Linux Analysis Report
SjLTg00G6b.elf

Overview

General Information

Sample name: SjLTg00G6b.elf
renamed because original name is a hash value
Original sample name: 1be1b7f19a2874356e911641c0a73fd2.elf
Analysis ID: 1447593
MD5: 1be1b7f19a2874356e911641c0a73fd2
SHA1: 3f6a56fcbf1a311c31ac9248993ef885bec7a286
SHA256: bf465cd696a886c140438f5d42f192238ea8b85015363920edcc46dec4e332ee
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SjLTg00G6b.elf Virustotal: Detection: 25% Perma Link
Source: SjLTg00G6b.elf ReversingLabs: Detection: 34%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:59378 -> 91.92.240.97:1312
Sample listens on a socket
Source: /tmp/SjLTg00G6b.elf (PID: 5501) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) Socket: 0.0.0.0::37215 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.240.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.240.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.240.97
Source: unknown TCP traffic detected without corresponding DNS query: 85.116.135.221
Source: unknown TCP traffic detected without corresponding DNS query: 88.250.255.220
Source: unknown TCP traffic detected without corresponding DNS query: 223.24.217.142
Source: unknown TCP traffic detected without corresponding DNS query: 69.76.248.19
Source: unknown TCP traffic detected without corresponding DNS query: 221.7.25.0
Source: unknown TCP traffic detected without corresponding DNS query: 169.142.28.221
Source: unknown TCP traffic detected without corresponding DNS query: 76.31.249.198
Source: unknown TCP traffic detected without corresponding DNS query: 38.35.6.26
Source: unknown TCP traffic detected without corresponding DNS query: 149.151.130.120
Source: unknown TCP traffic detected without corresponding DNS query: 105.92.246.246
Source: unknown TCP traffic detected without corresponding DNS query: 17.103.68.104
Source: unknown TCP traffic detected without corresponding DNS query: 8.215.72.128
Source: unknown TCP traffic detected without corresponding DNS query: 74.76.58.240
Source: unknown TCP traffic detected without corresponding DNS query: 172.240.124.85
Source: unknown TCP traffic detected without corresponding DNS query: 84.109.33.70
Source: unknown TCP traffic detected without corresponding DNS query: 95.43.234.225
Source: unknown TCP traffic detected without corresponding DNS query: 46.242.37.167
Source: unknown TCP traffic detected without corresponding DNS query: 61.238.226.173
Source: unknown TCP traffic detected without corresponding DNS query: 180.79.122.196
Source: unknown TCP traffic detected without corresponding DNS query: 74.253.37.100
Source: unknown TCP traffic detected without corresponding DNS query: 111.83.252.128
Source: unknown TCP traffic detected without corresponding DNS query: 195.237.177.53
Source: unknown TCP traffic detected without corresponding DNS query: 90.78.150.197
Source: unknown TCP traffic detected without corresponding DNS query: 147.218.168.172
Source: unknown TCP traffic detected without corresponding DNS query: 165.149.226.217
Source: unknown TCP traffic detected without corresponding DNS query: 123.255.66.42
Source: unknown TCP traffic detected without corresponding DNS query: 12.24.81.90
Source: unknown TCP traffic detected without corresponding DNS query: 218.1.249.178
Source: unknown TCP traffic detected without corresponding DNS query: 249.71.190.234
Source: unknown TCP traffic detected without corresponding DNS query: 60.98.39.247
Source: unknown TCP traffic detected without corresponding DNS query: 186.33.134.243
Source: unknown TCP traffic detected without corresponding DNS query: 145.140.74.209
Source: unknown TCP traffic detected without corresponding DNS query: 97.155.158.18
Source: unknown TCP traffic detected without corresponding DNS query: 147.6.140.155
Source: unknown TCP traffic detected without corresponding DNS query: 2.201.56.71
Source: unknown TCP traffic detected without corresponding DNS query: 60.224.64.155
Source: unknown TCP traffic detected without corresponding DNS query: 241.197.109.194
Source: unknown TCP traffic detected without corresponding DNS query: 18.140.33.29
Source: unknown TCP traffic detected without corresponding DNS query: 240.25.225.228
Source: unknown TCP traffic detected without corresponding DNS query: 128.13.185.250
Source: unknown TCP traffic detected without corresponding DNS query: 245.58.253.226
Source: unknown TCP traffic detected without corresponding DNS query: 114.217.143.96
Source: unknown TCP traffic detected without corresponding DNS query: 8.255.28.55
Source: unknown TCP traffic detected without corresponding DNS query: 209.79.18.251
Source: unknown TCP traffic detected without corresponding DNS query: 253.137.61.251
Source: unknown TCP traffic detected without corresponding DNS query: 135.46.63.102
Source: unknown TCP traffic detected without corresponding DNS query: 213.97.248.95
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: SjLTg00G6b.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5501, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5501, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5622, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5622, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5629, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5629, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5634, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5634, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5644, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SjLTg00G6b.elf PID: 5644, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/SjLTg00G6b.elf (PID: 5501) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) SIGKILL sent: pid: 933, result: successful Jump to behavior
Yara signature match
