Linux Analysis Report
zfehGxWbb4.elf

Overview

General Information

Sample name: zfehGxWbb4.elf
renamed because original name is a hash value
Original sample name: 8f6057d0c7aad5019ceebd394faccdc1.elf
Analysis ID: 1426701
MD5: 8f6057d0c7aad5019ceebd394faccdc1
SHA1: 1e3d9a6f08fbc8bc4d76a67cd15f9b9def20b6ab
SHA256: b908cfa9989fff008ce8f8dbc10582f91dc8ed29aad0940a3af90de2443c98de
Tags: 32elfmiraimotorola
Infos:

Detection

Mirai
Score: 84
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: zfehGxWbb4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: zfehGxWbb4.elf ReversingLabs: Detection: 60%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:47484 -> 220.178.41.38:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:36298 -> 178.206.124.239:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55712
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55772
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55848
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55988
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56024
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56030
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56058
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56068
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52530
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52582
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52594
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52608
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52730
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:37836 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 221.226.41.212:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 17.186.110.71:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 141.34.51.116:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 77.240.168.209:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 71.174.144.220:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 16.80.98.78:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 153.243.239.63:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 2.89.101.176:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 217.125.190.254:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 96.165.123.171:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 43.46.168.154:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 159.239.46.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 12.243.44.148:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 222.195.231.110:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.78.60.37:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 133.189.221.170:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 144.31.167.103:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.152.177.211:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 148.6.169.50:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 105.99.212.58:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 247.253.30.193:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 155.194.76.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 63.151.245.35:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 142.58.68.228:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 207.146.69.210:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 206.25.94.235:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 223.169.134.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 162.241.182.134:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 61.227.5.5:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 106.149.42.17:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 37.23.137.60:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 121.171.196.92:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 197.8.93.127:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 204.2.114.215:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 200.238.194.62:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 179.22.142.172:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 182.90.9.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 101.194.50.131:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 182.156.70.180:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 107.89.138.93:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 211.253.165.140:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 186.172.101.92:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 76.103.181.190:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 124.202.238.21:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 62.1.70.90:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 47.17.203.69:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 220.83.194.7:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 75.79.86.107:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 158.42.114.62:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 122.22.38.60:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 31.173.36.234:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 93.27.140.107:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 102.25.223.76:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 92.103.139.254:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.253.233.102:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 244.9.114.231:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 187.246.40.6:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.153.18.6:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 103.133.143.45:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 153.235.26.255:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 177.18.48.40:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 40.189.182.128:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 99.193.197.39:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 92.162.89.60:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 135.41.186.92:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 181.202.26.203:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 168.32.16.80:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 141.207.217.24:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 23.7.88.192:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.230.227.186:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 174.128.193.54:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 71.72.180.124:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 154.15.63.172:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 89.34.242.83:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 37.153.216.145:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 19.243.167.208:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 177.68.157.37:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 244.68.241.114:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 24.16.193.17:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 87.249.31.234:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 81.62.57.241:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 223.137.190.160:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.215.173.251:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.167.49.234:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.37.48.123:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 110.89.74.181:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 178.218.146.152:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 205.124.234.136:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 66.195.147.10:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 186.26.176.196:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 216.117.178.232:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 24.198.176.129:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 173.67.171.3:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 4.68.106.56:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 75.36.38.218:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 34.208.49.194:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.113.226.140:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 154.3.40.99:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 85.178.118.120:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 94.89.180.71:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 17.4.146.2:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 249.245.16.194:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 4.130.96.76:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 221.155.27.98:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 27.113.2.148:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 103.119.222.133:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 125.55.135.142:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 103.2.64.124:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 240.36.207.104:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 141.119.121.129:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 185.122.175.161:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 223.167.39.24:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 179.134.53.196:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 35.106.59.81:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 134.244.204.251:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 88.52.220.18:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 222.233.136.21:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 78.104.26.105:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 40.97.94.82:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 184.193.112.16:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 219.5.246.104:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 19.134.194.129:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 59.70.47.10:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 108.168.63.146:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 166.113.176.132:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 191.122.33.221:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 221.42.144.