Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
robinbot

Overview

General Information

Sample Name:robinbot
Analysis ID:756090
MD5:500009d8f68330a8f82b59884a9afe47
SHA1:575f5e6894b1a2f7a728435487666acdb9758f83
SHA256:a46770913fba87921b56d789396e07cdfd68a846b2e80a77aa07e1c62f9304d6
Infos:

Detection

Mirai
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample deletes itself
Uses known network protocols on non-standard ports
Machine Learning detection for sample
Yara signature match
Sample contains strings that are potentially command strings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:756090
Start date and time:2022-11-29 16:32:34 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 55s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:robinbot
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Run name:Potential for more IOCs and behavior
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.evad.lin@0/0@0/0
  • VT rate limit hit for: http://89.203.251.188/bins.sh;$
Command:/tmp/robinbot
PID:6224
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • robinbot (PID: 6224, Parent: 6122, MD5: 500009d8f68330a8f82b59884a9afe47) Arguments: /tmp/robinbot
    • robinbot New Fork (PID: 6225, Parent: 6224)
      • robinbot New Fork (PID: 6226, Parent: 6225)
      • robinbot New Fork (PID: 6227, Parent: 6225)
      • robinbot New Fork (PID: 6228, Parent: 6225)
        • robinbot New Fork (PID: 6230, Parent: 6228)
  • cleanup
SourceRuleDescriptionAuthorStrings
robinbotSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x16200:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x16270:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x162e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x16350:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x163c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
robinbotMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0x117db:$x2: /dev/misc/watchdog
  • 0x117cd:$x3: /dev/watchdog
  • 0x1605e:$s1: LCOGQGPTGP
  • 0x15df9:$s3: CFOKLKQVPCVMP
  • 0x15de1:$s4: QWRGPTKQMP
  • 0x15d6c:$s5: HWCLVGAJ
  • 0x15f25:$s6: NKQVGLKLE
robinbotJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    robinbotJoeSecurity_Mirai_9Yara detected MiraiJoe Security
      robinbotJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        Click to see the 14 entries
        SourceRuleDescriptionAuthorStrings
        6227.1.0000000000400000.0000000000418000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
        • 0x16200:$xo1: oMXKNNC\x0D\x17\x0C\x12
        • 0x16270:$xo1: oMXKNNC\x0D\x17\x0C\x12
        • 0x162e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
        • 0x16350:$xo1: oMXKNNC\x0D\x17\x0C\x12
        • 0x163c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
        6227.1.0000000000400000.0000000000418000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
        • 0x117db:$x2: /dev/misc/watchdog
        • 0x117cd:$x3: /dev/watchdog
        • 0x1605e:$s1: LCOGQGPTGP
        • 0x15df9:$s3: CFOKLKQVPCVMP
        • 0x15de1:$s4: QWRGPTKQMP
        • 0x15d6c:$s5: HWCLVGAJ
        • 0x15f25:$s6: NKQVGLKLE
        6227.1.0000000000400000.0000000000418000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6227.1.0000000000400000.0000000000418000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
            6227.1.0000000000400000.0000000000418000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
              Click to see the 58 entries
              No Snort rule has matched

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: robinbotVirustotal: Detection: 65%Perma Link
              Source: robinbotReversingLabs: Detection: 61%
              Source: robinbotJoe Sandbox ML: detected

              Networking

              barindex
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48294
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48298
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48304
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48280
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48332
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48346
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48350
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48356
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48310
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48356
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48362
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48366
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48358
              Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48362
              Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:57518 -> 41.19.218.223:80
              Source: global trafficTCP traffic: 192.168.2.23:52822 -> 89.7.104.165:80
              Source: global trafficTCP traffic: 192.168.2.23:45694 -> 42.52.227.192:80
              Source: global trafficTCP traffic: 192.168.2.23:59786 -> 42.184.7.37:80
              Source: global trafficTCP traffic: 192.168.2.23:43154 -> 1.54.169.217:80
              Source: global trafficTCP traffic: 192.168.2.23:51766 -> 62.168.10.60:80
              Source: global trafficTCP traffic: 192.168.2.23:60452 -> 130.43.149.208:80
              Source: global trafficTCP traffic: 192.168.2.23:53296 -> 14.12.74.189:80
              Source: global trafficTCP traffic: 192.168.2.23:51174 -> 61.236.226.235:80
              Source: global trafficTCP traffic: 192.168.2.23:42628 -> 67.162.87.213:80
              Source: global trafficTCP traffic: 192.168.2.23:58512 -> 70.22.69.171:80
              Source: global trafficTCP traffic: 192.168.2.23:57016 -> 77.147.6.59:80
              Source: global trafficTCP traffic: 192.168.2.23:44714 -> 156.192.217.220:80
              Source: global trafficTCP traffic: 192.168.2.23:52954 -> 90.45.174.46:80
              Source: global trafficTCP traffic: 192.168.2.23:34446 -> 190.68.254.62:80
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 163.151.162.85:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 104.142.173.149:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 209.184.177.135:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 137.243.81.5:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.206.168.216:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 19.135.140.179:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 197.239.84.85:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 200.92.245.153:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 116.67.119.148:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 141.120.197.91:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 65.154.218.40:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 124.212.254.113:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 163.136.220.64:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 160.154.217.169:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 42.100.191.234:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.137.192.245:2323
              Source: global trafficTCP traffic: 192.168.2.23:35656 -> 189.87.192.206:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 135.149.49.5:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 147.79.64.93:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.178.111.66:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 75.55.208.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 160.142.234.100:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 173.9.184.220:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 187.224.94.159:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 105.123.130.198:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.222.104.130:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 200.214.123.249:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 54.6.154.146:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 55.85.248.107:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 65.170.196.42:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 107.89.146.145:2323
