Linux Analysis Report
E0sl4ONdra.elf

Overview

General Information

Sample name: E0sl4ONdra.elf
renamed because original name is a hash value
Original sample name: 362b760141ac8e22dabe55cc65e2e598.elf
Analysis ID: 1426707
MD5: 362b760141ac8e22dabe55cc65e2e598
SHA1: 00f554b3dcdc377f5ddd96a3b684685dfb9f683b
SHA256: 2c0f0b2616d7e56f5f82d05e35d28be44d1187ccab83e62dcfe1a82569198817
Tags: 32elfmipsmirai
Infos:

Detection

Mirai
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: E0sl4ONdra.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: E0sl4ONdra.elf ReversingLabs: Detection: 65%
Source: E0sl4ONdra.elf Virustotal: Detection: 67% Perma Link

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:36350 -> 180.211.191.254:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:46536 -> 153.141.185.179:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:49350 -> 183.171.208.148:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:47974 -> 187.218.22.105:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:57196 -> 201.117.162.41:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43604
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43612
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43626
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43662
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43672
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43712
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37242
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37254
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 247.175.87.138:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 195.224.32.124:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 104.61.41.231:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.237.141.210:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 209.135.106.216:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 119.118.246.37:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.134.246.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 40.1.139.124:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 36.246.182.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 16.125.19.240:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 176.42.236.140:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 171.98.136.57:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 171.195.68.39:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 213.229.163.153:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 62.238.30.104:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 208.45.55.31:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 255.145.177.215:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 62.152.114.48:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 165.250.2.219:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.14.116.215:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 44.75.196.165:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.250.188.176:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 170.173.123.210:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 27.166.102.22:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 67.2.167.111:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 213.63.74.61:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 193.72.78.90:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 152.138.219.88:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 185.73.86.156:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 149.84.74.230:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 142.148.160.178:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 241.216.36.135:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.208.45.4:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 108.77.37.51:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 97.232.221.209:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 47.54.183.250:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 218.6.123.181:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 218.5.48.19:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 176.255.84.219:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 243.5.138.229:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 42.134.9.1:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 198.166.161.217:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 216.217.108.11:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 60.240.251.111:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 97.10.232.223:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 144.19.195.222:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 96.207.17.168:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 121.36.167.82:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 80.236.160.228:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 174.187.225.30:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 93.12.223.66:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 216.143.3.49:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 106.132.195.7:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 93.198.205.196:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.33.204.130:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 124.22.187.42:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 57.128.96.206:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 254.86.51.100:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 204.246.15.253:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 198.158.228.74:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 203.55.208.200:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 144.4.152.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 253.57.154.190:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 18.85.152.167:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 249.117.100.138:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 251.147.25.12:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 159.71.121.136:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 150.16.53.181:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 61.49.30.80:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 218.90.10.83:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 176.233.96.32:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 163.229.160.70:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 107.57.159.246:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 120.143.198.80:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 160.54.203.130:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 16.48.167.74:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 95.73.23.0:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 170.113.85.14:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 185.49.170.253:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.143.221.180:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 91.26.160.192:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 19.50.244.143:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 125.244.230.121:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 119.71.248.248:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.150.101.136:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 90.46.222.81:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 253.234.207.125:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 40.110.97.79:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 176.28.2.179:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 182.40.107.138:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 91.5.66.26:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 12.56.131.95:2323
Source: global traffic TCP traffic: 192.168.2.13:57640 -> 93.123.85.167:5555