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 252.14.64.45:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 60.122.216.95:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 17.194.198.34:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 19.205.152.254:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.213.41.116:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 119.201.230.126:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 163.79.199.241:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 111.95.77.8:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.178.130.165:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 187.181.167.28:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 95.78.70.136:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 206.186.18.11:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 152.199.140.226:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 2.161.7.77:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 173.111.110.192:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 211.87.148.141:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 164.212.54.215:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 73.229.58.56:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 142.49.71.228:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 108.44.212.196:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 42.113.9.166:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 19.232.101.14:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.183.28.184:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 41.113.166.71:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 125.150.115.197:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 161.18.254.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 184.143.194.11:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 104.228.3.174:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.78.50.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 139.164.160.54:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 171.18.27.10:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 162.96.30.141:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 45.48.141.26:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 114.90.172.20:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 143.22.236.222:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 9.191.210.195:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 1.244.152.102:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 250.0.5.97:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 114.79.174.85:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 190.98.151.158:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 150.20.93.130:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 169.249.25.15:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 141.41.133.253:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 98.34.176.254:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 93.89.155.206:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 111.27.133.225:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 152.94.78.240:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 60.118.253.91:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 20.42.253.25:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 106.98.17.188:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 23.184.110.33:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 189.221.110.69:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 106.85.114.49:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 159.54.106.94:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 12.76.134.122:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 240.71.34.55:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 95.65.191.143:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 79.166.174.134:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 92.97.118.138:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 107.137.2.65:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.66.136.45:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 119.169.92.222:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 13.179.247.216:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 146.137.138.219:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 220.177.64.42:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 61.110.159.177:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 18.127.167.56:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.130.22.108:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 92.221.112.53:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 98.27.79.67:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 210.198.213.171:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.179.27.95:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 117.32.70.56:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 171.233.63.125:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 169.222.168.4:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 153.203.51.168:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 207.85.111.232:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 196.240.126.19:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 155.137.111.33:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 206.46.43.50:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 27.26.86.85:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 60.123.194.140:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 210.77.25.162:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 79.48.87.4:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 217.201.30.114:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 155.122.82.118:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 123.231.245.51:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 124.64.250.50:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 245.92.111.214:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 116.10.187.75:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 122.51.30.203:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 99.101.172.244:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 111.38.5.105:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 9.108.144.23:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 146.1.73.126:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.194.112.107:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 189.221.140.193:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 119.229.243.166:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 170.163.252.174:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 208.171.27.192:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 89.64.204.217:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 208.27.11.42:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 109.162.243.45:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 87.16.214.96:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 252.208.16.161:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.2.24.22:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 8.76.88.69:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 119.63.255.44:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.104.109.189:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 155.211.99.107:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 123.15.195.118:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 16.46.187.219:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 209.147.96.43:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 146.66.59.24:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 57.152.247.225:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 209.202.93.30:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 95.148.122.234:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.0.191.136:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 