              Source: global trafficTCP traffic: 192.168.2.23:51198 -> 89.203.251.188:7267
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 143.144.130.65:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.100.246.114:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 204.213.205.118:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.70.201.148:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 114.154.146.252:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 84.126.30.181:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 72.96.228.219:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 5.249.17.203:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 29.105.195.127:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 50.40.194.3:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 162.78.6.107:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 220.202.211.41:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.36.64.44:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.131.111.14:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 23.22.98.112:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 109.11.173.177:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 223.6.247.130:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 107.233.118.154:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 110.140.165.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.179.158.49:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 105.66.194.214:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 94.26.22.117:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 119.11.139.79:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 75.26.181.151:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 213.4.250.93:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 169.173.222.182:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 48.236.86.172:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 15.192.178.237:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 79.83.63.161:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 1.136.86.171:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 67.151.50.197:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 75.6.93.112:2323
              Source: global trafficTCP traffic: 192.168.2.23:32822 -> 187.97.44.133:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 95.52.106.171:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 33.148.92.70:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.149.147.150:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 108.208.102.205:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 171.173.99.26:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 130.216.49.6:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 96.158.69.6:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 93.51.139.184:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 216.46.203.199:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 119.249.93.179:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.212.150.123:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 82.232.99.98:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 165.251.205.13:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 62.112.225.121:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.204.80.148:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 96.83.234.242:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.214.55.57:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 106.189.126.165:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.4.227.195:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 71.181.130.227:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.109.14.17:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 160.30.6.161:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.117.53.207:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 79.95.201.126:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.193.18.50:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.64.21.84:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 207.100.22.63:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.25.164.58:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 88.170.167.42:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 177.223.99.112:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 31.233.64.156:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 153.116.66.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 17.174.21.93:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 161.84.160.216:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 79.117.93.26:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 64.10.38.215:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 128.75.30.64:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 16.66.216.208:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 222.134.132.190:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 80.177.116.178:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 89.60.180.230:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 186.130.167.134:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 114.91.131.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 87.141.30.72:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 32.227.145.174:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 108.73.29.204:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 106.155.152.197:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 124.65.63.81:2323
              Source: global trafficTCP traffic: 192.168.2.23:54272 -> 189.216.57.108:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 11.218.149.26:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 110.210.0.7:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 157.169.77.132:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 132.161.54.74:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 5.135.137.173:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 31.220.244.241:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 187.192.10.153:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 3.231.89.198:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.97.197.218:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 113.38.186.195:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 89.63.29.167:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 43.38.71.86:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 71.118.231.208:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 183.250.197.133:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 181.180.110.135:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 71.148.112.115:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 70.235.235.75:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 32.52.35.23:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 221.142.142.57:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 180.211.170.