205:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 141.202.71.28:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 119.152.215.145:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 123.80.246.62:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 252.90.135.67:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.79.177.122:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 48.254.184.33:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 164.246.105.38:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 35.133.251.139:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 104.73.24.126:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 61.186.180.69:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 135.240.84.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 185.199.231.7:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 184.43.112.9:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 2.185.213.170:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 202.137.68.175:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 254.190.178.136:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 102.184.52.193:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 23.112.123.122:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.171.136.217:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 197.217.62.101:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 186.238.213.127:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 47.251.90.90:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 216.70.47.171:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 124.171.54.152:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.66.136.225:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 40.56.104.103:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 47.85.70.34:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 115.8.165.248:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 135.84.207.156:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 180.222.35.219:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 102.70.62.105:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 176.102.159.14:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 174.88.115.47:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 167.247.147.252:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.119.188.146:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 38.30.98.50:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 91.183.145.106:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 166.30.208.3:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 84.99.203.195:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.142.92.49:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 148.154.14.1:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 205.139.207.148:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 250.58.60.95:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 34.68.172.33:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 120.242.52.211:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.126.235.169:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 121.131.253.231:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 151.25.111.89:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 77.134.196.78:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 209.231.42.236:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 152.244.223.58:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 206.153.139.17:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 189.87.128.231:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 104.181.163.103:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 188.23.164.177:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 79.252.202.23:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.2.85.89:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 98.240.148.102:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 36.235.123.85:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 17.166.93.151:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 112.190.69.110:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.246.88.236:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 94.81.23.200:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 78.16.254.196:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 162.192.244.163:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.246.15.62:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 157.14.127.69:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 1.167.220.105:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 100.179.2.179:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 200.95.22.159:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 201.31.142.21:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.33.116.224:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 41.233.4.105:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 1.159.32.147:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 99.92.14.19:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 166.173.112.52:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 160.240.205.188:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 88.159.93.83:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 135.48.182.101:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 68.159.134.190:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 210.247.70.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 199.7.175.88:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 40.6.78.225:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 197.255.127.63:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 191.171.188.59:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 17.75.214.253:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 140.215.213.29:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 161.238.57.112:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 241.173.151.192:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 163.58.240.36:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 142.166.140.202:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 252.62.248.166:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 123.169.189.144:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 13.222.233.1:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 196.182.75.218:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 107.198.146.221:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 76.190.77.178:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 57.175.89.44:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 186.62.168.88:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 245.9.55.231:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.210.200.181:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 116.175.71.171:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 144.62.200.192:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 108.158.183.233:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 116.209.241.11:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 102.17.191.31:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 111.115.8.9:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 122.143.117.153:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.183.231.209:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 121.205.66.47:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 89.221.86.165:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 245.176.106.249:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 180.234.173.52:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 97.129.10.62:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 254.108.108.106:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 200.178.195.132:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 82.119.40.249:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 19.205.196.42:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 125.37.205.142:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.160.246.142:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 59.197.215.91:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 71.93.160.101:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 95.62.187.72:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 141.147.36.69:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 36.64.226.187:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 181.82.19.24:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 126.239.5.164:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 81.98.165.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 24.170.172.118:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 9.1.121.34:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 73.110.89.174:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 48.38.122.55:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 158.78.127.5:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 20.39.185.150:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 221.185.234.98:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 113.97.203.29:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 163.207.143.130:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 201.129.53.229:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 181.218.10.116:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 75.96.165.39:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 58.0.18.80:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 19.88.205.19:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 219.197.138.62:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 107.156.215.85:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 242.134.112.109:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 88.48.6.198:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 61.190.250.