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 47.64.190.31:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 254.131.10.57:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 79.98.142.255:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.224.47.60:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 124.68.229.148:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 243.67.194.67:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 150.159.187.237:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 157.197.121.237:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 255.224.124.84:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 200.119.210.125:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 180.185.245.233:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.203.214.128:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 183.125.55.112:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 171.45.61.113:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.60.249.47:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 45.7.199.78:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 65.26.32.180:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.155.102.90:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.208.129.64:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 173.145.109.79:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 60.76.106.67:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 8.6.205.92:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.205.13.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 183.53.223.197:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 37.114.214.211:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.176.59.224:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 17.154.35.139:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 84.135.245.211:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 246.28.228.176:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.150.149.229:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 38.43.243.187:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 41.141.25.24:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 48.220.65.191:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 75.253.169.118:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 160.59.109.87:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 23.12.128.15:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 201.115.78.142:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 85.141.141.10:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 73.1.228.233:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 223.43.60.115:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.131.214.224:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 177.87.0.241:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 95.93.176.131:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 169.170.124.116:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 58.222.78.77:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.140.225.80:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.13.90.249:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 148.192.184.91:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 179.227.251.63:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 247.102.73.27:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.51.91.51:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 125.251.228.112:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.138.29.30:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 85.128.85.122:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 91.239.243.137:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 245.170.169.231:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 241.196.44.145:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 169.179.99.173:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 182.160.21.65:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 96.66.91.144:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 142.189.27.184:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 88.87.63.69:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 211.55.11.153:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.184.2.217:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 181.237.138.239:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 96.102.200.80:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 91.172.225.206:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 122.40.13.215:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 83.201.207.100:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 136.104.88.205:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.74.214.238:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 198.101.45.78:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 87.95.85.125:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 241.12.213.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 243.156.255.187:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 76.189.72.193:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 117.33.152.102:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 44.43.203.255:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 194.108.88.244:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 20.85.141.235:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 71.70.193.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 166.230.4.59:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 67.223.114.59:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 166.37.114.78:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 187.202.4.169:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 251.162.244.197:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 199.18.247.16:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 97.51.6.67:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 74.163.21.21:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 34.165.47.95:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 114.202.146.235:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 18.192.221.14:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.89.93.122:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 68.126.212.33:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 92.238.235.134:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 149.137.129.214:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 153.1.65.33:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.107.241.127:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 247.130.215.246:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.166.14.121:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 119.143.95.213:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.145.238.135:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 76.3.107.119:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 155.185.232.68:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 122.52.1.250:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 159.181.245.56:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 190.117.145.165:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 176.55.68.93:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 114.139.57.30:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 158.220.233.216:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 146.18.17.235:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 87.14.177.141:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.111.79.106:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.166.146.131:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 1.18.38.19:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 188.217.26.40:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 97.205.74.193:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 70.203.163.54:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 48.0.212.57:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 84.12.99.52:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 99.8.189.251:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 58.99.39.176:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 44.161.62.15:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.106.132.210:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 221.45.208.72:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 108.37.64.61:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 58.184.74.151:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 58.122.238.1:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 41.135.58.53:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 203.241.222.75:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 156.51.96.31:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 57.72.73.85:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 69.5.2.165:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.73.50.78:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 253.199.99.41:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 82.177.94.52:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 67.9.106.107:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.85.214.209:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 184.234.145.226:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 153.37.167.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 48.45.200.227:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 161.254.157.219:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 62.117.181.203:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 245.40.208.76:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 223.252.177.15:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 4.27.128.74:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 102.19.133.