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 85.231.39.47:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 183.131.151.92:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 195.34.132.90:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 50.5.252.251:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 212.233.55.201:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 75.97.244.246:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 52.180.129.119:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 67.141.38.213:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 177.133.155.80:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 116.186.50.145:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 116.212.180.80:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 62.196.12.160:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 136.8.93.180:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 164.57.193.76:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 46.167.217.53:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 98.121.27.54:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 157.95.21.205:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 43.160.254.106:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 72.228.102.105:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 94.17.137.86:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 137.106.150.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 22.136.128.97:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.35.160.212:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 71.211.243.4:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 121.110.73.27:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 33.132.113.87:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 167.158.157.57:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 189.249.205.243:2323
              Source: global trafficTCP traffic: 192.168.2.23:42946 -> 189.247.194.199:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 200.151.49.59:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 142.121.197.7:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 77.66.22.4:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 199.87.129.117:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 8.129.133.147:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 95.195.226.70:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 13.42.219.133:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 21.117.53.252:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 154.151.66.94:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 122.66.123.169:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 121.39.224.137:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 102.229.168.3:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.111.126.19:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.191.181.20:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 143.98.42.186:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 153.214.121.126:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 163.37.245.24:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 54.31.132.214:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 113.245.14.6:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 168.97.206.194:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 109.27.179.30:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 179.95.137.156:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 189.116.191.64:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 108.228.239.195:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 51.245.110.17:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 157.80.239.181:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 52.65.175.98:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 39.246.123.239:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 95.38.160.52:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.82.51.33:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 167.181.60.65:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.210.145.46:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.122.105.221:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 108.240.60.197:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 220.148.44.31:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 144.252.121.112:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.171.118.135:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 27.135.198.213:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 213.226.154.87:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 16.133.163.123:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 166.247.194.109:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 176.98.151.86:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 118.191.83.238:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.215.225.207:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 123.172.10.234:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 137.160.241.156:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 140.164.70.61:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 176.189.183.229:2323
              Source: global trafficTCP traffic: 192.168.2.23:36578 -> 187.100.5.250:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 25.158.61.237:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 93.120.73.32:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 121.151.162.233:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 154.230.112.114:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 24.178.223.210:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 188.127.51.54:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 68.42.44.95:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 89.232.237.134:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 137.98.13.32:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 100.16.103.72:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 214.199.75.211:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 163.4.151.124:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 165.216.141.58:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 166.231.158.138:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 134.162.203.241:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 97.217.0.76:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 173.78.32.4:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.130.20.252:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 16.76.40.204:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 77.110.228.69:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 159.232.28.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 133.162.195.74:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 167.241.180.160:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.144.16.201:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 39.169.161.170:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 22.253.251.152:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 138.31.232.216:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 81.164.55.227:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 211.69.184.58:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 197.47.245.230:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 202.188.206.186:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 179.137.100.52:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 182.19.32.242:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 94.98.36.29:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 12.28.211.180:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 157.77.58.92:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 205.218.25.88:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 99.252.11.90:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 176.173.120.82:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 86.82.172.87:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.136.212.224:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 38.12.182.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 101.251.200.37:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 206.174.59.37:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 88.85.4.247:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 40.160.100.143:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 132.90.101.151:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 28.31.41.64:2323