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 197.158.176.187:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 155.175.182.148:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 128.31.50.241:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 125.24.191.146:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 112.150.20.101:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 31.185.213.236:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 61.123.42.5:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 43.193.90.119:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 218.233.230.153:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 243.84.245.14:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 251.58.97.57:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 145.193.202.73:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.150.236.124:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.175.103.232:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 165.79.151.126:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 59.70.248.184:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 247.173.110.41:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 79.251.140.72:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 173.163.211.123:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 187.34.156.165:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 71.211.220.215:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 78.8.17.184:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.48.67.235:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 243.238.109.149:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 167.74.91.220:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 35.207.177.220:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 24.9.213.67:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.141.28.242:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 53.235.65.205:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 245.111.55.211:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 8.232.43.26:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 180.23.39.160:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 175.158.106.189:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 198.43.53.57:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 27.248.228.58:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 48.204.79.253:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.122.237.23:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 39.75.170.239:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 149.46.181.33:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 73.159.27.119:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 170.112.70.91:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 199.54.233.238:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 195.117.212.19:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 54.133.233.65:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 63.38.138.77:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 75.26.245.205:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 189.182.147.49:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 154.203.148.44:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 46.246.84.222:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 242.171.240.124:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 250.4.35.124:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 58.198.59.5:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 103.147.65.137:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 198.61.49.250:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 124.121.176.245:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 170.168.165.43:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 145.188.214.95:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 89.237.89.76:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.181.156.232:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 40.140.61.253:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 45.40.69.22:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 80.234.19.95:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 152.171.145.34:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 97.23.152.233:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 93.86.85.179:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 171.68.36.170:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 149.104.146.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 111.137.71.112:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 108.184.122.10:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 117.53.197.26:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 19.191.127.133:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 150.88.34.168:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 92.39.105.250:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 100.187.5.23:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 175.240.127.198:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 100.137.179.180:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 72.106.12.141:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 210.3.65.39:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 181.184.137.243:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 208.19.205.185:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 150.195.229.219:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 186.210.97.173:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 117.153.129.243:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 250.119.43.48:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 27.231.34.145:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 202.31.191.79:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 184.175.202.235:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 32.212.136.178:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 85.101.55.214:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 9.240.201.24:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 32.2.247.106:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.104.149.49:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 208.175.137.227:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 175.165.252.122:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 8.193.225.244:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 20.139.84.45:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 202.222.24.148:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 39.16.3.165:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 148.35.207.225:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 38.116.8.222:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 178.220.225.162:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.31.26.137:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 2.78.40.133:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 99.122.25.89:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 160.159.15.21:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 1.33.56.53:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 91.104.69.136:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 209.9.57.244:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.124.211.102:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 13.215.186.154:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 141.102.47.234:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 161.249.112.172:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 99.207.208.202:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 150.119.98.11:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 115.71.190.191:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 122.115.129.195:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.192.95.185:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 91.205.209.180:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 240.172.135.7:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 87.4.217.126:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 80.207.29.187:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 223.97.137.88:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 70.26.133.21:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 87.181.178.82:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 70.217.36.32:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 13.139.141.158:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 146.85.155.172:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 101.27.96.51:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 109.49.102.49:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 63.238.39.57:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 195.236.220.244:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 113.142.33.7:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 58.241.183.185:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 174.61.239.231:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 162.186.121.145:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 157.142.12.140:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 141.55.86.159:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 38.200.153.81:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 159.145.135.41:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 96.80.113.130:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 98.237.161.190:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 96.157.41.24:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 76.158.48.3:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.210.85.123:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 202.17.207.119:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 104.103.140.190:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 98.191.209.252:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 119.238.216.