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 211.51.255.16:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 41.145.184.210:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 186.41.54.37:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 155.174.27.213:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 177.162.201.89:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 174.146.158.153:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 66.228.87.229:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 148.199.88.141:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 53.189.126.93:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 251.178.135.88:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.194.239.94:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 66.17.16.156:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 155.113.19.16:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 1.25.248.219:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 199.12.48.231:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 151.203.191.186:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 67.127.113.236:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 249.88.245.41:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.11.21.132:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 93.93.75.21:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 139.163.136.181:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.110.226.243:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.91.143.10:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 180.29.226.66:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 190.198.172.102:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 71.125.60.76:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 87.158.164.41:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 162.157.57.208:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 71.247.126.144:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.15.35.71:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 39.193.106.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 24.33.205.64:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.32.182.199:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 81.20.166.164:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.25.80.29:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 75.64.141.87:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.182.41.255:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 154.181.33.171:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 164.14.43.9:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.247.113.75:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.86.148.71:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 212.102.137.42:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 99.234.115.220:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 162.113.26.251:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 9.135.199.30:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 143.25.195.244:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 88.13.195.140:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 114.72.47.222:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 169.2.182.76:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 146.22.101.178:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 186.255.134.71:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 59.175.105.245:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 81.42.156.64:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 72.171.11.236:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 111.187.245.47:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 165.148.222.133:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 59.126.156.174:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.89.198.95:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 158.222.74.212:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 220.103.54.126:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 19.53.1.254:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 46.152.43.151:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 154.221.85.169:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 87.212.225.105:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.52.249.163:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 32.143.2.181:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 158.185.110.192:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 216.233.40.155:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 63.107.143.101:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.24.178.85:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 175.70.35.128:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.229.240.94:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 150.21.55.59:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 201.106.55.53:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 254.196.188.237:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 65.206.191.189:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 106.29.222.26:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 43.51.240.75:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 8.252.29.215:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.37.237.10:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 202.227.185.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 83.54.106.197:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 79.225.27.25:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 220.116.30.87:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.109.249.214:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.223.32.23:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 196.110.73.42:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 248.149.54.48:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 5.246.236.136:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 157.223.201.139:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 164.3.202.41:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.245.149.28:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 68.50.147.16:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 181.79.217.149:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 168.98.245.73:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 145.240.254.97:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 248.148.245.161:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.74.251.91:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.33.99.182:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.187.112.238:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.70.208.178:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 155.140.98.1:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 98.90.38.38:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 98.248.66.29:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 107.85.21.9:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 249.50.40.206:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 150.246.183.17:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.64.176.84:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 89.152.182.115:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 66.148.136.234:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 1.237.12.199:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 213.165.57.22:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 109.104.14.95:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.7.121.119:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 183.210.166.187:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 110.123.183.108:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 191.41.211.99:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 91.119.195.151:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 99.17.138.197:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.43.182.126:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 66.214.2.159:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 110.195.178.198:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 101.147.228.251:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 4.89.142.182:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 69.249.232.162:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 245.8.67.141:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 181.148.236.34:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 183.23.13.161:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.146.122.82:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 169.18.88.254:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 246.29.168.110:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 84.4.170.190:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 116.154.144.142:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 24.247.70.195:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 211.139.202.172:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 173.43.182.109:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 159.54.207.208:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 175.163.31.23:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 186.59.180.104:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.108.47.147:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 36.163.114.165:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 177.99.145.6:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 71.229.37.27:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 