Linux Analysis Report
I95q6K4AMy

Overview

General Information

Sample Name: I95q6K4AMy
Analysis ID: 680658
MD5: a1d40f8e8634726af705363d1ce318e3
SHA1: a23ea7dbd1ae980ef1860db2004a64c0c20753c3
SHA256: d80ab5938a57dfbf5db4f294b4c4123320df3aad659c44683438dd4ac2553779
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: I95q6K4AMy Virustotal: Detection: 25% Perma Link
Source: I95q6K4AMy ReversingLabs: Detection: 38%

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37966
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37972
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37976
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37978
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37982
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37984
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37988
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37994
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37998
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38002
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 61755
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37846
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55059
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56958
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312
Sample listens on a socket
Source: /tmp/I95q6K4AMy (PID: 6228) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) Socket: 0.0.0.0::37215 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown TCP traffic detected without corresponding DNS query: 141.127.218.63
Source: unknown TCP traffic detected without corresponding DNS query: 94.88.27.251
Source: unknown TCP traffic detected without corresponding DNS query: 106.203.200.61
Source: unknown TCP traffic detected without corresponding DNS query: 114.17.203.192
Source: unknown TCP traffic detected without corresponding DNS query: 38.57.217.229
Source: unknown TCP traffic detected without corresponding DNS query: 153.78.89.12
Source: unknown TCP traffic detected without corresponding DNS query: 1.47.32.59
Source: unknown TCP traffic detected without corresponding DNS query: 179.186.168.152
Source: unknown TCP traffic detected without corresponding DNS query: 171.78.58.54
Source: unknown TCP traffic detected without corresponding DNS query: 250.236.223.63
Source: unknown TCP traffic detected without corresponding DNS query: 17.112.238.246
Source: unknown TCP traffic detected without corresponding DNS query: 27.59.31.253
Source: unknown TCP traffic detected without corresponding DNS query: 36.162.42.11
Source: unknown TCP traffic detected without corresponding DNS query: 179.25.60.109
Source: unknown TCP traffic detected without corresponding DNS query: 116.212.95.34
Source: unknown TCP traffic detected without corresponding DNS query: 8.180.102.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.75.4.33
Source: unknown TCP traffic detected without corresponding DNS query: 4.33.224.196
Source: unknown TCP traffic detected without corresponding DNS query: 92.201.31.30
Source: unknown TCP traffic detected without corresponding DNS query: 101.27.255.246
Source: unknown TCP traffic detected without corresponding DNS query: 103.87.102.3
Source: unknown TCP traffic detected without corresponding DNS query: 123.105.11.194
Source: unknown TCP traffic detected without corresponding DNS query: 105.215.4.48
Source: unknown TCP traffic detected without corresponding DNS query: 153.199.179.59
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.181.106
Source: unknown TCP traffic detected without corresponding DNS query: 161.208.187.67
Source: unknown TCP traffic detected without corresponding DNS query: 203.187.7.96
Source: unknown TCP traffic detected without corresponding DNS query: 150.86.27.22
Source: unknown TCP traffic detected without corresponding DNS query: 119.209.58.85
Source: unknown TCP traffic detected without corresponding DNS query: 143.34.42.88
Source: unknown TCP traffic detected without corresponding DNS query: 251.61.108.103
Source: unknown TCP traffic detected without corresponding DNS query: 99.41.77.21
Source: unknown TCP traffic detected without corresponding DNS query: 216.92.163.195
Source: unknown TCP traffic detected without corresponding DNS query: 91.150.149.218
Source: unknown TCP traffic detected without corresponding DNS query: 109.150.76.180
Source: unknown TCP traffic detected without corresponding DNS query: 102.111.62.60
Source: unknown TCP traffic detected without corresponding DNS query: 183.182.176.202
Source: unknown TCP traffic detected without corresponding DNS query: 135.6.126.193
Source: unknown TCP traffic detected without corresponding DNS query: 181.50.40.115
Source: unknown TCP traffic detected without corresponding DNS query: 166.245.177.209
Source: unknown TCP traffic detected without corresponding DNS query: 151.57.57.176
Source: unknown TCP traffic detected without corresponding DNS query: 99.122.196.220
Source: unknown TCP traffic detected without corresponding DNS query: 43.48.62.31
Source: unknown TCP traffic detected without corresponding DNS query: 73.123.13.47
Source: unknown TCP traffic detected without corresponding DNS query: 170.187.173.4
Source: unknown TCP traffic detected without corresponding DNS query: 101.1.71.169
Source: unknown TCP traffic detected without corresponding DNS query: 249.12.95.5
Source: unknown TCP traffic detected without corresponding DNS query: 212.47.95.98
Source: I95q6K4AMy String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6235, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6235, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6346, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I95q6K4AMy PID: 6346, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Yara signature match
Source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6226, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6228, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6229, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6235, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6235, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6327, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6328, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6336, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6346, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I95q6K4AMy PID: 6346, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Sample tries to kill a process (SIGKILL)