Source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5501, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5501, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5503, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5622, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5622, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5629, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5629, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5634, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5634, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5644, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SjLTg00G6b.elf PID: 5644, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@4/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/490/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/793/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/794/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/850/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/796/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/777/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/931/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/658/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/779/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/812/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/933/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/917/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/782/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/1/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/764/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/766/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/723/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/789/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/800/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/888/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/724/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/802/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/803/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5501) File opened: /proc/804/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/490/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/793/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/794/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/850/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/796/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/777/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/931/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/658/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/779/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/812/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/933/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/917/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/782/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/1/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/764/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/766/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/723/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/789/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/800/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/888/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/724/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/802/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/803/fd Jump to behavior
Source: /tmp/SjLTg00G6b.elf (PID: 5507) File opened: /proc/804/fd Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: SjLTg00G6b.elf Submission file: segment LOAD with 7.9554 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SjLTg00G6b.elf (PID: 5499) Queries kernel information via 'uname': Jump to behavior
Source: SjLTg00G6b.elf, 5499.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5501.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5629.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5644.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5634.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5503.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5622.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5508.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: SjLTg00G6b.elf, 5499.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5501.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5629.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5644.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5634.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5503.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5622.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5508.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp Binary or memory string: b3x86_64/usr/bin/qemu-arm/tmp/SjLTg00G6b.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SjLTg00G6b.elf
Source: SjLTg00G6b.elf, 5499.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5501.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5629.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5644.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5634.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5503.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5622.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp, SjLTg00G6b.elf, 5508.1.000055c82eb6e000.000055c82ed3c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: SjLTg00G6b.elf, 5499.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5501.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5629.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5644.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5634.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5503.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5622.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp, SjLTg00G6b.elf, 5508.1.00007ffcd2490000.00007ffcd24b1000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5634.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5622.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5644.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5501.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5629.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5503.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5499.1.00007f4734017000.00007f473402b000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
86.251.252.143
 unknown France
3215 FranceTelecom-OrangeFR false
105.191.121.14
 unknown Morocco
36925 ASMediMA false
171.132.29.199
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
37.35.209.246
 unknown Spain
12479 UNI2-ASES false
176.216.209.179
 unknown Turkey
8386 KOCNETTR false
27.251.50.221
 unknown India
