Linux Analysis Report
YbuW0MHZo0

Overview

General Information

Sample Name: YbuW0MHZo0
Analysis ID: 680649
MD5: dcdd462eaf76769b9a0b79640b98065b
SHA1: df86c4b2b98e4f540d31ff8bba0c2d5beda8b9e6
SHA256: 12bcdc291270a3506825c13eaa2efb0f6f4a4304a504db2ed3a427414adca191
Tags: 32elfmiraimotorola
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: YbuW0MHZo0 ReversingLabs: Detection: 58%

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37552
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37554
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37560
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37562
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37564
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37580
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37588
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37590
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37594
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50454
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50478
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50500
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50508
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50520
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50526
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312
Sample listens on a socket
Source: /tmp/YbuW0MHZo0 (PID: 6227) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) Socket: 0.0.0.0::0 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 196.170.136.68
Source: unknown TCP traffic detected without corresponding DNS query: 245.132.102.68
Source: unknown TCP traffic detected without corresponding DNS query: 112.83.63.71
Source: unknown TCP traffic detected without corresponding DNS query: 4.167.50.63
Source: unknown TCP traffic detected without corresponding DNS query: 67.36.87.188
Source: unknown TCP traffic detected without corresponding DNS query: 169.85.79.120
Source: unknown TCP traffic detected without corresponding DNS query: 1.239.196.71
Source: unknown TCP traffic detected without corresponding DNS query: 83.117.153.224
Source: unknown TCP traffic detected without corresponding DNS query: 197.185.41.215
Source: unknown TCP traffic detected without corresponding DNS query: 124.157.138.126
Source: unknown TCP traffic detected without corresponding DNS query: 190.66.148.224
Source: unknown TCP traffic detected without corresponding DNS query: 126.22.206.196
Source: unknown TCP traffic detected without corresponding DNS query: 99.156.169.200
Source: unknown TCP traffic detected without corresponding DNS query: 18.53.233.110
Source: unknown TCP traffic detected without corresponding DNS query: 188.108.138.201
Source: unknown TCP traffic detected without corresponding DNS query: 34.234.169.82
Source: unknown TCP traffic detected without corresponding DNS query: 221.120.38.74
Source: unknown TCP traffic detected without corresponding DNS query: 97.2.90.224
Source: unknown TCP traffic detected without corresponding DNS query: 171.202.187.251
Source: unknown TCP traffic detected without corresponding DNS query: 47.165.49.88
Source: unknown TCP traffic detected without corresponding DNS query: 68.217.223.13
Source: unknown TCP traffic detected without corresponding DNS query: 152.177.235.87
Source: unknown TCP traffic detected without corresponding DNS query: 147.190.44.36
Source: unknown TCP traffic detected without corresponding DNS query: 54.61.26.60
Source: unknown TCP traffic detected without corresponding DNS query: 240.47.184.158
Source: unknown TCP traffic detected without corresponding DNS query: 181.41.39.58
Source: unknown TCP traffic detected without corresponding DNS query: 166.248.45.146
Source: unknown TCP traffic detected without corresponding DNS query: 51.6.115.216
Source: unknown TCP traffic detected without corresponding DNS query: 57.8.108.210
Source: unknown TCP traffic detected without corresponding DNS query: 192.21.18.123
Source: unknown TCP traffic detected without corresponding DNS query: 19.78.235.43
Source: unknown TCP traffic detected without corresponding DNS query: 158.201.76.226
Source: unknown TCP traffic detected without corresponding DNS query: 78.194.127.69
Source: unknown TCP traffic detected without corresponding DNS query: 147.136.242.170
Source: unknown TCP traffic detected without corresponding DNS query: 36.153.170.0
Source: unknown TCP traffic detected without corresponding DNS query: 2.140.111.138
Source: unknown TCP traffic detected without corresponding DNS query: 244.219.122.145
Source: unknown TCP traffic detected without corresponding DNS query: 115.98.28.224
Source: unknown TCP traffic detected without corresponding DNS query: 133.23.127.158
Source: unknown TCP traffic detected without corresponding DNS query: 173.8.125.55
Source: unknown TCP traffic detected without corresponding DNS query: 254.244.172.213
Source: unknown TCP traffic detected without corresponding DNS query: 63.107.217.24
Source: unknown TCP traffic detected without corresponding DNS query: 247.160.16.17
Source: unknown TCP traffic detected without corresponding DNS query: 48.20.227.50
Source: unknown TCP traffic detected without corresponding DNS query: 57.36.66.79
Source: unknown TCP traffic detected without corresponding DNS query: 91.58.184.30
Source: unknown TCP traffic detected without corresponding DNS query: 208.115.222.147