Source: /tmp/I95q6K4AMy (PID: 6228) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal80.troj.evad.lin@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/491/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/793/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/772/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/796/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/774/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/797/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/777/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/799/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/658/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/912/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/759/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/936/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/918/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/1/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/761/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/785/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/884/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/720/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/721/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/788/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/789/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/800/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/801/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/847/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6234) File opened: /proc/904/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/491/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/793/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/772/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/796/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/774/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/797/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/777/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/799/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/658/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/912/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/759/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/936/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/918/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/1/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/761/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/785/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/884/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/720/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/721/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/788/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/789/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/800/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/801/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/847/fd Jump to behavior
Source: /tmp/I95q6K4AMy (PID: 6228) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37966
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37972
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37976
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37978
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37982
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37984
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37988
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37994
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37998
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38002
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 61755
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37846
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55059
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 56958
ELF contains segments with high entropy indicating compressed/encrypted content
Source: I95q6K4AMy Submission file: segment LOAD with 7.9459 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/I95q6K4AMy (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: I95q6K4AMy, 6226.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6228.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6328.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6346.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6336.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6229.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6327.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6235.1.00007fffa833c000.00007fffa835d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/I95q6K4AMySUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/I95q6K4AMy
Source: I95q6K4AMy, 6226.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6228.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6328.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6346.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6336.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6229.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6327.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6235.1.000055bee51e2000.000055bee5390000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: I95q6K4AMy, 6226.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6228.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6328.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6346.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6336.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6229.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6327.1.000055bee51e2000.000055bee5390000.rw-.sdmp, I95q6K4AMy, 6235.1.000055bee51e2000.000055bee5390000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: I95q6K4AMy, 6226.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6228.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6328.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6346.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6336.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6229.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6327.1.00007fffa833c000.00007fffa835d000.rw-.sdmp, I95q6K4AMy, 6235.1.00007fffa833c000.00007fffa835d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6336.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6346.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6328.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6327.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007fd0dc017000.00007fd0dc029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
223.92.221.118
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
210.139.227.226
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
