Linux Analysis Report
armv5l.elf

Overview

General Information

Sample name: armv5l.elf
Analysis ID: 1580227
MD5: 02c05410972ff924e28a08021b1cccb5
SHA1: 5bfa60e7df6ca2ef350fc337e1c4665b299dd110
SHA256: f40c05923568661de9bd1caf7de1cf4e0a16e69972bf871a5e07227cf2b330eb
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings indicative of password brute-forcing capabilities
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: armv5l.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: armv5l.elf ReversingLabs: Detection: 44%

Networking
barindex
Opens /sys/class/net/* files useful for querying network interface information
Source: /tmp/armv5l.elf (PID: 6244) Opens: /sys/class/net/ Jump to behavior
Source: /tmp/armv5l.elf (PID: 6244) Opens: /sys/class/net/ens160/address Jump to behavior
Source: /tmp/armv5l.elf (PID: 6244) Opens: /sys/class/net/ens160/flags Jump to behavior
Source: /tmp/armv5l.elf (PID: 6244) Opens: /sys/class/net/ens160/carrier Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.182.159.185:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 92.8.200.23:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 152.45.145.185:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 65.236.40.125:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 128.84.89.164:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 69.139.173.211:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 53.24.94.19:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 111.85.54.217:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.117.34.136:2332
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 125.194.206.214:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 41.140.186.149:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 13.237.60.96:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 149.173.81.76:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 167.139.107.145:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 40.175.4.184:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 34.42.185.160:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 111.131.247.124:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 221.135.228.125:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 203.79.0.165:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.19.122.195:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.94.38.198:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 211.126.174.82:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 61.222.82.161:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 137.228.190.148:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 2.23.15.139:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 83.31.121.120:1023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.240.252.168:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 60.17.70.69:1023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 161.34.191.116:23023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 162.204.117.29:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 64.29.149.235:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.35.1.89:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 48.53.119.131:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 17.140.249.216:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 220.29.170.158:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.245.176.104:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 78.10.218.22:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 19.138.221.226:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 134.196.25.152:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 169.217.177.31:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 53.220.213.190:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 165.242.94.200:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 184.217.115.244:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 161.241.222.58:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 153.206.203.182:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 53.241.222.50:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 161.14.244.37:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 116.182.89.99:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.206.167.100:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.199.15.138:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 171.236.132.119:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 135.122.166.141:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 182.9.57.66:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 4.180.106.13:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 145.8.170.122:523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 180.25.249.7:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 46.222.40.3:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 2.84.214.155:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 109.36.86.230:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.56.66.5:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.192.153.4:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 183.134.147.42:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 69.163.73.113:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 61.6.74.151:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.1.186.109:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 163.90.250.201:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 118.244.177.248:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 79.85.176.130:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.229.41.218:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 128.179.58.76:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 183.207.230.135:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 158.250.175.74:9001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 169.33.18.193:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.237.250.111:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 156.8.134.65:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 12.211.194.94:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 213.242.35.164:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 88.239.154.158:254
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 34.56.160.177:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 152.214.196.115:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 194.120.253.60:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 142.68.226.224:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 140.84.207.230:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 114.177.169.17:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 44.243.199.62:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 95.255.41.162:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 134.136.135.206:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 190.239.163.143:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 130.204.233.61:23023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 46.196.148.64:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 139.95.111.73:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.133.94.44:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 119.247.200.55:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 2.172.239.144:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.127.220.189:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 162.134.252.244:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 212.181.163.34:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 189.82.138.86:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 152.103.185.48:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 94.38.200.73:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.40.31.43:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 95.221.22.30:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 195.71.36.139:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 178.8.226.202:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 176.23.249.221:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 205.251.167.107:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 197.238.112.242:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 174.163.93.11:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 45.190.151.18:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 202.20.160.170:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 128.168.52.118:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 57.187.48.66:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 124.37.227.60:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 66.137.227.172:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 76.148.248.20:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 223.98.188.231:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.164.54.100:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.38.44.109:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.247.8.30:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 206.143.18.151:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 103.46.35.240:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 106.102.230.24:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 12.163.169.98:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.200.112.164:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.122.139.26:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.203.209.137:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 92.113.117.35:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 180.192.140.88:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 193.108.214.153:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 120.168.180.236:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.96.168.234:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 9.35.211.201:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 169.26.167.211:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 113.196.160.173:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.12.169.244:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 107.229.3.36:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 155.128.29.218:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 199.36.122.254:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 104.160.140.94:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.82.119.87:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 132.190.117.246:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 69.203.171.186:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 182.136.114.127:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 195.57.247.79:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 168.66.223.186:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 222.143.31.56:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.214.201.72:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 25.48.189.79:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 200.152.160.226:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 59.193.83.165:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 18.103.117.232:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 68.201.170.70:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 37.133.63.193:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 25.140.232.217:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.173.247.192:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 92.75.61.142:9001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 196.241.237.57:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 198.187.84.73:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 98.115.110.152:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 134.141.36.137:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 185.152.107.185:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.115.200.238:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.111.40.115:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 138.91.186.99:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 146.225.34.100:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 160.158.248.188:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 130.166.247.171:2030