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: YbuW0MHZo0, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: YbuW0MHZo0, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6225, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6225, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6234, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6234, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6338, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6338, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6345, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YbuW0MHZo0 PID: 6345, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Yara signature match
Source: YbuW0MHZo0, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: YbuW0MHZo0, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6225, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6225, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6227, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6234, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6234, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6338, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6338, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6345, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YbuW0MHZo0 PID: 6345, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/YbuW0MHZo0 (PID: 6227) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal76.troj.lin@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/491/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/793/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/772/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/796/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/774/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/797/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/777/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/799/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/658/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/912/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/759/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/936/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/918/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/1/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/761/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/785/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/884/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/720/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/721/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/788/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/789/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/800/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/801/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/847/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6233) File opened: /proc/904/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/491/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/793/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/772/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/796/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/774/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/797/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/777/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/799/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/658/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/912/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/759/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/936/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/918/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/1/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/761/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/785/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/884/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/720/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/721/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/788/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/789/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/800/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/801/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/847/fd Jump to behavior
Source: /tmp/YbuW0MHZo0 (PID: 6227) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37552
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37554
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37560
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37562
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37564
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37580
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37588
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37590
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37594
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50454
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50468
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50478
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50492
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50500
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50508
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50512
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50520
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50526
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/YbuW0MHZo0 (PID: 6225) Queries kernel information via 'uname': Jump to behavior
Source: YbuW0MHZo0, 6225.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6227.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6328.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6345.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6338.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6228.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6327.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6234.1.00007ffdff644000.00007ffdff665000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: YbuW0MHZo0, 6225.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6227.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6328.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6345.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6338.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6228.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6327.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6234.1.00005605851c1000.0000560585246000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: YbuW0MHZo0, 6225.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6227.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6328.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6345.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6338.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6228.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6327.1.00005605851c1000.0000560585246000.rw-.sdmp, YbuW0MHZo0, 6234.1.00005605851c1000.0000560585246000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/m68k
Source: YbuW0MHZo0, 6225.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6227.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6328.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6345.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6338.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6228.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6327.1.00007ffdff644000.00007ffdff665000.rw-.sdmp, YbuW0MHZo0, 6234.1.00007ffdff644000.00007ffdff665000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/YbuW0MHZo0SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/YbuW0MHZo0

