Linux Analysis Report
wNJM6XQwaZ.elf

Overview

General Information

Sample name: wNJM6XQwaZ.elf
renamed because original name is a hash value
Original sample name: cf74d9cd40a277e48896f93b631e28f4.elf
Analysis ID: 1447594
MD5: cf74d9cd40a277e48896f93b631e28f4
SHA1: 50a1cbc7ec8f175536beddb3391900045defe17a
SHA256: cfb5c921083ca15e2a7e3aa40e2a1fb11da814b59da0215c1097504094013c34
Tags: 32elfmiraipowerpc
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: wNJM6XQwaZ.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: wNJM6XQwaZ.elf ReversingLabs: Detection: 42%
Source: wNJM6XQwaZ.elf Virustotal: Detection: 43% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:43346 -> 91.92.240.97:1312
Sample listens on a socket
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) Socket: 0.0.0.0::0 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.240.97
Source: unknown TCP traffic detected without corresponding DNS query: 212.5.70.212
Source: unknown TCP traffic detected without corresponding DNS query: 44.173.188.85
Source: unknown TCP traffic detected without corresponding DNS query: 244.246.195.85
Source: unknown TCP traffic detected without corresponding DNS query: 168.216.44.215
Source: unknown TCP traffic detected without corresponding DNS query: 194.139.30.35
Source: unknown TCP traffic detected without corresponding DNS query: 8.142.240.201
Source: unknown TCP traffic detected without corresponding DNS query: 27.204.89.81
Source: unknown TCP traffic detected without corresponding DNS query: 18.235.123.114
Source: unknown TCP traffic detected without corresponding DNS query: 105.204.65.27
Source: unknown TCP traffic detected without corresponding DNS query: 45.127.204.181
Source: unknown TCP traffic detected without corresponding DNS query: 153.104.6.146
Source: unknown TCP traffic detected without corresponding DNS query: 171.174.28.109
Source: unknown TCP traffic detected without corresponding DNS query: 97.85.175.74
Source: unknown TCP traffic detected without corresponding DNS query: 180.82.224.160
Source: unknown TCP traffic detected without corresponding DNS query: 181.100.105.105
Source: unknown TCP traffic detected without corresponding DNS query: 192.90.148.246
Source: unknown TCP traffic detected without corresponding DNS query: 152.74.107.100
Source: unknown TCP traffic detected without corresponding DNS query: 152.168.190.192
Source: unknown TCP traffic detected without corresponding DNS query: 205.141.238.171
Source: unknown TCP traffic detected without corresponding DNS query: 173.208.51.191
Source: unknown TCP traffic detected without corresponding DNS query: 207.190.242.47
Source: unknown TCP traffic detected without corresponding DNS query: 69.165.56.246
Source: unknown TCP traffic detected without corresponding DNS query: 2.205.72.155
Source: unknown TCP traffic detected without corresponding DNS query: 91.91.26.53
Source: unknown TCP traffic detected without corresponding DNS query: 166.18.36.221
Source: unknown TCP traffic detected without corresponding DNS query: 78.22.123.67
Source: unknown TCP traffic detected without corresponding DNS query: 241.20.238.182
Source: unknown TCP traffic detected without corresponding DNS query: 242.130.240.248
Source: unknown TCP traffic detected without corresponding DNS query: 212.168.39.60
Source: unknown TCP traffic detected without corresponding DNS query: 68.33.236.22
Source: unknown TCP traffic detected without corresponding DNS query: 42.170.232.92
Source: unknown TCP traffic detected without corresponding DNS query: 35.90.202.59
Source: unknown TCP traffic detected without corresponding DNS query: 171.86.187.154
Source: unknown TCP traffic detected without corresponding DNS query: 177.155.219.189
Source: unknown TCP traffic detected without corresponding DNS query: 161.147.245.129
Source: unknown TCP traffic detected without corresponding DNS query: 38.123.62.13
Source: unknown TCP traffic detected without corresponding DNS query: 171.85.184.197
Source: unknown TCP traffic detected without corresponding DNS query: 204.190.237.142
Source: unknown TCP traffic detected without corresponding DNS query: 105.66.191.22
Source: unknown TCP traffic detected without corresponding DNS query: 221.145.35.84
Source: unknown TCP traffic detected without corresponding DNS query: 83.101.26.23
Source: unknown TCP traffic detected without corresponding DNS query: 248.62.150.76
Source: unknown TCP traffic detected without corresponding DNS query: 175.85.189.17
Source: unknown TCP traffic detected without corresponding DNS query: 93.1.233.198
Source: unknown TCP traffic detected without corresponding DNS query: 8.123.192.61
Source: unknown TCP traffic detected without corresponding DNS query: 76.240.120.36
Source: unknown TCP traffic detected without corresponding DNS query: 203.84.203.27
Source: unknown TCP traffic detected without corresponding DNS query: 221.233.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 14.32.36.134
Source: wNJM6XQwaZ.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6272.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6272.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6274.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6274.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6398.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6398.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6276.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6276.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6282.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6282.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6405.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6405.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6394.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6394.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6388.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6388.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6272, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6272, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6282, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6282, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6394, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6394, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6398, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6398, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Sample tries to kill a process (SIGKILL)
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) SIGKILL sent: pid: 936, result: successful Jump to behavior
Yara signature match
Source: 6272.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6272.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6274.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6274.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6398.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6398.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6276.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6276.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6282.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6282.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6405.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6405.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6394.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6394.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6388.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6388.1.00007f38c400b000.00007f38c4014000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6272, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6272, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6274, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6276, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6282, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6282, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6394, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6394, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6398, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6398, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wNJM6XQwaZ.elf PID: 6405, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal68.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/491/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/793/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/772/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/796/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/774/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/797/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/777/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/799/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/658/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/912/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/759/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/936/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/918/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/1/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/761/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/785/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/884/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/720/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/721/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/788/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/789/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/800/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/801/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/847/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6274) File opened: /proc/904/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/491/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/793/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/772/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/796/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/774/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/797/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/777/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/799/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/658/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/912/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/759/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/936/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/918/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/1/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/761/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/785/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/884/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/720/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/721/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/788/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/789/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/800/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/801/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/847/fd Jump to behavior
Source: /tmp/wNJM6XQwaZ.elf (PID: 6280) File opened: /proc/904/fd Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: wNJM6XQwaZ.elf Submission file: segment LOAD with 7.955 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/wNJM6XQwaZ.elf (PID: 6272) Queries kernel information via 'uname': Jump to behavior
Source: wNJM6XQwaZ.elf, 6272.1.0000560f426b9000.0000560f42769000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: wNJM6XQwaZ.elf, 6274.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6388.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6405.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6394.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6276.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6398.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6282.1.0000560f426b9000.0000560f42769000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: wNJM6XQwaZ.elf, 6272.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6274.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6388.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6405.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6394.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6276.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6398.1.0000560f426b9000.0000560f42769000.rw-.sdmp, wNJM6XQwaZ.elf, 6282.1.0000560f426b9000.0000560f42769000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: wNJM6XQwaZ.elf, 6272.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6274.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6388.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6405.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6394.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6276.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6398.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6282.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: wNJM6XQwaZ.elf, 6272.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6274.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6388.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6405.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6394.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6276.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6398.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp, wNJM6XQwaZ.elf, 6282.1.00007ffcee67b000.00007ffcee69c000.rw-.sdmp Binary or memory string: c.x86_64/usr/bin/qemu-ppc/tmp/wNJM6XQwaZ.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wNJM6XQwaZ.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
222.112.249.252
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
157.159.2.12
 unknown France
2094 FR-TELECOM-MANAGEMENT-SUDPARISTelecomManagementSudPari false
198.222.27.55
 unknown United States
721 DNIC-ASBLK-00721-00726US false
151.131.142.192
 unknown United States
38595 RDCPL-AS-AUREDDIRTCOMMUNICATIONSPTYLTDAU false
80.189.219.79
 unknown United Kingdom
6871 PLUSNETUKInternetServiceProviderGB false
193.105.194.7
 unknown United Kingdom
196972 SKANET-PL false
166.135.50.235
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
249.17.141.75
 unknown Reserved
unknown unknown false
13.209.34.137
 unknown United States
16509 AMAZON-02US false
35.6.69.137
 unknown United States
36375 UMICH-AS-5US false
75.34.40.56
 unknown United States
7018 ATT-INTERNET4US false
167.177.234.84
 unknown United States
7800 ALLINA-HEALTH-SYSTEM-INCUS false
5.201.64.106
 unknown Poland
12324 LUBMAN-EDU-ASPolandLublinPL false
103.207.37.125
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
254.248.117.91
 unknown Reserved
unknown unknown false
158.160.21.6
 unknown Venezuela
721 DNIC-ASBLK-00721-00726US false
57.179.76.88
 unknown Belgium
2686 ATGS-MMD-ASUS false
130.225.89.225
 unknown Denmark
1835 FSKNET-DKForskningsnettet-DanishnetworkforResearchand false
199.34.73.10
 unknown Canada
30549 LAKELAND-NETWORKSCA false
178.134.55.152
 unknown Georgia
35805 SILKNET-ASGE false
74.184.166.182
 unknown United States
7018 ATT-INTERNET4US false
182.61.27.102
 unknown China
38365 BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd false
209.245.20.114
 unknown United States
3356 LEVEL3US false
254.137.224.197
 unknown Reserved
unknown unknown false
18.92.85.240
 unknown United States
3 MIT-GATEWAYSUS false
171.34.167.197
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
68.201.76.33
 unknown United States
11427 TWC-11427-TEXASUS false
125.194.199.248
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
65.72.198.90
 unknown United States
3491 BTN-ASNUS false
18.146.49.141
 unknown United States
16509 AMAZON-02US false
67.80.151.78
 unknown United States
6128 CABLE-NET-1US false
122.249.144.149
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
147.200.0.237
 unknown Australia
55542 RMSNET-AS-APRoadsandMaritimeServicesAU false
130.234.121.114
 unknown Finland
1741 FUNETASFI false
57.119.20.168
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
98.126.6.63
 unknown United States
35908 VPLSNETUS false
249.81.149.50
 unknown Reserved
unknown unknown false
123.30.215.217
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
243.234.199.98
 unknown Reserved
unknown unknown false
163.125.252.87
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
70.37.100.44
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
198.60.21.142
 unknown United States
210 WEST-NET-WESTUS false
167.93.80.81
 unknown United States
8103 STATE-OF-FLAUS false
184.108.65.235
 unknown United States
7922 COMCAST-7922US false
161.195.174.59
 unknown United States
263740 CorporacionLaceibanetsocietyHN false
143.28.20.53
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
193.162.116.19
 unknown Denmark
210210 REGION-MIDTJYLLAND-DK false
161.10.197.21
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
118.135.88.107
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
75.159.38.93
 unknown Canada
852 ASN852CA false
250.32.103.220
 unknown Reserved
unknown unknown false
75.20.117.181
 unknown United States
7018 ATT-INTERNET4US false
191.175.230.200
 unknown Brazil
26615 TIMSABR false
243.250.83.136
 unknown Reserved
unknown unknown false
247.250.141.60
 unknown Reserved
unknown unknown false
44.73.199.103
 unknown United States
7377 UCSDUS false
17.6.122.204
 unknown United States
714 APPLE-ENGINEERINGUS false
59.2.205.7
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
121.216.13.178
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
180.91.109.215
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
220.234.178.186
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
119.177.215.217
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
20.10.177.167
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
217.217.226.241
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
139.235.224.179
 unknown United States
1462 DNIC-ASBLK-01462-01463US false
166.68.79.118
 unknown United States
58681 NSWPOLSERV-AS-APNewSouthWalesPoliceAU false
152.75.141.106
 unknown United States
20137 USAGM-LANUS false
186.7.126.155
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
12.113.56.195
 unknown United States
7018 ATT-INTERNET4US false
108.6.54.185
 unknown United States
701 UUNETUS false
223.199.214.232
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
75.180.146.199
 unknown United States
14065 TWC-14065-COUDERSPORTUS false
124.135.242.48
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.31.187.169
 unknown Tunisia
37492 ORANGE-TN false
89.85.144.138
 unknown France
5410 BOUYGTEL-ISPFR false
222.106.198.180
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
62.141.160.96
 unknown Germany
20588 FVBDE false
200.137.211.254
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
34.96.145.73
 unknown United States
15169 GOOGLEUS false
4.131.82.69
 unknown United States
3356 LEVEL3US false
176.161.210.30
 unknown France
5410 BOUYGTEL-ISPFR false
196.15.169.2
 unknown South Africa
5713 SAIX-NETZA false
78.158.226.197
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
135.113.97.68
 unknown United States
10455 LUCENT-CIOUS false
124.110.28.51
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
93.77.161.15
 unknown Russian Federation
205515 TSCRIMEARU false
135.237.84.117
 unknown United States
10455 LUCENT-CIOUS false
117.229.75.255
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
86.221.210.166
 unknown France
3215 FranceTelecom-OrangeFR false
192.70.138.96
 unknown United States
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
23.26.70.87
 unknown United States
11798 ACEDATACENTERS-AS-1US false
146.194.60.180
 unknown United Kingdom
25049 STASCO-UK-ASManagedbySATelecom-LDMGB false
206.49.36.77
 unknown United States
5511 OPENTRANSITFR false
220.8.36.255
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
203.225.168.192
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
5.249.45.205
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
63.175.201.10
 unknown United States
1239 SPRINTLINKUS false
178.192.36.160
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
44.93.204.219
 unknown United States
7377 UCSDUS false
185.237.138.34
 unknown Spain
209984 WIBERES false