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 77.53.56.14:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 63.169.227.0:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 116.128.0.120:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 196.123.193.53:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 104.159.122.177:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 25.75.188.195:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 54.91.86.151:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 199.209.6.180:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.117.31.45:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 125.179.21.252:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 155.160.152.252:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 169.113.102.117:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 48.11.131.76:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 139.49.167.179:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 5.39.225.247:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 181.216.43.34:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.148.223.131:10001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 47.230.241.249:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 212.120.86.40:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 48.183.109.153:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 175.246.17.197:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 59.184.88.174:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 83.44.210.73:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 8.60.34.121:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 208.159.112.37:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 197.12.226.171:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 223.151.48.200:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 144.145.211.32:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 195.72.186.202:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 17.214.177.17:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 145.249.205.195:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 82.223.151.235:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 210.0.100.240:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 5.114.99.83:63210
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 13.37.87.39:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 178.75.209.39:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 203.53.12.165:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 105.230.196.124:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 51.119.199.106:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 103.14.241.14:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 143.64.228.96:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 117.65.116.164:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 168.107.69.254:17000
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 207.212.99.117:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 99.57.48.218:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 144.94.120.188:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 152.152.1.145:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 196.200.65.253:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 52.57.113.71:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 122.181.86.152:63210
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 116.146.221.138:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 168.99.30.237:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 171.134.161.27:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 92.153.246.55:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 71.119.95.190:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 76.241.56.154:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 115.229.17.201:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 133.220.28.89:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.93.246.153:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 112.150.203.226:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 83.145.138.117:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 138.113.36.4:2332
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 110.58.28.186:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 13.165.39.122:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.125.227.83:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 104.49.102.233:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 122.77.34.218:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 166.181.111.194:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 133.157.119.44:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 199.58.140.201:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 66.195.195.211:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 122.239.107.147:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.199.165.57:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 114.47.188.223:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 177.219.107.33:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.59.116.217:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 63.2.226.160:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 43.153.118.56:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 64.103.180.183:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.122.116.148:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 121.43.68.188:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 178.37.150.196:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 168.5.160.29:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.102.167.30:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 111.150.48.177:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 64.149.69.71:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 52.221.243.156:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 106.100.134.222:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 191.13.81.211:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 89.204.156.221:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 171.213.4.116:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 184.2.112.140:49829
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 181.15.131.183:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 76.202.17.3:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 83.236.28.167:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 116.165.254.127:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 96.216.39.140:9999
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 143.152.120.48:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 131.135.30.108:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 153.238.120.33:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 180.68.138.221:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 123.57.96.64:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 158.74.171.170:23023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 100.45.172.28:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 212.130.205.169:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 46.227.64.158:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 184.114.228.210:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.253.247.179:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 63.138.74.210:49829
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 112.25.90.160:49829
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 76.75.15.220:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 112.39.234.189:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 185.32.221.215:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 47.22.203.188:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 128.222.130.108:1023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 131.198.71.226:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 101.51.19.248:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 125.115.28.19:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 177.46.11.250:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 139.59.122.139:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 69.114.6.116:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 206.119.176.167:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 158.60.40.168:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 100.220.116.173:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 110.128.212.113:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 154.181.192.156:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 31.217.238.137:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 43.133.91.51:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 5.56.28.56:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 122.249.46.122:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 156.171.151.211:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 201.159.241.220:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 188.77.85.107:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.197.198.39:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 121.178.85.4:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 191.4.6.164:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 46.196.59.154:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 193.42.235.19:63210
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 64.63.251.159:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 1.220.154.136:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 118.33.6.171:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.130.193.143:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 143.8.133.143:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 121.120.37.101:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 131.200.186.150:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 117.251.92.212:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 148.84.106.108:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 190.96.89.103:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 132.22.70.208:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 19.199.87.252:2332
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 201.82.135.183:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 182.32.127.125:23023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 203.224.249.148:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 58.107.66.80:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 18.222.49.55:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 44.207.98.55:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 157.115.24.175:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 73.78.219.95:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 222.218.194.56:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 181.238.27.166:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 198.236.66.155:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 200.45.8.249:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 154.35.29.157:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 106.88.237.197:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.192.100.67:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 2.162.187.105:5523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 58.96.183.203:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 48.214.158.114:63210
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 112.152.92.141:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 138.109.72.107:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 136.55.254.55:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 140.32.29.17:2332
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 183.73.247.69:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 88.164.91.195:1337