79.68.10.66:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.199.153.206:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 161.9.1.68:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 115.19.36.171:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 216.46.85.77:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 85.171.252.194:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 142.222.112.231:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 5.216.17.184:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 147.9.80.252:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 48.175.236.105:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 47.88.29.22:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 72.55.215.123:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 151.102.188.168:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 46.91.94.40:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 20.16.41.250:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 185.90.186.34:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 18.139.169.204:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 222.252.14.46:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 85.140.176.104:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 67.39.213.222:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 72.68.206.97:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 43.181.5.63:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 67.121.110.233:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 217.27.93.178:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 183.145.166.44:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.109.244.109:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 138.201.155.246:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 142.94.184.37:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 72.181.174.97:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 248.47.151.63:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 213.210.53.203:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 244.102.223.28:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 197.232.33.194:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 71.148.184.224:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 169.60.145.29:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 18.168.50.164:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 147.146.169.120:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 73.195.107.92:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 119.47.116.72:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 109.133.255.87:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 115.12.248.203:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 37.95.241.198:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 195.135.123.242:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 112.199.255.188:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 27.151.196.75:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 85.148.40.41:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 218.230.108.59:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 44.35.136.46:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 169.4.178.68:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 210.46.13.250:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 143.29.23.232:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 86.74.82.240:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 115.50.150.36:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 167.22.160.233:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 48.182.133.115:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 64.30.99.75:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.15.183.61:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 60.42.185.214:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 66.167.178.133:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 69.38.236.183:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 180.58.72.3:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 39.82.28.157:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.36.174.195:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 161.179.148.210:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 163.25.27.1:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 193.129.191.199:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.131.63.96:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 65.245.200.205:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 126.114.176.101:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.217.165.245:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 80.43.144.103:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 209.245.23.156:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 118.20.184.28:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 133.63.33.155:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 163.255.131.113:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 190.232.156.144:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 76.166.78.222:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.0.6.128:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 178.20.67.65:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 209.54.236.70:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 61.80.110.154:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 205.159.79.7:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 116.32.106.2:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 205.159.240.96:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 242.111.129.154:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 210.214.175.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 191.139.22.251:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 110.183.90.106:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 84.233.162.213:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 99.229.211.147:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 40.225.208.136:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 48.151.40.101:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 201.78.55.36:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.255.233.251:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 218.92.67.101:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 75.129.238.108:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 183.75.110.228:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 27.155.221.132:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 242.53.200.17:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.46.171.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 37.113.218.124:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 8.245.223.184:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 78.65.106.132:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 108.238.107.153:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 117.5.201.65:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 69.246.174.179:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 186.81.249.158:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 178.110.102.225:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 155.90.39.110:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 97.255.102.208:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 147.8.10.51:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 212.64.141.176:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 198.180.213.234:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 68.198.155.152:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 36.224.207.225:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 165.236.165.69:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 36.116.47.20:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 195.168.45.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 176.26.42.66:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 61.5.81.219:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 42.246.119.133:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 158.23.168.0:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 222.38.222.39:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 47.63.221.75:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 223.66.64.206:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 20.147.182.127:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 249.110.18.134:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 103.218.87.186:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 112.240.39.59:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 36.215.34.