90.213.98.221:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 165.55.143.65:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 198.105.245.196:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 12.170.103.216:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 110.132.16.17:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 188.51.226.180:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 90.29.214.54:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 41.138.75.194:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 177.147.19.130:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 42.119.187.62:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 200.211.213.236:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 17.107.15.243:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 9.16.136.75:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 13.47.239.92:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 92.28.177.76:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 116.169.95.245:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 104.13.119.66:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 20.50.89.84:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 92.145.226.220:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 74.101.127.241:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 195.114.233.136:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 148.211.126.215:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 66.48.47.114:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 1.3.63.55:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 69.209.188.4:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.5.14.58:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 109.164.26.138:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 125.101.199.243:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 243.71.163.88:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.37.144.189:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.38.130.7:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 104.96.143.179:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 35.185.83.240:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 171.243.139.31:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 98.56.13.98:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 117.39.39.16:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 46.17.86.101:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 76.105.247.183:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 248.199.172.50:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 94.10.109.14:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 187.159.245.253:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 255.190.2.196:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 171.105.10.131:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 210.44.92.202:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 61.142.77.73:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 1.145.18.194:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 157.149.222.234:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 109.103.249.37:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 41.165.166.13:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 42.141.64.132:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 198.188.34.30:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 251.72.163.169:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 8.3.59.222:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 86.134.163.19:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 158.26.0.2:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 14.192.34.196:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 77.133.190.195:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 153.186.71.202:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 195.30.1.190:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 112.28.206.199:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 219.9.97.70:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 4.50.82.111:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 175.203.205.177:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 200.98.211.85:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 117.35.33.90:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 48.192.247.95:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 48.183.34.81:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 123.53.28.223:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 124.28.69.142:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 54.62.167.77:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 78.70.179.195:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 72.54.210.187:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 85.7.244.154:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 109.5.123.120:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 179.239.33.99:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 147.101.158.210:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 118.135.173.197:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 246.206.14.189:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 150.92.18.177:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 242.41.12.175:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 101.250.41.88:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.199.133.224:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 12.31.211.161:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 164.204.208.188:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 87.90.50.81:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 103.112.16.62:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 115.102.148.29:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 70.134.204.176:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 245.44.166.156:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 59.253.143.228:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 189.235.110.193:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 179.41.245.232:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 199.44.205.142:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 146.139.76.24:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 79.168.65.175:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 118.253.228.50:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 168.119.150.166:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 207.72.229.134:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 157.66.43.159:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 247.18.140.241:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.134.50.136:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 252.250.177.202:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 86.59.233.150:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 242.4.52.31:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 149.207.162.105:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 159.233.132.204:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 220.167.238.141:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 167.119.174.104:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 161.164.82.18:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 82.50.247.212:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 193.152.211.228:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 111.126.106.216:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 208.87.7.80:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 19.220.147.191:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 130.234.104.168:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 155.222.231.114:2323
Source: global traffic TCP traffic: 192.168.2.13:58614 -> 164.170.144.107:2323
Sample listens on a socket
Source: /tmp/E0sl4ONdra.elf (PID: 5434) Socket: 127.0.0.1::20905 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 247.175.87.138
Source: unknown TCP traffic detected without corresponding DNS query: 188.231.194.149
Source: unknown TCP traffic detected without corresponding DNS query: 85.253.136.134
Source: unknown TCP traffic detected without corresponding DNS query: 4.139.101.109
Source: unknown TCP traffic detected without corresponding DNS query: 141.136.66.192
Source: unknown TCP traffic detected without corresponding DNS query: 116.108.143.181
Source: unknown TCP traffic detected without corresponding DNS query: 203.177.251.31
Source: unknown TCP traffic detected without corresponding DNS query: 195.224.32.124
Source: unknown TCP traffic detected without corresponding DNS query: 216.34.225.94
Source: unknown TCP traffic detected without corresponding DNS query: 80.128.79.26
Source: unknown TCP traffic detected without corresponding DNS query: 119.83.24.93
Source: unknown TCP traffic detected without corresponding DNS query: 9.43.200.74
Source: unknown TCP traffic detected without corresponding DNS query: 141.77.219.29
Source: unknown TCP traffic detected without corresponding DNS query: 198.83.211.136
