Linux Analysis Report
CLqMCUCXCO

Overview

General Information

Sample Name: CLqMCUCXCO
Analysis ID: 680646
MD5: 0d9bef8f8f3122657c1861adf01c3eab
SHA1: 1f9e60bbbbf572cd3fb8f79004bacd0cdb624fc8
SHA256: a0ef9bb1cde6cc4d41a0a4a594c631763bbfa93ee76879b372fd61a466f85590
Tags: 32elfintelmirai
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: CLqMCUCXCO Virustotal: Detection: 39% Perma Link
Source: CLqMCUCXCO ReversingLabs: Detection: 56%

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34898
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34902
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34904
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34906
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34908
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34910
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34914
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34920
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34922
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34924
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33364
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47490
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47510
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33398
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47526
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33416
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47544
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33434
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47558
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33452
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47576
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47592
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47610
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33468
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 216.238.6.157
Source: unknown TCP traffic detected without corresponding DNS query: 193.222.225.203
Source: unknown TCP traffic detected without corresponding DNS query: 173.93.243.238
Source: unknown TCP traffic detected without corresponding DNS query: 14.142.27.238
Source: unknown TCP traffic detected without corresponding DNS query: 105.113.115.234
Source: unknown TCP traffic detected without corresponding DNS query: 194.108.126.192
Source: unknown TCP traffic detected without corresponding DNS query: 192.118.221.238
Source: unknown TCP traffic detected without corresponding DNS query: 88.194.28.101
Source: unknown TCP traffic detected without corresponding DNS query: 156.200.46.160
Source: unknown TCP traffic detected without corresponding DNS query: 182.186.55.42
Source: unknown TCP traffic detected without corresponding DNS query: 88.102.28.20
Source: unknown TCP traffic detected without corresponding DNS query: 76.150.75.232
Source: unknown TCP traffic detected without corresponding DNS query: 157.236.197.17
Source: unknown TCP traffic detected without corresponding DNS query: 242.62.26.3
Source: unknown TCP traffic detected without corresponding DNS query: 151.82.111.200
Source: unknown TCP traffic detected without corresponding DNS query: 255.93.218.27
Source: unknown TCP traffic detected without corresponding DNS query: 212.200.151.190
Source: unknown TCP traffic detected without corresponding DNS query: 85.45.75.175
Source: unknown TCP traffic detected without corresponding DNS query: 178.73.49.128
Source: unknown TCP traffic detected without corresponding DNS query: 73.227.125.113
Source: unknown TCP traffic detected without corresponding DNS query: 60.128.75.231
Source: unknown TCP traffic detected without corresponding DNS query: 4.50.213.103
Source: unknown TCP traffic detected without corresponding DNS query: 191.25.124.91
Source: unknown TCP traffic detected without corresponding DNS query: 5.187.160.20
Source: unknown TCP traffic detected without corresponding DNS query: 62.90.144.79
Source: unknown TCP traffic detected without corresponding DNS query: 241.15.202.109
Source: unknown TCP traffic detected without corresponding DNS query: 142.198.249.105
Source: unknown TCP traffic detected without corresponding DNS query: 182.144.241.148
Source: unknown TCP traffic detected without corresponding DNS query: 212.24.89.19
Source: unknown TCP traffic detected without corresponding DNS query: 193.163.154.242
Source: unknown TCP traffic detected without corresponding DNS query: 70.196.63.223
Source: unknown TCP traffic detected without corresponding DNS query: 19.98.196.122
Source: unknown TCP traffic detected without corresponding DNS query: 97.27.119.128
Source: unknown TCP traffic detected without corresponding DNS query: 97.209.93.176
Source: unknown TCP traffic detected without corresponding DNS query: 199.41.101.235
Source: unknown TCP traffic detected without corresponding DNS query: 60.0.192.116
Source: unknown TCP traffic detected without corresponding DNS query: 76.137.213.110
Source: unknown TCP traffic detected without corresponding DNS query: 8.254.207.131
Source: unknown TCP traffic detected without corresponding DNS query: 18.169.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 72.234.45.186
Source: unknown TCP traffic detected without corresponding DNS query: 24.24.124.11
Source: unknown TCP traffic detected without corresponding DNS query: 4.223.42.138
Source: unknown TCP traffic detected without corresponding DNS query: 61.129.55.206
Source: unknown TCP traffic detected without corresponding DNS query: 109.107.180.59
Source: unknown TCP traffic detected without corresponding DNS query: 189.85.92.8
Source: unknown TCP traffic detected without corresponding DNS query: 12.92.82.171
Source: unknown TCP traffic detected without corresponding DNS query: 197.199.123.254
Source: unknown TCP traffic detected without corresponding DNS query: 35.206.96.107
Source: CLqMCUCXCO String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0xc01000
Yara signature match
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Sample tries to kill a process (SIGKILL)
Source: /tmp/CLqMCUCXCO (PID: 6226) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal80.troj.evad.lin@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/491/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/793/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/772/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/796/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/774/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/797/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/777/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/799/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/658/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/6226/exe Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/912/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/759/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/936/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/918/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/1/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/761/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/785/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/884/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/720/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/721/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/788/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/789/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/800/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/801/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/847/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6226) File opened: /proc/904/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/491/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/793/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/772/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/796/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/774/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/797/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/777/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/799/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/658/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/6229/exe Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/912/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/759/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/936/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/918/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/1/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/761/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/785/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/884/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/720/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/721/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/788/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/789/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/800/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/801/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/847/fd Jump to behavior
Source: /tmp/CLqMCUCXCO (PID: 6229) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34898
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34902
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34904
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34906
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34908
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34910
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34914
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34920
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34922
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 34924
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33364
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47490
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47510
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33398
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47526
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33416
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47544
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33434
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47558
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33452
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47576
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47592
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 47610
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 33468
ELF contains segments with high entropy indicating compressed/encrypted content
Source: CLqMCUCXCO Submission file: segment LOAD with 7.8712 entropy (max. 8.0)