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 76.17.72.217:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 148.121.68.202:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 48.176.125.124:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 12.63.134.62:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 45.190.172.253:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 136.248.205.170:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 146.60.107.84:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 113.22.22.243:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 219.74.210.174:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 253.130.136.139:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 118.233.202.83:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 255.169.146.123:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.124.213.200:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 12.254.138.94:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 189.232.86.101:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 197.245.239.250:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 241.123.106.249:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 212.186.93.55:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 108.2.249.204:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.172.239.144:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 124.96.113.110:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 163.244.28.159:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 34.138.187.41:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 171.67.198.49:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 104.232.113.175:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.215.183.67:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 42.192.222.243:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 130.200.238.51:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 46.114.67.203:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 254.117.41.80:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.139.76.38:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 200.108.64.91:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 116.235.12.58:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 41.144.169.177:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 125.61.15.113:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 162.169.151.140:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 57.5.73.63:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 217.229.213.213:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 44.64.38.130:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 142.116.199.157:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 200.180.164.141:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 99.186.78.6:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 250.42.180.1:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 84.24.159.134:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 247.51.3.235:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.137.77.139:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 18.110.251.180:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 34.25.93.80:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 171.38.206.109:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 92.51.169.37:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 154.22.154.218:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 200.112.83.191:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 43.157.234.254:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 190.243.101.143:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 82.161.4.197:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 145.194.149.44:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 217.186.219.3:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 216.220.225.57:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 112.96.211.101:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 83.215.180.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 135.254.88.197:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 98.157.68.30:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 71.209.74.204:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 189.150.105.32:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 69.180.199.214:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.171.168.222:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 73.1.41.198:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 130.203.80.162:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 5.129.100.226:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 180.219.252.85:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 156.146.171.217:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 65.219.246.10:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 164.206.29.220:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 31.244.76.180:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 197.88.4.83:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 74.58.103.56:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 196.153.92.112:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 165.57.160.43:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 97.73.131.120:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 152.67.102.79:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 95.251.32.195:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 247.85.147.251:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 70.7.206.50:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 240.215.85.247:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 201.127.81.191:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 143.44.32.133:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 191.200.31.249:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 245.11.225.99:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 120.128.57.230:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 80.36.249.182:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 178.22.54.90:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 1.100.103.91:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 116.206.148.33:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 48.220.239.182:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 181.44.89.36:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 189.60.250.104:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.157.224.246:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 164.172.69.28:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 71.36.47.41:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 95.20.69.21:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 24.0.25.239:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 251.125.200.29:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 70.149.180.182:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 191.27.56.95:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 59.54.174.182:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 73.203.53.1:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 97.23.152.8:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 39.132.179.149:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 84.144.96.221:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 246.66.236.18:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 149.193.93.220:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 157.234.10.9:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 17.30.55.43:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 153.126.149.40:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 112.113.127.227:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 247.252.140.5:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 14.207.254.96:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 106.100.111.237:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 182.151.207.16:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 81.31.50.111:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 31.26.127.213:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 203.152.156.44:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 112.231.131.213:2323
Source: global traffic TCP traffic: 192.168.2.14:36106 -> 88.7.114.236:2323
Sample listens on a socket
Source: /tmp/zfehGxWbb4.elf (PID: 5499) Socket: 127.0.0.1::20905 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 93.123.85.167
Source: unknown TCP traffic detected without corresponding DNS query: 221.226.41.212
Source: unknown TCP traffic detected without corresponding DNS query: 104.178.188.212
Source: unknown TCP traffic detected without corresponding DNS query: 53.191.126.14
Source: unknown TCP traffic detected without corresponding DNS query: 105.43.203.134
Source: unknown TCP traffic detected without corresponding DNS query: 118.55.102.171
Source: unknown TCP traffic detected without corresponding DNS query: 191.141.170.87
Source: unknown TCP traffic detected without corresponding DNS query: 37.255.179.13
Source: unknown TCP traffic detected without corresponding DNS query: 196.229.242.87
Source: unknown TCP traffic detected without corresponding DNS query: 59.21.9.34