              Source: global trafficTCP traffic: 192.168.2.23:57892 -> 189.240.214.253:8080
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.106.171.171:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 213.28.207.62:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 44.169.176.34:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 208.49.2.235:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 87.172.47.29:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 136.150.139.165:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 170.148.57.189:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 87.231.69.247:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 14.112.6.22:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 144.156.168.243:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.143.139.76:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 61.31.61.166:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 93.6.141.88:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.32.109.152:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 64.131.172.234:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 182.100.127.241:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 38.53.169.75:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 89.181.137.217:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 223.13.96.239:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 35.214.167.127:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 213.26.177.67:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 194.192.233.146:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 34.54.140.135:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 5.235.72.161:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 50.58.82.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 206.111.251.131:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.161.7.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 60.0.124.107:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 120.91.144.249:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.230.152.173:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 90.174.220.215:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 50.235.140.85:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 77.90.52.153:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 177.119.63.81:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 111.16.121.190:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 46.182.220.209:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.177.66.65:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 201.194.213.163:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 170.29.34.69:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 102.103.170.71:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 215.171.159.186:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 142.20.224.115:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 177.186.127.21:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 119.111.201.100:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 118.214.161.25:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 70.243.213.196:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 117.95.253.203:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 129.124.11.12:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 200.147.114.187:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 162.97.64.220:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 48.247.33.61:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.125.31.69:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 157.187.29.122:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.4.225.193:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 5.174.242.76:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 189.118.206.169:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 34.45.11.226:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 66.190.222.250:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 194.16.130.68:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 49.208.128.105:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.26.243.37:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 125.129.106.24:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 142.89.106.225:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 29.239.49.207:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 206.54.67.169:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 87.137.17.71:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 26.120.91.80:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 163.206.149.159:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 46.104.71.10:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.105.48.142:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 34.74.43.39:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 139.63.207.192:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 165.134.200.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 80.35.42.82:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 26.206.51.113:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.3.211.83:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 174.117.4.66:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 69.27.106.198:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 27.196.55.65:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 191.190.101.43:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 7.100.196.77:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 223.235.237.247:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 32.139.196.31:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 116.226.248.24:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 11.138.34.229:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 63.163.210.44:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 57.122.126.26:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 20.28.167.181:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 52.12.222.75:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 80.150.184.88:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 207.235.218.20:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 86.156.83.49:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 119.41.214.13:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 40.131.116.46:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 48.171.171.13:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 176.157.22.236:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 152.225.87.2:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 120.195.196.194:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 174.49.171.110:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 190.25.160.23:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 104.110.14.127:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 197.228.249.212:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 24.16.123.88:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 135.112.229.64:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.105.238.87:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 130.77.222.130:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 140.128.233.158:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 182.58.214.177:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 89.199.152.