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 247.197.186.215:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 70.24.47.186:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 198.9.255.214:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 119.248.213.205:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 183.167.149.241:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 164.208.185.57:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 190.225.231.70:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 39.124.39.46:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 14.98.236.113:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 80.18.23.219:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 207.249.117.203:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 109.82.26.183:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 177.49.47.104:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 110.60.124.192:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 77.145.35.74:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 2.74.135.167:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 48.90.14.42:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 254.71.111.136:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 223.210.193.189:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 217.198.185.250:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 74.191.138.223:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 91.152.21.149:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 99.16.196.227:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 42.210.97.114:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 150.255.91.106:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 154.94.151.169:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 223.134.94.171:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 34.2.205.47:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 93.192.56.203:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 88.211.164.21:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 136.88.69.125:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 212.39.215.31:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 204.91.67.254:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 47.12.54.31:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 59.197.35.44:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 38.72.8.235:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 155.207.82.225:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 109.182.150.54:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 151.223.214.181:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 61.126.183.207:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 155.246.129.197:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 67.212.32.126:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 39.147.189.152:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 204.175.183.210:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 253.186.183.152:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 218.190.128.142:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 240.141.58.14:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 246.54.112.102:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 148.50.9.127:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 249.240.138.137:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 133.99.187.156:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 174.78.24.91:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 9.77.144.108:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 60.102.31.222:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 187.57.12.19:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 161.101.121.150:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 77.58.188.122:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 12.225.39.202:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 122.197.133.15:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 211.211.161.106:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 176.56.95.82:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 44.225.220.123:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 219.199.90.22:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 179.38.230.9:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 163.233.148.187:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 105.150.144.13:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 223.59.23.153:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 97.24.205.234:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 27.235.154.52:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 53.185.124.242:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 220.130.10.255:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 16.129.128.127:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 63.30.25.36:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 222.182.104.15:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 223.98.83.220:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 84.48.212.198:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 24.150.224.28:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 114.8.178.80:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 40.225.25.9:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 149.33.80.230:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 159.58.228.213:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 206.2.36.140:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 126.218.42.189:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 97.166.28.175:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 62.172.166.235:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 40.15.222.149:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 93.79.190.241:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 12.105.60.145:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 208.74.218.186:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 155.41.148.65:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 75.210.85.46:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 88.239.181.83:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 90.153.136.62:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 114.16.233.113:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 105.209.62.10:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 117.222.37.28:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 5.221.55.105:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 111.161.143.61:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 159.165.120.15:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 169.218.219.11:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 218.140.184.143:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 244.135.185.230:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 125.71.203.64:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 59.2.59.135:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 124.188.38.87:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 219.184.181.237:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 71.80.95.27:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 198.15.81.249:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 197.41.161.190:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 254.230.23.185:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 212.8.33.121:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 114.89.44.55:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 65.133.31.190:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 86.204.98.125:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 37.106.18.73:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 44.212.150.58:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 135.206.69.186:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 54.134.35.229:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 152.180.62.123:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 199.26.151.108:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 188.196.34.79:2323
Source: global traffic TCP traffic: 192.168.2.13:19749 -> 162.112.193.83:2323
Source: /tmp/tL98mBWW8p.elf (PID: 5424) Socket: 127.0.0.1::20905 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 206.55.218.149
Source: unknown TCP traffic detected without corresponding DNS query: 105.178.162.63
Source: unknown TCP traffic detected without corresponding DNS query: 45.238.188.223
Source: unknown TCP traffic detected without corresponding DNS query: 92.51.250.114
Source: unknown TCP traffic detected without corresponding DNS query: 106.253.156.195
Source: unknown TCP traffic detected without corresponding DNS query: 42.24.171.29
Source: unknown TCP traffic detected without corresponding DNS query: 248.11.206.109
Source: unknown TCP traffic detected without corresponding DNS query: 65.5.230.140
Source: unknown TCP traffic detected without corresponding DNS query: 99.25.89.237
Source: unknown TCP traffic detected without corresponding DNS query: 248.181.200.215
Source: unknown TCP traffic detected without corresponding DNS query: 145.182.1.148
Source: unknown TCP traffic detected without corresponding DNS query: 81.98.203.209
Source: unknown TCP traffic detected without corresponding DNS query: 156.52.63.13
Source: unknown TCP traffic detected without corresponding DNS query: 8.77.252.30
Source: unknown TCP traffic detected without corresponding DNS query: 182.184.66.33
Source: unknown TCP traffic detected without corresponding DNS query: 116.5.233.189
Source: unknown TCP traffic detected without corresponding DNS query: 118.240.68.67
Source: unknown TCP traffic detected without corresponding DNS query: 93.66.101.58
Source: unknown TCP traffic detected without corresponding DNS query: 120.37.126.193
Source: unknown TCP traffic detected without corresponding DNS query: 75.203.26.226
Source: unknown TCP traffic detected without corresponding DNS query: 173.122.70.218
Source: unknown TCP traffic detected without corresponding DNS query: 192.53.205.72
Source: unknown TCP traffic detected without corresponding DNS query: 212.86.89.241
Source: unknown TCP traffic detected without corresponding DNS query: 250.32.191.192
Source: unknown TCP traffic detected without corresponding DNS query: 115.180.58.204
Source: unknown TCP traffic detected without corresponding DNS query: 106.240.28.199
Source: unknown TCP traffic detected without corresponding DNS query: 171.104.1.185
Source: unknown TCP traffic detected without corresponding DNS query: 243.127.31.196
Source: unknown TCP traffic detected without corresponding DNS query: 86.130.58.35
Source: unknown TCP traffic detected without corresponding DNS query: 133.235.31.34
Source: unknown TCP traffic detected without corresponding DNS query: 24.67.132.251
Source: unknown TCP traffic detected without corresponding DNS query: 4.165.243.234
Source: unknown TCP traffic detected without corresponding DNS query: 35.227.93.232
Source: unknown TCP traffic detected without corresponding DNS query: 143.16.78.109
Source: unknown TCP traffic detected without corresponding DNS query: 248.152.3.236
Source: unknown TCP traffic detected without corresponding DNS query: 93.7.24.227
Source: unknown TCP traffic detected without corresponding DNS query: 115.58.156.67
Source: unknown TCP traffic detected without corresponding DNS query: 179.140.150.159
Source: unknown TCP traffic detected without corresponding DNS query: 212.138.227.178
Source: unknown TCP traffic detected without corresponding DNS query: 101.50.144.127