Source: unknown TCP traffic detected without corresponding DNS query: 180.212.85.247
Source: unknown TCP traffic detected without corresponding DNS query: 92.156.197.94
Source: unknown TCP traffic detected without corresponding DNS query: 64.7.221.192
Source: unknown TCP traffic detected without corresponding DNS query: 170.7.72.89
Source: unknown TCP traffic detected without corresponding DNS query: 141.34.51.116
Source: unknown TCP traffic detected without corresponding DNS query: 203.206.46.12
Source: unknown TCP traffic detected without corresponding DNS query: 32.229.36.191
Source: unknown TCP traffic detected without corresponding DNS query: 114.193.114.186
Source: unknown TCP traffic detected without corresponding DNS query: 54.59.160.4
Source: unknown TCP traffic detected without corresponding DNS query: 113.75.48.214
Source: unknown TCP traffic detected without corresponding DNS query: 9.98.34.76
Source: unknown TCP traffic detected without corresponding DNS query: 87.25.115.74
Source: unknown TCP traffic detected without corresponding DNS query: 177.186.55.194
Source: unknown TCP traffic detected without corresponding DNS query: 75.5.186.91
Source: unknown TCP traffic detected without corresponding DNS query: 157.131.174.230
Source: unknown TCP traffic detected without corresponding DNS query: 16.95.156.202
Source: unknown TCP traffic detected without corresponding DNS query: 200.146.46.94
Source: unknown TCP traffic detected without corresponding DNS query: 77.240.168.209
Source: unknown TCP traffic detected without corresponding DNS query: 193.222.43.45
Source: unknown TCP traffic detected without corresponding DNS query: 202.32.216.120
Source: unknown TCP traffic detected without corresponding DNS query: 196.19.2.53
Source: unknown TCP traffic detected without corresponding DNS query: 102.123.43.140
Source: unknown TCP traffic detected without corresponding DNS query: 24.98.53.137
Source: unknown TCP traffic detected without corresponding DNS query: 206.151.177.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.75.195.99
Source: unknown TCP traffic detected without corresponding DNS query: 145.39.112.15
Source: unknown TCP traffic detected without corresponding DNS query: 71.174.144.220
Source: unknown TCP traffic detected without corresponding DNS query: 118.220.152.143
Source: unknown TCP traffic detected without corresponding DNS query: 47.253.242.207
Source: unknown TCP traffic detected without corresponding DNS query: 202.63.69.165
Source: unknown TCP traffic detected without corresponding DNS query: 252.252.140.225
Source: unknown TCP traffic detected without corresponding DNS query: 37.193.59.11
Source: unknown TCP traffic detected without corresponding DNS query: 16.80.98.78
Source: unknown TCP traffic detected without corresponding DNS query: 24.117.36.40
Source: unknown TCP traffic detected without corresponding DNS query: 124.200.51.47
Source: unknown TCP traffic detected without corresponding DNS query: 68.11.12.17
Source: unknown TCP traffic detected without corresponding DNS query: 201.27.176.3
Source: unknown TCP traffic detected without corresponding DNS query: 219.152.127.35
Source: unknown TCP traffic detected without corresponding DNS query: 105.7.6.201
Source: unknown TCP traffic detected without corresponding DNS query: 135.87.249.247
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: zfehGxWbb4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5499.1.00007fe42c001000.00007fe42c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5503.1.00007fe42c001000.00007fe42c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: zfehGxWbb4.elf PID: 5499, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: zfehGxWbb4.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/zfehGxWbb4.elf (PID: 5507) SIGKILL sent: pid: 853, result: successful Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) SIGKILL sent: pid: 5334, result: successful Jump to behavior
Yara signature match
Source: zfehGxWbb4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5499.1.00007fe42c001000.00007fe42c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5503.1.00007fe42c001000.00007fe42c016000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: zfehGxWbb4.elf PID: 5499, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: zfehGxWbb4.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal84.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3760/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3761/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2672/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1583/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3244/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3120/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3361/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3239/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1577/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1610/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/512/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1299/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/514/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/519/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2946/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/917/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1593/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3011/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3094/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2955/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3406/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1589/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3129/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3402/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3125/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3245/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/767/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/800/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/888/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3762/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/801/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3763/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/769/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/803/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/806/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/807/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/928/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2956/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/5441/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/490/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3142/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1635/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1633/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1599/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3139/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1873/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1630/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3412/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/657/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/658/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/659/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/418/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/419/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1639/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1638/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/5334/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3398/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1371/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3392/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/780/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/660/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/661/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/782/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1369/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3304/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3425/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/785/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1642/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/940/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/941/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1640/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3147/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3268/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1364/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/548/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3664/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1647/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2991/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1383/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1382/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1381/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/791/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/671/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/794/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1655/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2986/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/795/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/674/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1653/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/797/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/2983/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3159/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/678/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1650/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3157/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/679/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1659/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3319/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/3178/maps Jump to behavior