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 118.168.107.79:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 18.147.176.235:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 141.170.237.180:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 134.79.8.254:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 189.174.63.104:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.26.211.204:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 216.236.152.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.57.91.27:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.71.7.44:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 70.189.69.124:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 222.121.133.154:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 169.104.137.212:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 53.115.10.93:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 19.18.200.189:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 22.82.221.116:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 112.245.168.3:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 29.15.190.218:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 64.200.135.139:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 11.27.196.73:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 203.87.47.198:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 58.153.107.97:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 136.240.123.140:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 78.30.243.129:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 16.95.158.176:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 81.196.45.185:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 114.81.147.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 62.40.69.187:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 211.25.222.147:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 17.235.32.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 52.112.207.23:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 143.202.57.45:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 70.18.7.113:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 174.5.235.54:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 81.37.108.145:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 146.189.54.185:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 18.63.28.132:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 170.43.196.32:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 196.163.206.25:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 21.208.124.218:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.179.136.212:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 12.77.192.43:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 54.118.61.26:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 48.116.238.228:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 65.65.38.8:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 68.231.100.23:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 39.224.101.206:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 35.154.83.136:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 102.43.107.17:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.239.156.229:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.27.124.239:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 50.114.238.139:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 221.245.168.11:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 16.200.228.146:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 138.208.200.129:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 9.208.140.99:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 164.114.171.149:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 11.221.212.36:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 17.10.184.206:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 155.241.32.20:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 56.111.12.135:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 106.59.169.83:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 110.226.20.221:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 65.96.72.16:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 191.181.254.114:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 182.200.251.25:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 84.128.2.87:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 221.229.171.143:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 158.140.78.217:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 76.193.60.210:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 75.60.160.62:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 105.128.30.241:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 76.210.130.111:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 87.75.40.107:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 106.124.131.103:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 141.30.188.219:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 136.58.33.40:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 90.172.14.195:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 96.35.244.158:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 82.232.221.168:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 198.200.39.12:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 61.158.28.118:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 138.152.208.119:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 104.226.236.51:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 193.212.118.29:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 84.76.241.115:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 2.34.22.127:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 190.230.108.14:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.93.96.214:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 189.22.133.229:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 84.19.97.169:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 208.64.139.172:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 135.144.71.99:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 215.137.36.132:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 148.121.142.133:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 74.57.187.35:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.235.17.12:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 151.53.234.146:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 150.220.127.86:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 92.48.238.199:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 80.170.249.10:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 71.66.123.172:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 149.168.181.31:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 222.188.234.248:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 90.37.39.111:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 90.237.87.170:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 81.249.48.177:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 82.120.87.140:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 219.222.67.84:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 90.135.15.215:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 43.91.72.217:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 162.47.51.40:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 83.143.126.84:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 1.112.185.160:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 145.136.121.83:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 171.120.78.133:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 168.4.178.199:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 128.195.154.83:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 45.149.70.140:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 173.134.247.203:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 123.219.179.85:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 23.154.216.203:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 117.120.62.159:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 185.222.4.20:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 19.113.215.184:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 14.29.219.125:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 128.186.201.61:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 68.11.105.134:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 91.222.141.174:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 115.106.197.182:2323