10201 DWL-AS-INDishnetWirelessLimitedBroadbandWirelessIN false
133.160.230.245
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
97.126.179.209
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
212.183.169.114
 unknown Italy
41497 AS_QCOMIT false
178.114.241.23
 unknown Austria
8437 UTA-ASAT false
136.18.177.247
 unknown United States
60311 ONEFMCH false
109.104.0.160
 unknown Sweden
33885 OWNITKatarinavagen15SE false
163.103.37.178
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
196.233.71.227
 unknown Tunisia
37492 ORANGE-TN false
39.237.105.51
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
192.38.105.146
 unknown Denmark
1835 FSKNET-DKForskningsnettet-DanishnetworkforResearchand false
170.17.10.15
 unknown United States
26039 ATHENE-USAUS false
65.20.206.157
 unknown United States
199592 CP-ASDE false
38.89.76.148
 unknown United States
174 COGENT-174US false
106.245.106.20
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
116.100.100.230
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
156.149.192.221
 unknown New Zealand
137 ASGARRConsortiumGARREU false
168.137.76.232
 unknown United States
26989 HR-WORLD-HEADQUARTERSUS false
23.187.178.48
 unknown Reserved
395678 VC-AS-01US false
151.173.4.95
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
39.230.204.71
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
250.176.203.60
 unknown Reserved
unknown unknown false
147.61.239.101
 unknown United States
4193 WA-STATE-GOVUS false
125.221.91.139
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
104.132.49.99
 unknown United States
36384 GOOGLE-ITUS false
78.0.185.229
 unknown Croatia (LOCAL Name: Hrvatska)
5391 T-HTCroatianTelecomIncHR false
183.148.55.48
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.92.72.45
 unknown United States
3 MIT-GATEWAYSUS false
60.174.126.80
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
212.176.60.254
 unknown Russian Federation
2854 ROSPRINT-ASRU false
185.100.7.132
 unknown France
35393 EURO-WEB-ASFR false
197.234.167.167
 unknown South Africa
37315 CipherWaveZA false
111.34.213.62
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
96.23.248.128
 unknown Canada
5769 VIDEOTRONCA false
65.151.18.22
 unknown United States
395505 IMANAGEUS false
210.198.12.220
 unknown Japan 7514 MEXComputerEngineeringConsultingLtdJP false
141.231.140.22
 unknown United Kingdom
12701 BARCAPLondonGB false
117.114.195.181
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
179.144.245.92
 unknown Brazil
26599 TELEFONICABRASILSABR false
66.163.125.148
 unknown United States
29877 STS-TELECOM-AS-1US false
186.16.123.7
 unknown Paraguay
23201 TelecelSAPY false
63.29.248.183
 unknown United States
701 UUNETUS false
204.120.44.55
 unknown United States
1239 SPRINTLINKUS false
34.128.90.81
 unknown United States
2686 ATGS-MMD-ASUS false
120.203.223.211
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
173.132.231.28
 unknown United States
10507 SPCSUS false
150.134.68.180
 unknown United States
30499 YSU-ASUS false
179.93.120.173
 unknown Brazil
26599 TELEFONICABRASILSABR false
93.203.122.4
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
38.21.161.44
 unknown United States
11738 BLIP-NETWORKSUS false
75.210.162.19
 unknown United States
22394 CELLCOUS false
99.104.21.197
 unknown United States
7018 ATT-INTERNET4US false
244.21.69.209
 unknown Reserved
unknown unknown false
152.17.230.86
 unknown United States
40245 WAKE-FOREST-UNIVERSITYUS false
210.144.161.233
 unknown Japan 4673 INTERVIANTTDATACORPORATIONJP false
209.172.239.49
 unknown United States
393289 MERCERU-GA-ASNUS false
133.222.94.73
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
20.1.227.168
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
210.63.139.171
 unknown Taiwan; Republic of China (ROC)
9924 TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi false
77.116.122.92
 unknown Austria
25255 H3G-AUSTRIA-ASTELE2AUSTRIAAT false
67.149.12.124
 unknown United States
12083 WOW-INTERNETUS false
102.176.4.210
 unknown Ghana
29614 GHANATEL-ASGH false
190.153.214.40
 unknown Chile
14259 GtdInternetSACL false
84.209.150.143
 unknown Norway
41164 GET-NOGETNorwayNO false
87.109.111.43
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
164.133.154.31
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
193.212.192.192
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
74.55.227.241
 unknown United States
36351 SOFTLAYERUS false
111.214.188.211
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
59.79.11.118
 unknown China
24364 CNGI-SH-IX-AS-APCERNET2IXatShanghaiJiaotongUniversity false
140.252.14.116
 unknown United States
62600 ABOR-SUN-CORRIDORUS false
8.215.228.207
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
87.166.207.154
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
115.198.134.139
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
87.212.98.52
 unknown Netherlands
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
104.208.173.166
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
135.218.59.167
 unknown United States
797 AMERITECH-ASUS false
155.67.50.159
 unknown United States
37532 ZAMRENZM false
88.223.11.67
 unknown Lithuania
39354 INIT-MGNT-LT false
113.196.210.18
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
139.235.224.167
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
150.37.108.90
 unknown Japan 59104 SOKAU-ASSokaUniversityJP false
68.151.112.43
 unknown Canada
6327 SHAWCA false
101.217.88.18
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
70.13.52.41
 unknown United States
10507 SPCSUS false
34.96.158.190
 unknown United States
15169 GOOGLEUS false
4.95.190.205
 unknown United States
3356 LEVEL3US false
9.150.23.16
 unknown United States
3356 LEVEL3US false
135.162.10.211
 unknown United States
14962 NCR-252US false
200.52.52.7
 unknown Mexico
6503 AxtelSABdeCVMX false
40.115.125.68
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
247.57.121.73
 unknown Reserved
unknown unknown false
178.2.222.149
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
148.213.58.105
 unknown Mexico
15236 UniversidaddeColimaMX false
135.48.241.92
 unknown United States
54614 CIKTELECOM-CABLECA false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true