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
42.69.171.161
 unknown Taiwan; Republic of China (ROC)
4249 LILLY-ASUS false
172.38.84.30
 unknown United States
21928 T-MOBILE-AS21928US false
34.59.214.73
 unknown United States
2686 ATGS-MMD-ASUS false
209.27.25.134
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
114.3.148.80
 unknown Indonesia
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
4.69.47.238
 unknown United States
3356 LEVEL3US false
177.153.108.0
 unknown Brazil
27715 LocawebServicosdeInternetSABR false
73.12.240.93
 unknown United States
7922 COMCAST-7922US false
111.18.78.21
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
145.149.36.228
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
174.146.78.98
 unknown United States
10507 SPCSUS false
219.56.55.60
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
119.167.80.219
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
162.40.95.242
 unknown United States
7029 WINDSTREAMUS false
67.114.131.14
 unknown United States
7018 ATT-INTERNET4US false
42.63.8.28
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
179.187.164.239
 unknown Brazil
18881 TELEFONICABRASILSABR false
199.15.84.104
 unknown Canada
21775 AS-AFILIAS-REGISTRY-SERVICESCA false
104.126.211.58
 unknown United States
16625 AKAMAI-ASUS false
44.11.16.27
 unknown United States
7377 UCSDUS false
20.220.220.209
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
24.226.21.21
 unknown Canada
7992 COGECOWAVECA false
252.235.157.209
 unknown Reserved
unknown unknown false
185.119.218.28
 unknown Czech Republic
198167 APPTOCLOUDAppToCloudserversvpsCZ false
116.188.238.145
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
196.24.228.7
 unknown South Africa
36982 UCTZA false
169.9.204.201
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
185.110.97.136
 unknown France
21212 SIGFOXFR false
126.73.1.19
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
112.236.34.178
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
255.15.2.172
 unknown Reserved
unknown unknown false
161.79.55.185
 unknown Brazil
2715 FundacaoCarlosChagasFilhodeAmparoaPesquisaBR false
44.155.182.240
 unknown United States
1213 HEANETIE false
153.74.2.118
 unknown United States
14962 NCR-252US false
177.227.216.188
 unknown Mexico
13999 MegaCableSAdeCVMX false
208.240.166.235
 unknown United States
4208 THE-ISERV-COMPANYUS false
105.219.30.252
 unknown South Africa
16637 MTNNS-ASZA false
101.161.253.77
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
146.150.30.12
 unknown United States
15169 GOOGLEUS false
111.75.79.72
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
44.135.83.109
 unknown United States
7377 UCSDUS false
69.1.193.170
 unknown United States
26091 INDDCUS false
74.218.42.85
 unknown United States
10796 TWC-10796-MIDWESTUS false
211.106.91.154
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
206.52.224.241
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
48.11.106.104
 unknown United States
2686 ATGS-MMD-ASUS false
46.205.80.66
 unknown Poland
12912 TMPL false
107.5.192.223
 unknown United States
7922 COMCAST-7922US false
45.106.6.110
 unknown Egypt
37069 MOBINILEG false
184.193.182.209
 unknown United States
10507 SPCSUS false
1.17.85.122
 unknown Korea Republic of