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: YbuW0MHZo0, type: SAMPLE
Source: Yara match File source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: YbuW0MHZo0, type: SAMPLE
Source: Yara match File source: 6338.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6227.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6225.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6234.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6345.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.00007fc900001000.00007fc900011000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
139.169.35.31
 unknown United States
270 AS270US false
218.191.217.214
 unknown Hong Kong
9304 HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK false
91.103.53.121
 unknown Spain
31262 EDICOMES false
246.132.183.69
 unknown Reserved
unknown unknown false
115.143.117.94
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
221.157.77.15
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
69.44.220.229
 unknown United States
13767 DATABANK-DFWUS false
219.191.176.119
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
66.186.44.1
 unknown United States
40891 SDI-MEDIA-GROUPUS false
191.149.218.193
 unknown Colombia
26611 COMCELSACO false
178.228.58.237
 unknown Netherlands
31615 TMO-NL-ASNL false
248.133.158.76
 unknown Reserved
unknown unknown false
180.23.142.196
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
162.52.78.41
 unknown United States
35893 ACPCA false
69.37.49.65
 unknown United States
7018 ATT-INTERNET4US false
58.137.134.246
 unknown Thailand
18408 MITSUBISHIFA-CSLOXINFO-THCSLOXINFOTH false
210.145.102.97
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
9.94.32.203
 unknown United States
3356 LEVEL3US false
47.136.192.234
 unknown United States
5650 FRONTIER-FRTRUS false
89.233.66.133
 unknown Germany
9145 EWETELCloppenburgerStrasse310DE false
4.150.249.64
 unknown United States
3356 LEVEL3US false
248.111.220.143
 unknown Reserved
unknown unknown false
66.139.105.234
 unknown United States
7018 ATT-INTERNET4US false
212.58.250.97
 unknown United Kingdom
2818 BBCBBCInternetServicesUKGB false
185.191.89.31
 unknown Spain
205512 WIFILAVALLES false
89.109.12.129
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
43.152.14.154
 unknown Japan 4249 LILLY-ASUS false
4.54.18.92
 unknown United States
3356 LEVEL3US false
187.59.106.55
 unknown Brazil
18881 TELEFONICABRASILSABR false
156.41.209.244
 unknown United States
1226 CTA-42-AS1226US false
166.127.141.57
 unknown United States
4604 HOUSTON-ISDUS false
181.230.242.157
 unknown Argentina
10481 TelecomArgentinaSAAR false
61.9.25.51
 unknown Philippines
17970 SKYBB-AS-APSKYBroadbandSKYCableCorporationPH false
211.175.131.86
 unknown Korea Republic of
9457 DREAMX-ASDREAMLINECOKR false
62.0.77.79
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
168.189.78.57
 unknown United States
53526 THECLO-ASNUS false
168.92.42.22
 unknown United States
16399 FIRSTCOMM-AS2US false
200.121.65.160
 unknown Peru
6147 TelefonicadelPeruSAAPE false
108.23.239.123
 unknown United States
5650 FRONTIER-FRTRUS false
193.107.224.153
 unknown Ukraine
44041 UNICOMLAB-ASRU false
32.41.122.209
 unknown United States
2686 ATGS-MMD-ASUS false
42.207.180.116
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
255.74.31.12
 unknown Reserved
unknown unknown false
121.9.180.68
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
17.42.161.130
 unknown United States
714 APPLE-ENGINEERINGUS false
45.149.76.249
 unknown Iran (ISLAMIC Republic Of)
60631 PARVASYSTEMIR false
61.202.226.226
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
57.64.2.157
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
76.91.218.114
 unknown United States
20001 TWC-20001-PACWESTUS false
67.80.199.42
 unknown United States
6128 CABLE-NET-1US false
85.21.130.23
 unknown Russian Federation
8402 CORBINA-ASOJSCVimpelcomRU false
221.205.8.113
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
12.125.39.68
 unknown United States
7018 ATT-INTERNET4US false
206.121.134.66
 unknown United States
7018 ATT-INTERNET4US false
244.39.195.2
 unknown Reserved
unknown unknown false
252.194.182.128
 unknown Reserved
unknown unknown false
220.147.154.54
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
200.98.155.81
 unknown Brazil
7162 UniversoOnlineSABR false
202.126.194.6
 unknown New Zealand
17492 VECTOR-COMMUNICATIONS-ASVectorCommunicationsLTDNZ false
209.114.155.235
 unknown United States
17054 AS17054US false
247.188.164.180
 unknown Reserved
unknown unknown false
179.10.161.252
 unknown Brazil
26615 TIMSABR false
165.77.133.145
 unknown United States
4725 ODNSoftBankMobileCorpJP false
73.236.36.102
 unknown United States
7922 COMCAST-7922US false
216.135.68.192
 unknown United States
4261 BLUEGRASSNETUS false
207.147.233.222
 unknown United States
2711 SPIRITTEL-ASUS false
13.10.208.192
 unknown United States
26662 XEROX-WVUS false
54.56.255.200
 unknown United States
14618 AMAZON-AESUS false
150.145.85.46
 unknown Italy
137 ASGARRConsortiumGARREU false
47.33.229.16
 unknown United States
20115 CHARTER-20115US false
48.156.130.0
 unknown United States
2686 ATGS-MMD-ASUS false
14.86.131.117
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
4.15.188.253
 unknown United States
3356 LEVEL3US false
191.196.232.124
 unknown Brazil
26599 TELEFONICABRASILSABR false
17.98.106.237
 unknown United States
714 APPLE-ENGINEERINGUS false
111.214.188.218
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
177.8.210.235
 unknown Brazil
262819 LINKMAISPROVEDORDEACESSOASREDESDECOMLTDABR false
195.248.34.203
 unknown Austria
8437 UTA-ASAT false
136.140.138.103
 unknown United States
60311 ONEFMCH false
62.210.152.239
 unknown France
12876 OnlineSASFR false
47.114.18.29
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
104.1.204.81
 unknown United States
7018 ATT-INTERNET4US false
223.113.238.121
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
141.135.42.36
 unknown Belgium
6848 TELENET-ASBE false
207.68.157.241
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
180.156.74.127
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
187.51.205.116
 unknown Brazil
10429 TELEFONICABRASILSABR false
118.242.64.239
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
93.231.80.206
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
149.99.65.7
 unknown Canada
3602 AS3602-ROGERS-COMCA false
155.197.111.86
 unknown United States
37197 SUDRENSD false
84.56.216.101
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
122.121.155.169
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
104.170.219.173
 unknown United States
36352 AS-COLOCROSSINGUS false
159.62.185.241
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
1.19.209.35
 unknown Korea Republic of
45996 GNJ-AS-KRDAOUTECHNOLOGYKR false
86.99.44.125
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
99.210.200.183
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
97.67.48.156
 unknown United States
7029 WINDSTREAMUS false
209.148.121.224
 unknown United States
7065 SONOMAUS false