100.255.37.94
 unknown United States
21928 T-MOBILE-AS21928US false
157.84.108.152
 unknown United Kingdom
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
12.194.48.59
 unknown United States
8030 WORLDNET5-10US false
243.114.242.49
 unknown Reserved
unknown unknown false
18.207.133.64
 unknown United States
14618 AMAZON-AESUS false
216.47.150.29
 unknown United States
29825 IIT-NETWORK-ASUS false
205.241.14.240
 unknown United States
3364 CSDCO-ASUS false
208.1.146.46
 unknown United States
1239 SPRINTLINKUS false
150.121.57.75
 unknown China
4152 USDA-1US false
198.123.247.37
 unknown United States
297 AS297US false
126.149.55.110
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
178.40.197.80
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
124.80.10.191
 unknown Korea Republic of
17849 GINAMHANVIT-AS-KRTbroadGinamBroadcatingCoLtdKR false
118.16.102.230
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
102.21.168.170
 unknown unknown
37054 Telecom-MalagasyMG false
18.19.210.92
 unknown United States
3 MIT-GATEWAYSUS false
136.161.34.87
 unknown United States
174 COGENT-174US false
209.86.96.6
 unknown United States
7029 WINDSTREAMUS false
76.204.63.38
 unknown United States
7018 ATT-INTERNET4US false
167.246.237.231
 unknown United States
22808 RESOURCES-22808US false
87.233.230.44
 unknown Netherlands
15703 TRUESERVER-ASTrueServerBVASnumberNL false
125.191.73.184
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
213.196.132.238
 unknown Switzerland
21040 DATAPARKCH false
106.105.86.49
 unknown Taiwan; Republic of China (ROC)
18049 TINP-TWTaiwanInfrastructureNetworkTechnologieTW false
61.196.242.205
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
53.200.167.39
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
185.105.253.172
 unknown Germany
8648 KAMP-DE false
178.92.173.150
 unknown Ukraine
6849 UKRTELNETUA false
66.135.90.230
 unknown United States
18897 MONTANA-SKY-NETWORKS-INCUS false
198.250.182.80
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
121.11.16.205
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
108.17.85.12
 unknown United States
701 UUNETUS false
218.226.230.161
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
95.151.243.73
 unknown United Kingdom
12576 EELtdGB false
213.52.157.157
 unknown United Kingdom
15830 EQUINIX-CONNECT-EMEAGB false
71.93.42.159
 unknown United States
20115 CHARTER-20115US false
12.183.68.128
 unknown United States
7018 ATT-INTERNET4US false
82.201.225.33
 unknown Egypt
24863 LINKdotNET-ASEG false
253.111.226.250
 unknown Reserved
unknown unknown false
208.127.35.15
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
202.19.217.219
 unknown Japan 7687 D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP false
248.111.220.133
 unknown Reserved
unknown unknown false
255.187.189.150
 unknown Reserved
unknown unknown false
8.120.227.187
 unknown United States
3356 LEVEL3US false
208.20.200.163
 unknown United States
1239 SPRINTLINKUS false
252.17.232.26
 unknown Reserved
unknown unknown false
255.148.57.201
 unknown Reserved
unknown unknown false
211.182.181.20
 unknown Korea Republic of
9706 PETISNET-ASBUSANEDUCATIONRESEARCHINFORMATIONCENTERKR false
119.28.5.218
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
81.130.63.147
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
84.229.162.133
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
44.67.141.103
 unknown United States
7377 UCSDUS false
124.132.61.141
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
92.245.158.205
 unknown France
48072 ALSATIS-ASalsatiswispnetworkASFR false
101.228.227.52
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
178.91.19.61
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
123.151.171.62
 unknown China
17638 CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT false
190.4.170.147
 unknown Curacao
11081 UnitedTelecommunicationServicesUTSCW false
200.244.158.139
 unknown Brazil
4230 CLAROSABR false
173.42.243.212
 unknown United States
812 ROGERS-COMMUNICATIONSCA false
72.144.232.184
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
196.224.103.42
 unknown Tunisia
37492 ORANGE-TN false
222.84.82.184
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
27.0.126.86
 unknown Bangladesh
10113 EFTEL-AS-APEftelLimitedAU false
244.69.9.240
 unknown Reserved
unknown unknown false
206.130.80.187
 unknown Canada
5690 VIANET-NOCA false
186.81.231.104
 unknown Colombia
10620 TelmexColombiaSACO false
105.88.195.67
 unknown Egypt
36992 ETISALAT-MISREG false
125.129.129.79
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
167.199.163.161
 unknown United States
2897 GEORGIA-1US false
60.106.72.186
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
183.33.114.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
178.66.27.22
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
78.177.213.154
 unknown Turkey
9121 TTNETTR false
151.14.245.144
 unknown Italy
1267 ASN-WINDTREIUNETEU false
176.67.118.123
 unknown Palestinian Territory Occupied
51407 MADA-ASPS false
125.251.7.45
 unknown Korea Republic of
38394 GOESN-AS-KRGyeonggidoSeongnamOfficeofEducationKR false
24.1.63.186
 unknown United States
7922 COMCAST-7922US false
152.129.212.83
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
192.224.153.94
 unknown United States
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
108.229.79.74
 unknown United States
36351 SOFTLAYERUS false
144.87.113.133
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
172.222.135.80
 unknown United States
20115 CHARTER-20115US false
125.51.29.229
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
141.113.207.11
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
222.209.178.155
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
150.124.136.6
 unknown United States
3955 WANG-US-1US false
73.211.142.138
 unknown United States
7922 COMCAST-7922US false
200.95.68.54
 unknown Mexico
8151 UninetSAdeCVMX false
185.50.154.101
 unknown United Kingdom
50203 UK-REYNOLDS-ASNGB false
181.166.184.202
 unknown Argentina
10318 TelecomArgentinaSAAR false
17.230.241.199
 unknown United States
714 APPLE-ENGINEERINGUS false
181.163.84.100
 unknown Chile
7418 TELEFONICACHILESACL false
118.177.65.107
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
202.210.131.217
 unknown Japan 4686 BEKKOAMEBEKKOAMEINTERNETINCJP false
76.108.80.243
 unknown United States
7922 COMCAST-7922US false
59.255.163.36
 unknown China
37937 CNNIC-EGOVNET-APChinaeGovNetInformationCenterCN false
39.231.53.6
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false