45996 GNJ-AS-KRDAOUTECHNOLOGYKR false
167.97.21.240
 unknown United States
2055 LSU-1US false
103.232.214.0
 unknown China
137443 ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK false
105.230.56.164
 unknown Kenya
36926 CKL1-ASNKE false
96.135.51.166
 unknown United States
7922 COMCAST-7922US false
180.21.226.128
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
86.55.160.156
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
144.28.237.126
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
84.26.62.18
 unknown Netherlands
33915 TNF-ASNL false
251.66.133.29
 unknown Reserved
unknown unknown false
251.150.175.57
 unknown Reserved
unknown unknown false
86.158.230.107
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
112.175.44.174
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
120.63.148.81
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
167.170.59.192
 unknown United States
59447 SAYFANETTR false
218.159.110.4
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
172.198.108.117
 unknown Australia
18747 IFX18747US false
209.95.232.103
 unknown United States
10676 GLOBALECUS false
221.130.31.143
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
202.175.229.220
 unknown Philippines
9658 ETPI-IDS-AS-APEasternTelecomsPhilsIncPH false
125.255.115.5
 unknown Japan 1221 ASN-TELSTRATelstraCorporationLtdAU false
207.63.247.0
 unknown United States
6325 ILLINOIS-CENTURYUS false
253.80.95.162
 unknown Reserved
unknown unknown false
80.221.104.15
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
48.239.46.98
 unknown United States
2686 ATGS-MMD-ASUS false
102.216.30.96
 unknown unknown
36926 CKL1-ASNKE false
71.62.22.214
 unknown United States
7922 COMCAST-7922US false
187.18.78.229
 unknown Brazil
22689 SercomtelParticipacoesSABR false
79.19.93.106
 unknown Italy
3269 ASN-IBSNAZIT false
158.220.98.173
 unknown Switzerland
8556 LEVANTISCH false
166.177.101.119
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
123.13.43.130
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
219.179.242.156
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
249.172.233.233
 unknown Reserved
unknown unknown false
212.167.96.87
 unknown European Union
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
188.23.65.155
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
23.33.161.135
 unknown United States
16625 AKAMAI-ASUS false
118.193.69.175
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
205.176.123.6
 unknown United States
8103 STATE-OF-FLAUS false
27.72.190.215
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
156.14.91.243
 unknown Italy
137 ASGARRConsortiumGARREU false
144.91.156.168
 unknown Japan 131952 POTATO-NETAsahikawaCableTelevisionCoLtdJP false
245.115.229.77
 unknown Reserved
unknown unknown false
71.69.198.211
 unknown United States
11426 TWC-11426-CAROLINASUS false
42.139.61.221
 unknown China
4249 LILLY-ASUS false
155.25.247.223
 unknown United States
1556 DNIC-ASBLK-01550-01601US false
203.153.248.73
 unknown Australia
9822 AMNET-AU-APAmnetITServicesPtyLtdAU false
109.173.24.136
 unknown Russian Federation
42610 NCNET-ASRU false
115.40.220.193
 unknown Korea Republic of
9845 CJCKN-AS-KRLGHelloVisionCorpKR false
5.53.131.174
 unknown Bulgaria
13124 IBGCBG false