              Source: global trafficTCP traffic: 192.168.2.23:64904 -> 52.135.136.123:2323
              Source: /tmp/robinbot (PID: 6226)Socket: 0.0.0.0::23Jump to behavior
              Source: /tmp/robinbot (PID: 6226)Socket: 0.0.0.0::0Jump to behavior
              Source: /tmp/robinbot (PID: 6226)Socket: 0.0.0.0::80Jump to behavior
              Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 163.151.162.85
              Source: unknownTCP traffic detected without corresponding DNS query: 83.190.241.252
              Source: unknownTCP traffic detected without corresponding DNS query: 20.19.233.226
              Source: unknownTCP traffic detected without corresponding DNS query: 45.81.142.31
              Source: unknownTCP traffic detected without corresponding DNS query: 86.8.87.39
              Source: unknownTCP traffic detected without corresponding DNS query: 167.5.212.208
              Source: unknownTCP traffic detected without corresponding DNS query: 82.130.119.117
              Source: unknownTCP traffic detected without corresponding DNS query: 27.153.74.237
              Source: unknownTCP traffic detected without corresponding DNS query: 54.213.36.74
              Source: unknownTCP traffic detected without corresponding DNS query: 88.61.106.82
              Source: unknownTCP traffic detected without corresponding DNS query: 104.142.173.149
              Source: unknownTCP traffic detected without corresponding DNS query: 95.60.53.181
              Source: unknownTCP traffic detected without corresponding DNS query: 17.50.61.226
              Source: unknownTCP traffic detected without corresponding DNS query: 196.140.221.108
              Source: unknownTCP traffic detected without corresponding DNS query: 206.35.61.39
              Source: unknownTCP traffic detected without corresponding DNS query: 180.180.89.207
              Source: unknownTCP traffic detected without corresponding DNS query: 223.167.249.150
              Source: unknownTCP traffic detected without corresponding DNS query: 44.14.123.140
              Source: unknownTCP traffic detected without corresponding DNS query: 202.48.66.143
              Source: unknownTCP traffic detected without corresponding DNS query: 188.159.123.206
              Source: unknownTCP traffic detected without corresponding DNS query: 209.184.177.135
              Source: unknownTCP traffic detected without corresponding DNS query: 46.21.99.14
              Source: unknownTCP traffic detected without corresponding DNS query: 60.220.164.58
              Source: unknownTCP traffic detected without corresponding DNS query: 122.6.32.167
              Source: unknownTCP traffic detected without corresponding DNS query: 147.27.52.221
              Source: unknownTCP traffic detected without corresponding DNS query: 76.245.236.136
              Source: unknownTCP traffic detected without corresponding DNS query: 150.104.214.104
              Source: unknownTCP traffic detected without corresponding DNS query: 160.9.111.142
              Source: unknownTCP traffic detected without corresponding DNS query: 147.71.201.65
              Source: unknownTCP traffic detected without corresponding DNS query: 219.172.207.151
              Source: unknownTCP traffic detected without corresponding DNS query: 137.243.81.5
              Source: unknownTCP traffic detected without corresponding DNS query: 13.96.107.89
              Source: unknownTCP traffic detected without corresponding DNS query: 121.113.44.14
              Source: unknownTCP traffic detected without corresponding DNS query: 213.89.225.108
              Source: unknownTCP traffic detected without corresponding DNS query: 193.185.85.99
              Source: unknownTCP traffic detected without corresponding DNS query: 66.68.113.85
              Source: unknownTCP traffic detected without corresponding DNS query: 11.186.151.230
              Source: unknownTCP traffic detected without corresponding DNS query: 104.103.254.113
              Source: unknownTCP traffic detected without corresponding DNS query: 91.80.118.85
              Source: unknownTCP traffic detected without corresponding DNS query: 194.34.99.79
              Source: unknownTCP traffic detected without corresponding DNS query: 2.206.168.216
              Source: unknownTCP traffic detected without corresponding DNS query: 67.26.77.133
              Source: unknownTCP traffic detected without corresponding DNS query: 95.62.219.106
              Source: unknownTCP traffic detected without corresponding DNS query: 90.208.83.53
              Source: unknownTCP traffic detected without corresponding DNS query: 33.201.138.99
              Source: unknownTCP traffic detected without corresponding DNS query: 188.218.71.100
              Source: unknownTCP traffic detected without corresponding DNS query: 39.27.47.6
              Source: unknownTCP traffic detected without corresponding DNS query: 125.194.52.215
              Source: robinbotString found in binary or memory: http://89.203.251.188/bin.sh;chmod
              Source: robinbotString found in binary or memory: http://89.203.251.188/bins.sh
              Source: robinbotString found in binary or memory: http://89.203.251.188/bins.sh;$
              Source: robinbotString found in binary or memory: http://89.203.251.188/bins.sh;chmod
              Source: robinbotString found in binary or memory: http://89.203.251.188/bins.sh;sh
              Source: robinbotString found in binary or memory: http://89.203.251.188/bins.sh;sh$
              Source: robinbotString found in binary or memory: http://89.203.251.188/mips
              Source: robinbotString found in binary or memory: http://89.203.251.188/mipsel
              Source: robinbotString found in binary or memory: http://purenetworks.com/HNAP1/
              Source: robinbotString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: robinbotString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

              System Summary

              barindex
              Source: robinbot, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
              Source: 6227.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
              Source: 6226.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
              Source: 6224.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
              Source: robinbot, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
              Source: robinbot, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
              Source: robinbot, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b