Source: unknown TCP traffic detected without corresponding DNS query: 141.36.130.96
Source: unknown TCP traffic detected without corresponding DNS query: 180.68.213.180
Source: unknown TCP traffic detected without corresponding DNS query: 248.227.13.104
Source: unknown TCP traffic detected without corresponding DNS query: 91.26.251.166
Source: unknown TCP traffic detected without corresponding DNS query: 104.61.41.231
Source: unknown TCP traffic detected without corresponding DNS query: 77.80.56.177
Source: unknown TCP traffic detected without corresponding DNS query: 38.117.152.143
Source: unknown TCP traffic detected without corresponding DNS query: 44.201.16.5
Source: unknown TCP traffic detected without corresponding DNS query: 167.116.82.123
Source: unknown TCP traffic detected without corresponding DNS query: 163.58.100.139
Source: unknown TCP traffic detected without corresponding DNS query: 2.107.94.162
Source: unknown TCP traffic detected without corresponding DNS query: 85.47.183.179
Source: unknown TCP traffic detected without corresponding DNS query: 206.189.11.229
Source: unknown TCP traffic detected without corresponding DNS query: 246.229.248.52
Source: unknown TCP traffic detected without corresponding DNS query: 89.237.141.210
Source: unknown TCP traffic detected without corresponding DNS query: 19.233.77.131
Source: unknown TCP traffic detected without corresponding DNS query: 216.130.162.100
Source: unknown TCP traffic detected without corresponding DNS query: 27.129.142.15
Source: unknown TCP traffic detected without corresponding DNS query: 185.100.235.168
Source: unknown TCP traffic detected without corresponding DNS query: 19.2.234.226
Source: unknown TCP traffic detected without corresponding DNS query: 1.171.21.181
Source: unknown TCP traffic detected without corresponding DNS query: 19.228.182.119
Source: unknown TCP traffic detected without corresponding DNS query: 105.213.146.111
Source: unknown TCP traffic detected without corresponding DNS query: 170.189.176.176
Source: unknown TCP traffic detected without corresponding DNS query: 92.75.63.220
Source: unknown TCP traffic detected without corresponding DNS query: 209.135.106.216
Source: unknown TCP traffic detected without corresponding DNS query: 105.170.114.202
Source: unknown TCP traffic detected without corresponding DNS query: 34.22.184.210
Source: unknown TCP traffic detected without corresponding DNS query: 103.230.120.0
Source: unknown TCP traffic detected without corresponding DNS query: 190.105.152.56
Source: unknown TCP traffic detected without corresponding DNS query: 113.70.155.225
Source: unknown TCP traffic detected without corresponding DNS query: 125.127.0.133
Source: unknown TCP traffic detected without corresponding DNS query: 115.146.74.203
Source: unknown TCP traffic detected without corresponding DNS query: 119.118.246.37
Source: unknown TCP traffic detected without corresponding DNS query: 252.220.2.155
Source: unknown TCP traffic detected without corresponding DNS query: 213.115.81.85

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: E0sl4ONdra.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: E0sl4ONdra.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: E0sl4ONdra.elf PID: 5434, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: E0sl4ONdra.elf PID: 5438, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/E0sl4ONdra.elf (PID: 5442) SIGKILL sent: pid: 855, result: successful Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) SIGKILL sent: pid: 5265, result: successful Jump to behavior
Yara signature match
Source: E0sl4ONdra.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: E0sl4ONdra.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: E0sl4ONdra.elf PID: 5434, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: E0sl4ONdra.elf PID: 5438, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal92.troj.linELF@0/1@0/0
Enumerates processes within the "proc" file system
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5265/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3122/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5380/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3117/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3114/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/914/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/518/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/519/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5418/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/917/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5419/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3375/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3132/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3095/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1745/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1866/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/884/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1982/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/765/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/767/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/800/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1906/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/802/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/803/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1748/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5440/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1482/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/490/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1480/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1755/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1238/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1875/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2964/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3413/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1751/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1872/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2961/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1475/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/656/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/778/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/657/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/658/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/659/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/5436/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/418/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/936/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/419/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/816/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1879/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1891/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3310/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3153/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/780/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/660/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1921/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/783/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1765/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2974/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1400/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1884/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3424/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2972/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3147/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2970/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1881/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3146/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3300/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1805/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1925/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1804/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1648/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1922/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3429/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3442/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3165/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3164/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3163/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3162/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/790/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3161/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/792/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/793/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/672/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1930/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/674/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/795/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3315/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1411/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/2984/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/1410/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/797/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/676/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3434/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3158/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/678/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/679/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3170/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/680/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3208/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3327/maps Jump to behavior