Source: unknown TCP traffic detected without corresponding DNS query: 135.36.152.144
Source: unknown TCP traffic detected without corresponding DNS query: 95.187.220.226
Source: unknown TCP traffic detected without corresponding DNS query: 148.103.146.244
Source: unknown TCP traffic detected without corresponding DNS query: 82.105.53.136
Source: unknown TCP traffic detected without corresponding DNS query: 5.58.69.180
Source: unknown TCP traffic detected without corresponding DNS query: 97.252.190.138
Source: unknown TCP traffic detected without corresponding DNS query: 211.212.178.229
Source: unknown TCP traffic detected without corresponding DNS query: 174.69.55.183
Source: unknown TCP traffic detected without corresponding DNS query: 158.21.52.188
Source: unknown TCP traffic detected without corresponding DNS query: 195.134.105.245
Source: unknown Network traffic detected: HTTP traffic on port 57332 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57332

System Summary

barindex
Source: tL98mBWW8p.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: tL98mBWW8p.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: tL98mBWW8p.elf PID: 5424, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: tL98mBWW8p.elf PID: 5428, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: ELF static info symbol of initial sample .symtab present: no
Source: /tmp/tL98mBWW8p.elf (PID: 5432) SIGKILL sent: pid: 855, result: successful Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) SIGKILL sent: pid: 5262, result: successful Jump to behavior
Source: tL98mBWW8p.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: tL98mBWW8p.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: tL98mBWW8p.elf PID: 5424, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: tL98mBWW8p.elf PID: 5428, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal92.troj.linELF@0/1@0/0
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/5262/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3122/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3117/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3114/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/914/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/518/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/519/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/917/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3375/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3132/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3095/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1745/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1866/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/884/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1982/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/765/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/767/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/800/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1906/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/802/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/803/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/5426/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1748/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/5429/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1482/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/490/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1480/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1755/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1238/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1875/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2964/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3413/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1751/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1872/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2961/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1475/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/656/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/778/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/657/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/658/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/659/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/418/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/936/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/419/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/816/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1879/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1891/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3310/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3153/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/780/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/660/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1921/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/783/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1765/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2974/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1400/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1884/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3424/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2972/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3147/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2970/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1881/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3146/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3300/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1805/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1925/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1804/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1648/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1922/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3429/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3442/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3165/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3164/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3163/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3162/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/790/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3161/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/792/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/793/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/672/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1930/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/674/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/795/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3315/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1411/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/2984/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1410/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/797/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/676/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3434/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3158/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/678/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/679/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3170/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/680/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3208/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3327/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3448/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/1940/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/3203/maps Jump to behavior
Source: /tmp/tL98mBWW8p.elf (PID: 5432) File opened: /proc/726/maps Jump to behavior
Source: /usr/bin/dash (PID: 5500) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3mcvMsUqZ8 /tmp/tmp.zYNmMV54Hy /tmp/tmp.QEeOR5imC3 Jump to behavior
Source: /usr/bin/dash (PID: 5501) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3mcvMsUqZ8 /tmp/tmp.zYNmMV54Hy /tmp/tmp.QEeOR5imC3 Jump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56044
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56064
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56084
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56088
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56094
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56098
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56108
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57746
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57864
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40542
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57876
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57890
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40554
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57906
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57916
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57924
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57934
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57952
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 40586
Source: /tmp/tL98mBWW8p.elf (PID: 5424) Queries kernel information via 'uname': Jump to behavior
Source: tL98mBWW8p.elf, 5424.1.00007ffe0aeee000.00007ffe0af0f000.rw-.sdmp, tL98mBWW8p.elf, 5428.1.00007ffe0aeee000.00007ffe0af0f000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: tL98mBWW8p.elf, 5424.1.000055991c7e2000.000055991c845000.rw-.sdmp, tL98mBWW8p.elf, 5428.1.000055991c7e2000.000055991c845000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: tL98mBWW8p.elf, 5424.1.000055991c7e2000.000055991c845000.rw-.sdmp, tL98mBWW8p.elf, 5428.1.000055991c7e2000.000055991c845000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: tL98mBWW8p.elf, 5424.1.00007ffe0aeee000.00007ffe0af0f000.rw-.sdmp, tL98mBWW8p.elf, 5428.1.00007ffe0aeee000.00007ffe0af0f000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/tL98mBWW8p.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tL98mBWW8p.elf

Stealing of Sensitive Information

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: tL98mBWW8p.elf, type: SAMPLE
Source: Yara match File source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY

Remote Access Functionality

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: tL98mBWW8p.elf, type: SAMPLE
Source: Yara match File source: 5424.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5428.1.00007fa300400000.00007fa300413000.r-x.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs