Linux Analysis Report
botnet.x86.elf

Overview

General Information

Sample name: botnet.x86.elf
Analysis ID: 1565970
MD5: 314e47a19a41a1d9feef57acf84fb90f
SHA1: d454a597ffd189e05ba563abcb565f2f175b1e85
SHA256: 7500119c868dcfb473052782666d058e390d845cc61569a66656006efc5e2b6d
Tags: elfuser-persistny
Infos:

Detection

Mirai, Moobot
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Moobot
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: botnet.x86.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: botnet.x86.elf Virustotal: Detection: 50% Perma Link
Machine Learning detection for sample
Source: botnet.x86.elf Joe Sandbox ML: detected

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.15:44226 -> 176.123.160.241:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.15:44758 -> 176.123.160.241:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.15:45016 -> 176.123.160.241:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.15:45274 -> 176.123.160.241:56744
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:44226 -> 176.123.160.241:56744
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 134.120.53.57:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 166.135.151.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 163.22.233.93:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 213.192.19.178:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 20.109.136.232:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 97.39.117.162:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 202.46.61.197:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 133.149.216.206:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 146.224.232.6:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.91.67.140:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 185.49.177.110:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 186.178.45.76:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 88.163.188.60:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 17.233.44.146:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 157.130.14.212:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 116.29.130.238:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 77.192.12.16:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 132.189.133.105:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 205.184.245.123:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 199.15.60.35:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 91.242.195.43:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 84.203.184.42:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 1.114.28.29:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 90.33.88.174:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 166.77.127.141:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 61.43.14.211:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 40.180.107.38:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 183.56.65.107:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 187.209.39.170:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 163.170.14.43:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 35.203.40.6:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 170.100.25.171:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 181.177.144.177:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 76.88.47.54:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 9.206.145.102:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 139.141.154.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 173.204.89.77:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 66.211.237.238:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 95.162.82.30:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 77.111.139.237:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 104.100.166.126:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 143.82.47.17:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 204.106.27.59:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 74.191.233.154:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 212.149.164.53:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 61.47.15.54:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 93.124.117.122:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 58.21.223.33:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.76.33.27:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 130.124.179.228:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 141.172.175.179:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 189.137.161.99:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 75.83.119.18:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 110.231.2.234:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 220.68.11.30:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 113.171.92.221:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.232.112.87:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 52.50.61.67:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 1.30.52.25:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 193.110.98.160:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 54.98.65.52:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 94.48.177.141:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 72.204.74.126:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 210.72.38.152:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 4.47.99.241:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 179.189.120.101:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 112.51.17.110:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 202.194.82.232:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 174.185.235.199:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 117.221.113.37:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 39.186.44.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 167.200.74.171:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 170.205.90.187:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 195.226.48.210:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 115.77.227.146:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 222.42.198.86:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 90.109.208.179:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 112.171.241.229:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 200.73.217.37:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 61.38.135.9:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 51.48.36.171:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 24.56.50.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 142.61.200.185:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 196.223.103.50:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 27.179.165.69:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 62.94.227.199:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 179.12.12.158:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 151.166.141.103:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 89.26.130.55:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 80.80.84.167:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 168.91.248.201:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 85.212.65.36:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 180.249.254.238:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 174.27.155.114:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.222.148.1:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 141.137.244.243:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 71.23.149.254:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 143.103.195.72:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 49.168.155.169:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 197.66.104.53:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 122.151.4.64:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 114.245.2.115:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 148.92.144.66:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 90.46.242.172:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 110.134.59.99:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 25.134.40.146:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 34.133.206.213:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 90.27.54.175:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 136.46.233.33:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 116.192.132.74:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 88.178.189.54:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.212.6.87:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 178.98.231.38:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 101.163.169.70:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 103.247.134.125:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 122.144.142.59:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 148.88.239.89:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 204.123.126.67:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 156.214.211.4:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.135.204.215:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 196.117.206.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 168.132.226.186:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 24.37.203.113:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 74.130.2.99:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 141.9.221.200:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 34.185.181.77:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 95.82.163.27:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 102.58.4.14:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 20.126.121.73:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 43.128.192.98:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 98.82.89.234:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 221.160.137.217:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 195.14.13.62:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 85.253.134.231:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 197.208.204.217:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 173.245.218.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 84.96.253.168:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 151.240.19.64:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 144.198.185.200:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 112.227.145.105:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 89.198.173.120:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 168.250.125.213:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 44.142.164.22:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 183.54.113.17:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 175.74.168.159:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 148.112.137.198:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 191.232.217.216:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.191.241.162:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 38.112.102.104:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 105.199.203.60:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 184.51.106.178:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 38.46.124.175:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 124.190.36.53:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 89.216.22.209:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 208.138.241.81:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 46.135.88.189:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.65.210.191:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 64.239.145.192:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 74.21.65.184:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 204.28.148.172:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 125.165.158.74:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 19.29.50.79:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.139.27.114:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 17.219.157.145:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 156.106.187.90:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 27.34.128.135:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.42.143.10:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 102.189.188.151:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 122.152.234.39:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 108.242.31.4:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 175.0.230.119:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 36.190.1.66:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.169.223.249:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.157.245.201:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.254.254.248:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 64.41.155.118:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.15.91.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 125.53.242.201:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 121.82.138.141:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 199.62.251.133:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 213.254.125.190:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 19.188.55.38:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 81.113.33.101:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 194.110.14.1:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 156.208.74.84:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 103.49.14.121:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 99.205.150.159:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 74.65.63.213:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 221.178.183.230:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 176.104.100.231:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 62.125.150.209:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 170.166.211.161:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 13.110.42.135:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 129.183.219.65:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 109.96.11.203:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 74.31.91.195:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.57.177.207:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 54.28.160.132:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 201.3.255.101:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 60.22.63.219:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 167.148.111.97:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 138.154.81.37:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 67.206.228.101:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 23.208.97.217:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.244.129.39:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 79.38.46.210:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 186.116.105.120:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 118.211.68.45:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 168.81.132.238:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 143.34.212.215:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 193.244.46.19:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.30.101.85:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 111.7.142.98:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.161.132.72:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 41.160.155.33:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 92.253.134.189:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.156.179.240:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 118.124.42.80:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 47.173.22.68:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 75.67.62.177:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 211.140.222.222:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 111.67.215.248:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 212.34.31.24:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 146.150.71.79:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 191.70.47.221:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 140.85.127.188:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.219.241.94:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 216.208.112.83:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 184.250.136.70:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 36.126.10.44:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 80.221.139.175:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 93.233.115.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 46.94.35.150:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 218.75.104.104:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 9.158.84.119:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 132.32.129.10:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 95.255.235.223:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 14.114.172.221:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 61.160.37.118:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 220.182.34.187:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 156.122.163.82:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 102.114.170.209:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 94.131.106.67:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 123.118.177.5:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 157.53.43.104:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 92.178.106.7:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.159.126.63:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 143.210.56.226:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 2.195.238.59:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 130.209.4.248:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 96.188.91.121:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 42.70.92.135:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 138.189.115.126:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 43.246.126.68:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 142.67.36.39:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 210.255.164.82:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 69.224.248.59:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 154.86.25.116:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 129.226.253.181:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.244.149.182:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 13.109.233.141:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 115.138.145.180:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 106.22.218.132:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 181.111.161.110:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 171.73.177.213:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 17.100.237.141:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 197.190.141.144:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 196.144.186.122:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.238.197.234:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 200.250.72.102:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 109.192.25.156:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 166.115.165.73:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 128.96.153.20:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 205.12.11.40:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 34.111.44.252:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 136.145.6.55:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 104.254.67.122:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 54.215.95.121:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 5.93.225.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 79.114.86.192:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 66.50.121.129:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 59.230.12.190:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 193.120.246.246:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 69.67.57.46:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 180.6.100.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 76.38.177.95:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 70.131.230.11:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 132.25.234.9:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 60.218.246.46:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 154.49.198.30:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 57.175.130.148:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 87.235.90.18:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 95.24.15.202:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 69.70.150.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 136.142.63.215:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 179.210.224.20:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 114.165.7.87:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 41.9.201.122:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 44.135.42.204:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 208.66.159.62:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 170.127.227.26:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 37.15.20.140:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 97.57.116.109:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.219.196.80:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 70.162.252.223:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 40.138.230.194:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 87.5.183.51:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 49.141.109.205:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 131.176.107.236:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 121.163.25.35:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 117.170.169.29:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 40.228.176.152:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.179.106.137:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 119.237.54.42:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 129.126.115.215:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 108.212.187.80:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.202.205.157:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.20.191.138:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 85.211.5.134:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 154.146.153.37:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 82.66.227.52:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 66.13.53.30:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 114.245.136.101:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 38.31.164.52:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 80.239.126.72:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 173.219.122.104:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.38.234.152:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 167.178.87.204:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 202.224.207.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 69.79.67.72:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 195.234.215.92:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 195.2.158.30:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 42.107.224.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 27.107.29.71:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 41.176.99.8:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 23.105.199.209:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.70.181.1:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 223.40.21.124:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 136.12.33.221:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 216.162.44.213:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 190.196.34.220:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 174.133.183.114:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 25.192.153.97:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 27.142.87.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 14.112.144.160:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 112.197.11.73:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.59.93.212:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 45.137.186.33:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 121.236.250.171:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 121.229.233.252:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 218.15.218.120:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 213.185.43.158:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 204.64.13.228:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 2.232.121.25:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.68.95.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 222.198.67.15:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 163.221.194.214:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 25.230.17.143:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 137.77.123.136:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 197.176.19.57:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 212.62.49.243:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 18.144.238.219:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 151.97.171.43:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 106.57.237.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.11.123.130:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 137.117.90.227:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 153.170.68.172:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 58.120.206.220:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 155.223.74.123:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.75.162.75:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 128.157.63.120:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 124.221.247.99:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 137.108.238.246:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 154.74.194.60:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 133.115.2.240:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 91.233.43.47:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 117.135.76.75:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 140.137.198.227:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 141.90.171.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 117.86.166.174:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 104.18.214.192:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 200.58.212.137:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 92.55.161.167:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 122.184.225.78:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 163.161.92.108:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 116.32.37.159:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 202.94.245.163:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.241.42.15:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 68.195.115.89:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 181.226.173.210:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 151.10.186.153:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 124.213.66.43:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 211.31.153.85:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 24.18.94.169:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 61.245.23.246:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.115.222.170:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 62.168.50.18:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 209.204.80.127:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 207.39.77.242:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 158.189.39.198:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 169.173.151.73:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 122.180.78.27:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 17.183.8.184:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 182.30.71.168:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 47.224.44.195:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 25.39.101.122:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 146.67.128.25:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 133.33.23.171:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 176.94.246.243:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 103.81.207.105:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 70.209.37.83:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 209.214.238.79:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 71.253.101.106:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 136.36.249.120:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 149.91.209.55:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 221.222.39.247:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 175.148.245.102:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 111.77.108.76:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 41.152.253.137:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 190.90.110.157:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.247.229.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 59.162.18.126:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 114.255.170.204:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 57.85.88.220:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 123.119.204.111:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 201.69.157.131:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 182.241.117.190:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 71.123.102.212:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 92.161.47.81:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 201.140.134.214:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 25.92.57.18:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 124.220.213.96:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 222.92.166.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 200.89.237.126:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 193.140.17.153:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 43.86.246.182:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 41.233.157.118:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 177.217.96.118:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 130.123.52.35:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 205.103.36.217:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 133.72.40.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 222.135.139.214:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.53.1.118:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 35.116.254.192:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 124.140.23.167:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 151.79.102.243:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 14.169.121.71:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 204.204.185.211:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 109.96.84.187:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 59.168.94.165:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.124.205.163:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 35.97.81.194:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 31.150.237.51:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 39.13.23.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 144.225.179.225:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 36.79.188.3:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 198.130.254.26:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 117.10.194.133:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 181.128.252.5:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 167.233.242.229:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 108.163.174.127:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 59.221.9.208:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 90.251.163.254:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 120.74.56.173:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 211.128.63.250:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 32.136.244.144:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 86.180.161.169:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 113.9.236.134:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 206.39.196.60:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 163.136.92.255:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 81.62.120.36:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 76.212.35.66:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 59.227.199.36:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 219.157.3.249:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 77.119.215.142:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 27.119.217.62:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 88.119.60.209:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 131.54.243.129:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 153.82.43.97:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 166.6.209.62:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 46.219.151.43:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 220.180.30.34:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 32.37.207.116:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 144.244.148.17:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 40.28.128.207:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 208.144.71.228:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 85.216.251.35:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 95.124.148.235:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 162.88.109.144:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 24.136.77.7:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 138.219.18.79:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 38.114.133.139:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 102.23.170.19:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 17.255.67.16:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 12.88.174.82:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 8.176.235.93:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 193.59.62.21:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 199.7.142.21:2323
Source: global traffic TCP traffic: 192.168.2.15:40962 -> 94.151.252.214:2323
Sample listens on a socket
Source: /tmp/botnet.x86.elf (PID: 5820) Socket: 0.0.0.0:1230 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 176.123.160.241
Source: unknown TCP traffic detected without corresponding DNS query: 134.120.53.57
Source: unknown TCP traffic detected without corresponding DNS query: 129.5.76.57
Source: unknown TCP traffic detected without corresponding DNS query: 84.113.169.169
Source: unknown TCP traffic detected without corresponding DNS query: 189.23.128.108
Source: unknown TCP traffic detected without corresponding DNS query: 220.46.14.57
Source: unknown TCP traffic detected without corresponding DNS query: 132.106.13.165
Source: unknown TCP traffic detected without corresponding DNS query: 157.159.226.234
Source: unknown TCP traffic detected without corresponding DNS query: 99.35.222.194
Source: unknown TCP traffic detected without corresponding DNS query: 153.5.139.55
Source: unknown TCP traffic detected without corresponding DNS query: 133.47.175.62
Source: unknown TCP traffic detected without corresponding DNS query: 166.135.151.96
Source: unknown TCP traffic detected without corresponding DNS query: 149.56.196.233
Source: unknown TCP traffic detected without corresponding DNS query: 73.246.107.245
Source: unknown TCP traffic detected without corresponding DNS query: 91.38.157.20
Source: unknown TCP traffic detected without corresponding DNS query: 8.111.192.180
Source: unknown TCP traffic detected without corresponding DNS query: 54.21.8.219
Source: unknown TCP traffic detected without corresponding DNS query: 107.226.227.82
Source: unknown TCP traffic detected without corresponding DNS query: 164.182.85.207
Source: unknown TCP traffic detected without corresponding DNS query: 39.95.140.18
Source: unknown TCP traffic detected without corresponding DNS query: 144.228.127.76
Source: unknown TCP traffic detected without corresponding DNS query: 208.24.254.133
Source: unknown TCP traffic detected without corresponding DNS query: 123.153.176.87
Source: unknown TCP traffic detected without corresponding DNS query: 54.221.73.79
Source: unknown TCP traffic detected without corresponding DNS query: 163.22.233.93
Source: unknown TCP traffic detected without corresponding DNS query: 149.71.171.14
Source: unknown TCP traffic detected without corresponding DNS query: 12.151.240.40
Source: unknown TCP traffic detected without corresponding DNS query: 147.102.38.101
Source: unknown TCP traffic detected without corresponding DNS query: 209.206.18.189
Source: unknown TCP traffic detected without corresponding DNS query: 67.117.88.151
Source: unknown TCP traffic detected without corresponding DNS query: 213.192.19.178
Source: unknown TCP traffic detected without corresponding DNS query: 146.11.181.245
Source: unknown TCP traffic detected without corresponding DNS query: 160.137.69.103
Source: unknown TCP traffic detected without corresponding DNS query: 151.86.144.154
Source: unknown TCP traffic detected without corresponding DNS query: 51.195.7.15
Source: unknown TCP traffic detected without corresponding DNS query: 54.243.252.130
Source: unknown TCP traffic detected without corresponding DNS query: 103.69.26.43
Source: unknown TCP traffic detected without corresponding DNS query: 134.77.242.112
Source: unknown TCP traffic detected without corresponding DNS query: 20.109.136.232
Source: unknown TCP traffic detected without corresponding DNS query: 177.130.177.135
Source: unknown TCP traffic detected without corresponding DNS query: 194.228.221.89
Source: unknown TCP traffic detected without corresponding DNS query: 186.45.174.232
Source: unknown TCP traffic detected without corresponding DNS query: 44.176.167.156
Source: unknown TCP traffic detected without corresponding DNS query: 212.8.36.193
Source: unknown TCP traffic detected without corresponding DNS query: 86.0.39.206
Source: unknown TCP traffic detected without corresponding DNS query: 157.34.92.235
Source: unknown TCP traffic detected without corresponding DNS query: 196.143.184.40
Source: unknown TCP traffic detected without corresponding DNS query: 212.19.15.96
Source: unknown TCP traffic detected without corresponding DNS query: 53.183.224.237
Source: unknown TCP traffic detected without corresponding DNS query: 185.102.229.157

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: botnet.x86.elf, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: botnet.x86.elf, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.troj.linELF@0/0@0/0