Source: /tmp/E0sl4ONdra.elf (PID: 5442) File opened: /proc/3448/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43604
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43612
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43626
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43650
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43662
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43672
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43692
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 43712
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37242
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37254
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/E0sl4ONdra.elf (PID: 5434) Queries kernel information via 'uname': Jump to behavior
Source: E0sl4ONdra.elf, 5434.1.00005603c7104000.00005603c718b000.rw-.sdmp, E0sl4ONdra.elf, 5438.1.00005603c7104000.00005603c718b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: E0sl4ONdra.elf, 5434.1.00005603c7104000.00005603c718b000.rw-.sdmp, E0sl4ONdra.elf, 5438.1.00005603c7104000.00005603c718b000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/mipsel
Source: E0sl4ONdra.elf, 5434.1.00007ffe06b71000.00007ffe06b92000.rw-.sdmp, E0sl4ONdra.elf, 5438.1.00007ffe06b71000.00007ffe06b92000.rw-.sdmp Binary or memory string: +x86_64/usr/bin/qemu-mipsel/tmp/E0sl4ONdra.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/E0sl4ONdra.elf
Source: E0sl4ONdra.elf, 5434.1.00007ffe06b71000.00007ffe06b92000.rw-.sdmp, E0sl4ONdra.elf, 5438.1.00007ffe06b71000.00007ffe06b92000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: E0sl4ONdra.elf, type: SAMPLE
Source: Yara match File source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: E0sl4ONdra.elf, type: SAMPLE
Source: Yara match File source: 5434.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007f4724400000.00007f472441a000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
247.78.135.254
 unknown Reserved
unknown unknown false
223.162.206.96
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
84.80.44.220
 unknown Netherlands
1136 KPNKPNNationalEU false
202.166.225.25
 unknown China
17501 WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP false
110.225.150.238
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
152.47.196.75
 unknown United States
81 NCRENUS false
38.9.48.100
 unknown United States
174 COGENT-174US false
167.8.33.28
 unknown United States
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
223.66.110.135
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
123.69.92.194
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
218.151.252.64
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
167.205.183.217
 unknown Indonesia
4796 BANDUNG-NET-AS-APInstituteofTechnologyBandungID false
166.127.141.74
 unknown United States
4604 HOUSTON-ISDUS false
171.206.181.132
 unknown United States
10794 BANKAMERICAUS false
199.46.56.155
 unknown United States
2379 CENTURYLINK-LEGACY-EMBARQ-WNPKUS false
89.19.50.213
 unknown United Kingdom
61317 ASDETUKhttpwwwheficedcomGB false
97.213.231.226
 unknown United States
6167 CELLCO-PARTUS false
250.52.163.120
 unknown Reserved
unknown unknown false
93.163.220.102
 unknown Denmark
3292 TDCTDCASDK false
167.229.131.162
 unknown United States
2897 GEORGIA-1US false
125.248.115.191
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
133.187.254.226
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
99.206.56.166
 unknown United States
10507 SPCSUS false
79.124.212.101
 unknown Ukraine
34058 LIFECELL-ASUA false
201.172.45.45
 unknown Mexico
11888 TelevisionInternacionalSAdeCVMX false
172.116.139.113
 unknown United States
20001 TWC-20001-PACWESTUS false
2.98.84.0
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
184.103.7.37
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
219.179.242.106
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
250.66.38.9
 unknown Reserved
unknown unknown false
173.203.102.154
 unknown United States
19994 RACKSPACEUS false
205.147.235.15
 unknown United States
7349 AS-TIERP-7349US false
188.61.151.92
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
44.105.65.38
 unknown United States
7377 UCSDUS false
87.117.138.144
 unknown Russian Federation
41691 SUMTEL-AS-RIPEMoscowRussiaRU false
200.98.219.211
 unknown Brazil
18479 UniversoOnlineSABR false
166.100.241.221
 unknown Japan 58681 NSWPOLSERV-AS-APNewSouthWalesPoliceAU false
39.103.164.0
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
43.143.26.45
 unknown Japan 4249 LILLY-ASUS false
113.2.57.86
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
219.246.105.250
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
115.143.142.74
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
45.93.168.232
 unknown Iran (ISLAMIC Republic Of)
57497 FARASOSAMANEHPASARGADIR false
109.95.3.189
 unknown Poland
198984 BIALNET-ASPL false
135.180.152.255
 unknown United States
46375 AS-SONICTELECOMUS false
63.120.158.138
 unknown United States
701 UUNETUS false
27.185.11.90
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
133.27.84.127
 unknown Japan 38635 KEIO-NETKeioUniversityJP false
74.98.157.12
 unknown United States
701 UUNETUS false
27.242.160.8
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
9.153.138.10
 unknown United States
3356 LEVEL3US false
32.8.177.106
 unknown United States
2686 ATGS-MMD-ASUS false
66.48.47.114
 unknown United States
701 UUNETUS false
61.207.245.94
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
188.139.215.211
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
118.198.166.237
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
76.163.41.173
 unknown United States
46606 UNIFIEDLAYER-AS-1US false
97.118.140.67
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
40.122.251.108
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
27.33.207.113
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
81.194.96.198
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
117.144.154.42
 unknown China
24400 CMNET-V4SHANGHAI-AS-APShanghaiMobileCommunicationsCoLt false
160.98.124.108
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
77.60.19.97
 unknown Netherlands
1136 KPNKPNNationalEU false
216.224.252.72
 unknown United States
39948 INIT-PHXUS false
165.138.30.194
 unknown United States
11686 ENAUS false
193.186.112.146
 unknown Austria
12762 VTG-AT false
108.150.19.250
 unknown United States
16509 AMAZON-02US false
98.167.233.137
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
172.150.130.194
 unknown United States
7018 ATT-INTERNET4US false
43.110.37.143
 unknown Japan 4249 LILLY-ASUS false
20.79.32.78
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
249.241.99.156
 unknown Reserved
unknown unknown false
121.95.0.34
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
57.5.138.254
 unknown Belgium
2686 ATGS-MMD-ASUS false
252.58.211.102
 unknown Reserved
unknown unknown false
219.118.227.191
 unknown Japan 18144 AS-ENECOMEnergiaCommunicationsIncJP false
169.135.216.28
 unknown United States
2576 DOT-ASUS false
24.219.213.136
 unknown United States
8092 AMHUS false
157.91.133.208
 unknown United States
1767 ILIGHT-NETUS false
206.70.233.178
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
88.23.223.149
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
9.254.39.208
 unknown United States
3356 LEVEL3US false
174.117.30.182
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
87.237.92.121
 unknown Germany
8549 AISEU-ASDE false
206.24.109.86
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
5.140.74.159
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
242.92.162.139
 unknown Reserved
unknown unknown false
81.70.1.127
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
163.21.10.200
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
167.68.197.128
 unknown United States
4583 WESTPUB-AUS false
241.143.37.26
 unknown Reserved
unknown unknown false
113.64.84.82
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
243.16.15.5
 unknown Reserved
unknown unknown false
23.50.13.102
 unknown United States
45899 VNPT-AS-VNVNPTCorpVN false
124.160.48.230
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
110.219.53.78
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
125.81.221.207
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
162.149.162.138
 unknown United States
7922 COMCAST-7922US false
37.151.78.129
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false