Source: /tmp/zfehGxWbb4.elf (PID: 5507) File opened: /proc/1394/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55712
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55772
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55848
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55988
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56024
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56030
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56058
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56068
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56074
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52530
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52582
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52594
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52608
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 52730
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/zfehGxWbb4.elf (PID: 5499) Queries kernel information via 'uname': Jump to behavior
Source: zfehGxWbb4.elf, 5499.1.00007ffc084ca000.00007ffc084eb000.rw-.sdmp, zfehGxWbb4.elf, 5503.1.00007ffc084ca000.00007ffc084eb000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/zfehGxWbb4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zfehGxWbb4.elf
Source: zfehGxWbb4.elf, 5499.1.000055604b10c000.000055604b191000.rw-.sdmp, zfehGxWbb4.elf, 5503.1.000055604b10c000.000055604b191000.rw-.sdmp Binary or memory string: K`U!/etc/qemu-binfmt/m68k
Source: zfehGxWbb4.elf, 5499.1.00007ffc084ca000.00007ffc084eb000.rw-.sdmp, zfehGxWbb4.elf, 5503.1.00007ffc084ca000.00007ffc084eb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: zfehGxWbb4.elf, 5499.1.000055604b10c000.000055604b191000.rw-.sdmp, zfehGxWbb4.elf, 5503.1.000055604b10c000.000055604b191000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.19.202.105
 unknown United States
2828 XO-AS15US false
171.212.20.45
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
142.80.215.189
 unknown Canada
5769 VIDEOTRONCA false
115.70.97.111
 unknown Australia
10143 EXETEL-AS-APExetelPtyLtdAU false
70.169.77.225
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
8.63.103.123
 unknown United States
3356 LEVEL3US false
242.180.30.221
 unknown Reserved
unknown unknown false
197.132.217.154
 unknown Egypt
24835 RAYA-ASEG false
241.196.237.196
 unknown Reserved
unknown unknown false
148.64.185.204
 unknown United States
16811 SAGENET-GTHUS false
212.30.125.187
 unknown France
12626 AS12626FR false
133.137.4.77
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
174.76.47.27
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
188.102.19.137
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
115.169.55.139
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
193.38.245.172
 unknown unknown
48095 XTGLOBALRO false
124.225.233.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
82.25.135.13
 unknown United Kingdom
5089 NTLGB false
192.139.223.227
 unknown Canada
577 BACOMCA false
116.211.189.229
 unknown China
58563 CHINATELECOM-HUBEI-IDCCHINANETHubeiprovincenetworkCN false
118.80.234.168
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
193.21.237.88
 unknown Germany
41099 GLOBALREACHGB false
118.8.252.53
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
176.104.88.172
 unknown Spain
12479 UNI2-ASES false
168.123.40.248
 unknown Guam
395400 UNIVERSITY-GUAMGU false
240.254.56.232
 unknown Reserved
unknown unknown false
253.138.115.225
 unknown Reserved
unknown unknown false
69.89.165.157
 unknown United States
26873 QCOL-ASUS false
242.186.81.88
 unknown Reserved
unknown unknown false
106.54.63.210
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
218.57.188.57
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
68.186.128.108
 unknown United States
20115 CHARTER-20115US false
115.18.198.32
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
195.52.179.48
 unknown Germany
12312 ECOTELDE false
204.162.204.254
 unknown United States
3356 LEVEL3US false
92.24.64.134
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
133.188.80.64
 unknown Japan 4729 JAEAJapanAtomicEnergyAgencyJP false
201.27.115.39
 unknown Brazil
27699 TELEFONICABRASILSABR false
167.123.35.215
 unknown Australia
19275 INTERVALUS false
136.76.251.150
 unknown United States
60311 ONEFMCH false
110.61.10.59
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
163.237.249.174
 unknown United States
13331 METAPEER-INCUS false
47.215.241.26
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
130.251.152.19
 unknown Italy
137 ASGARRConsortiumGARREU false
27.65.117.218
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
2.229.148.236
 unknown Italy
12874 FASTWEBIT false
172.170.142.191
 unknown United States
7018 ATT-INTERNET4US false
100.169.210.152
 unknown United States
21928 T-MOBILE-AS21928US false
9.23.88.243
 unknown United States
3356 LEVEL3US false
152.252.1.42
 unknown Brazil
26599 TELEFONICABRASILSABR false
153.1.190.159
 unknown Finland
1741 FUNETASFI false
122.33.60.146
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
212.57.149.162
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
66.240.47.80
 unknown United States
7922 COMCAST-7922US false
187.161.94.190
 unknown Mexico
11888 TelevisionInternacionalSAdeCVMX false
182.107.224.104
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
14.238.153.6
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
188.135.208.107
 unknown Italy
48291 ARIASPAIT false
159.7.108.111
 unknown Sweden
1906 NORTHROP-GRUMMANUS false
38.21.136.31
 unknown United States
393670 SFC-GAUS false
136.82.27.62
 unknown United States
60311 ONEFMCH false
24.87.37.2
 unknown Canada
6327 SHAWCA false
160.78.224.28
 unknown Italy
137 ASGARRConsortiumGARREU false
109.205.250.70
 unknown Russian Federation
38951 TKT-ASRU false
115.116.117.233
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
106.130.199.24
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
177.3.17.25
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
207.185.118.211
 unknown United States
32190 ADS-17-32190US false
147.57.192.54
 unknown United States
4193 WA-STATE-GOVUS false
66.7.38.146
 unknown United States
7029 WINDSTREAMUS false
24.166.152.195
 unknown United States
13343 TWC-13343-CHARLOTTEUS false
35.210.16.66
 unknown United States
19527 GOOGLE-2US false
197.40.144.147
 unknown Egypt
8452 TE-ASTE-ASEG false
244.210.21.73
 unknown Reserved
unknown unknown false
196.143.151.44
 unknown Egypt
36935 Vodafone-EG false
250.32.103.215
 unknown Reserved
unknown unknown false
83.171.193.49
 unknown Lebanon
8767 MNET-ASGermanyDE false
182.122.239.165
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
88.89.194.46
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
145.74.106.129
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
201.95.143.251
 unknown Brazil
27699 TELEFONICABRASILSABR false
152.54.238.186
 unknown United States
81 NCRENUS false
94.50.44.27
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
194.165.156.253
 unknown Jordan
8376 JordanDataCommunicationsJO false
1.168.57.133
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
41.110.216.179
 unknown Algeria
36947 ALGTEL-ASDZ false
191.29.23.39
 unknown Brazil
26599 TELEFONICABRASILSABR false
208.63.21.91
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
66.66.33.53
 unknown United States
11351 TWC-11351-NORTHEASTUS false
117.192.26.234
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
246.101.85.53
 unknown Reserved
unknown unknown false
167.121.106.206
 unknown United States
10662 NORFOLK-SOUTHERNUS false
78.145.86.2
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
63.148.60.92
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
37.222.227.77
 unknown Spain
12430 VODAFONE_ESES false
184.16.65.218
 unknown United States
5650 FRONTIER-FRTRUS false
12.28.160.14
 unknown United States
7018 ATT-INTERNET4US false
24.115.119.53
 unknown United States
3737 AS-PTDUS false
123.126.77.128
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
191.77.170.37
 unknown Colombia
26611 COMCELSACO false