Executes commands using a shell command-line interpreter
Source: /tmp/botnet.x86.elf (PID: 5821) Shell command executed: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/botnet.x86.elf bin/busybox; chmod 777 bin/busybox" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5825) Chmod executable: /usr/bin/chmod -> chmod 777 bin/busybox Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5823) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 5822) Rm executable: /usr/bin/rm -> rm -rf bin/busybox Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 5825) File: /tmp/bin/busybox (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 5825) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/busybox Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: botnet.x86.elf, type: SAMPLE
Source: Yara match File source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: botnet.x86.elf, type: SAMPLE
Source: Yara match File source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Yara detected Mirai
Source: Yara match File source: botnet.x86.elf, type: SAMPLE
Source: Yara match File source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: botnet.x86.elf, type: SAMPLE
Source: Yara match File source: 5820.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 5820, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.240.98.140
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
140.174.195.252
 unknown United States
30212 HYPERMEDIA-SYSTEMSUS false
108.163.174.127
 unknown Canada
32613 IWEB-ASCA false
4.66.254.72
 unknown United States
3356 LEVEL3US false
123.198.173.228
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
162.247.109.7
 unknown United States
23391 OASIS-SALUDAUS false
65.146.107.160
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
192.4.191.104
 unknown United States
116 TELCORDIAUS false
138.103.123.101
 unknown Sweden
7046 RFC2270-UUNET-CUSTOMERUS false
126.61.236.66
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
167.172.53.228
 unknown United States
14061 DIGITALOCEAN-ASNUS false
71.80.177.167
 unknown United States
20115 CHARTER-20115US false
161.146.210.239
 unknown Australia
18055 CENTRELINKDepartmentofHumanServicesAU false
213.87.254.237
 unknown Russian Federation
8359 MTSRU false
59.176.61.151
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
112.38.202.148
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
140.73.187.99
 unknown United States
23700 FASTNET-AS-IDLinknet-FastnetASNID false
167.183.204.45
 unknown United States
59447 SAYFANETTR false
48.137.53.247
 unknown United States
2686 ATGS-MMD-ASUS false
205.176.110.69
 unknown United States
8103 STATE-OF-FLAUS false
146.234.208.53
 unknown Germany
43857 FRAPORTDE false
144.81.144.235
 unknown United States
62989 IUPUS false
198.205.255.34
 unknown United States
11911 THE-BANK-OF-NEW-YORK-MELLON-CORPORATION-BASE-ASUS false
138.15.156.89
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
84.18.54.134
 unknown Jordan
33831 RHC-ASJO false
199.20.211.242
 unknown United States
18756 PATEAMUS false
99.180.30.106
 unknown United States
7018 ATT-INTERNET4US false
14.204.114.75
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
155.207.5.150
 unknown Greece
5470 ASAUTHNETAUTH-NET-ASGR false
20.79.56.65
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
52.249.136.56
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
126.70.159.224
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
150.57.209.77
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
51.254.229.103
 unknown France
16276 OVHFR false
107.220.40.243
 unknown United States
7018 ATT-INTERNET4US false
36.217.4.33
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
212.153.90.207
 unknown Netherlands
702 UUNETUS false
199.61.173.224
 unknown United States
11105 SFU-ASCA false
1.81.74.71
 unknown China
134768 CHINANET-SHAANXI-CLOUD-BASECHINANETSHAANXIprovinceCloud false
179.143.23.151
 unknown Brazil
53037 NEXTELTELECOMUNICACOESLTDABR false
63.43.186.162
 unknown United States
22394 CELLCOUS false
209.61.75.148
 unknown United States
174 COGENT-174US false
72.185.198.81
 unknown United States
33363 BHN-33363US false
53.220.96.74
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
62.182.127.43
 unknown Ukraine
34251 IMC-ASUA false
87.66.142.57
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
39.47.228.101
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
205.216.180.149
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
64.104.25.139
 unknown United States
109 CISCOSYSTEMSUS false
192.45.75.134
 unknown United States
1906 NORTHROP-GRUMMANUS false
112.227.145.105
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.159.82.182
 unknown France
2094 FR-TELECOM-MANAGEMENT-SUDPARISTelecomManagementSudPari false
59.211.238.211
 unknown China
2516 KDDIKDDICORPORATIONJP false
196.238.211.1
 unknown Tunisia
37492 ORANGE-TN false
106.134.42.158
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
223.72.208.214
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
168.194.165.131
 unknown Brazil
265393 FIRENETSERVICOSDETELECOMUNICACOESLTDABR false
93.90.131.184
 unknown Germany
47295 ITELLIGENCE-ASDE false
197.106.96.172
 unknown South Africa
37168 CELL-CZA false
62.16.115.11
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
129.180.45.126
 unknown Australia
24101 UNE-AS-APUniversityofNewEnglandAU false
126.83.9.147
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
103.163.150.225
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
12.28.172.44
 unknown United States
7018 ATT-INTERNET4US false
93.123.8.172
 unknown Bulgaria
34224 NETERRA-ASBG false
175.218.4.47
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
9.127.103.127
 unknown United States
3356 LEVEL3US false
208.38.179.181
 unknown United States
16724 WOW-DATACENTER-NETUS false
178.98.200.100
 unknown United Kingdom
12576 EELtdGB false
99.63.76.216
 unknown United States
7018 ATT-INTERNET4US false
129.14.137.62
 unknown United States
786 JANETJiscServicesLimitedGB false
188.117.130.154
 unknown Poland
31242 TKPSA-ASPL false
142.101.233.178
 unknown Canada
852 ASN852CA false
60.226.22.167
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
159.176.68.167
 unknown United States
34058 LIFECELL-ASUA false
5.204.50.6
 unknown Hungary
8448 PGSM-HUTorokbalintHungaryHU false
74.250.40.157
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
189.131.123.78
 unknown Mexico
8151 UninetSAdeCVMX false
77.48.38.241
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
135.73.117.254
 unknown United States
18676 AVAYAUS false
209.254.218.180
 unknown United States
7029 WINDSTREAMUS false
93.142.48.116
 unknown Croatia (LOCAL Name: Hrvatska)
5391 T-HTCroatianTelecomIncHR false
174.249.253.209
 unknown United States
22394 CELLCOUS false
4.167.81.27
 unknown United States
3356 LEVEL3US false
138.95.47.91
 unknown United States
3549 LVLT-3549US false
205.118.131.211
 unknown United States
210 WEST-NET-WESTUS false
87.132.30.13
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
110.191.127.233
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
165.131.16.230
 unknown United States
10967 HOMEDEPOTNETUS false
211.118.148.182
 unknown Korea Republic of
17862 KWNU-AS-KRKangwonNationalUniversityKR false
181.177.138.161
 unknown Bolivia
27839 ComtecoLtdaBO false
151.34.8.167
 unknown Italy
1267 ASN-WINDTREIUNETEU false
200.83.85.38
 unknown Chile
22047 VTRBANDAANCHASACL false
163.147.110.128
 unknown Japan 17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
134.15.87.145
 unknown United States
270 AS270US false
163.245.32.223
 unknown United States
17 PURDUEUS false
218.160.45.210
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
125.97.154.69
 unknown China
9814 FIBRLINKBeijingFibrLINKNetworksCoLtdCN false
93.121.209.227
 unknown France
21351 CANALPLUSTELECOMFR false
8.239.93.173
 unknown United States
3356 LEVEL3US false