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 208.240.93.42:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 67.217.156.52:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 186.213.77.71:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 196.144.8.216:5523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 158.63.170.62:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 210.108.14.0:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 76.230.83.130:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 25.11.38.150:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 155.99.117.126:9999
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 186.112.225.109:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.107.38.86:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 211.223.220.129:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.137.54.23:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 155.132.108.201:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.250.13.200:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 67.240.81.129:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 207.167.30.177:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 161.13.138.216:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 78.148.119.194:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 58.209.141.216:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 72.74.181.39:49829
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 25.155.57.203:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 66.22.233.58:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 112.46.198.1:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.252.244.61:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 197.11.164.219:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 66.78.131.117:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 139.158.50.134:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.233.137.68:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 147.10.156.11:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 42.242.22.200:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 219.130.143.198:2332
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 111.208.202.196:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 2.90.2.87:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 31.227.132.253:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 71.1.109.20:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 61.44.153.20:254
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 201.245.92.236:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 106.236.255.127:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 178.51.30.245:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 60.177.150.23:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 163.240.158.32:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 20.37.236.116:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.153.107.40:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 200.169.44.107:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 71.113.127.211:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 111.76.184.240:2030
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 197.87.22.186:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 91.23.122.56:7777
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 44.141.163.77:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.201.228.177:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 175.75.113.97:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 88.41.253.227:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 88.240.58.201:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 201.166.175.165:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 107.145.204.160:9999
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.106.184.236:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 223.66.146.162:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 175.40.76.31:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 217.33.15.193:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 75.150.128.131:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 217.119.49.134:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.93.54.190:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 24.111.37.193:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 156.4.57.60:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 125.186.126.2:2002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 95.84.189.7:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 198.163.247.142:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 196.90.195.159:9999
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 41.104.215.91:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 59.186.171.243:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 84.75.45.54:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 190.113.250.156:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 200.77.115.38:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 148.120.218.71:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 80.128.217.107:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.228.40.114:2030
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 65.167.98.41:2601
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 105.14.189.68:60009
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 217.5.214.6:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 205.105.29.61:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 117.94.89.49:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 23.132.71.112:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 40.130.176.229:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 189.85.67.102:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.166.220.106:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 70.187.29.96:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 93.49.217.0:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 101.125.25.38:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 104.161.30.202:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 170.236.9.142:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 138.134.35.158:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 205.229.202.33:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 4.246.194.111:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 115.199.231.127:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 182.16.11.207:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 32.31.72.174:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 139.50.226.6:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 108.46.137.100:10001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 168.156.229.68:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 174.56.232.160:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 160.225.148.117:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 95.169.179.129:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 175.60.122.202:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 165.185.209.175:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 20.219.13.173:523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 43.163.102.149:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 41.50.148.96:23023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 64.52.210.41:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 27.44.4.201:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 77.75.162.43:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 161.152.154.253:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 81.249.49.66:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 220.155.50.145:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 71.101.22.134:10001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 82.53.51.70:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.41.231.145:63256
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 141.205.191.30:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 167.81.229.122:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 156.157.18.216:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 206.52.33.222:30003
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 58.220.22.34:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 164.128.164.244:17000
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 87.19.211.73:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 173.17.98.225:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 74.119.60.234:26
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 160.182.173.78:523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 49.9.60.122:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 89.127.0.38:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 159.105.86.175:2223
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 77.225.214.250:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 20.169.224.206:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 101.101.106.200:10023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 94.92.45.194:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 129.220.251.111:30002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 195.130.167.140:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 123.33.87.168:63210
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 135.74.173.23:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 23.112.227.196:1023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 9.50.35.59:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 156.22.49.90:523
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 12.121.226.32:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 17.100.254.187:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 72.184.241.242:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 171.214.79.60:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 44.6.12.203:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 85.59.12.210:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 43.223.228.126:10001
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 42.96.151.243:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 171.201.141.78:60023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 146.227.214.232:2323
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 54.163.19.192:17000
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 130.124.160.45:7218
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 200.145.199.218:6962
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 191.248.171.213:6002
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 221.156.221.29:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 121.116.36.2:4719
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 73.123.106.9:6023
Source: global traffic TCP traffic: 192.168.2.23:7961 -> 218.124.45.219:60023
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 165.137.229.242
Source: unknown TCP traffic detected without corresponding DNS query: 17.238.231.28
Source: unknown TCP traffic detected without corresponding DNS query: 183.115.71.233
Source: unknown TCP traffic detected without corresponding DNS query: 111.140.214.6
Source: unknown TCP traffic detected without corresponding DNS query: 49.101.67.90
Source: unknown TCP traffic detected without corresponding DNS query: 94.122.98.140
Source: unknown TCP traffic detected without corresponding DNS query: 95.5.4.183
Source: unknown TCP traffic detected without corresponding DNS query: 166.213.117.86
Source: unknown TCP traffic detected without corresponding DNS query: 220.239.42.3
Source: unknown TCP traffic detected without corresponding DNS query: 70.182.159.185
Source: unknown TCP traffic detected without corresponding DNS query: 1.140.78.51
Source: unknown TCP traffic detected without corresponding DNS query: 178.64.93.85
Source: unknown TCP traffic detected without corresponding DNS query: 68.132.84.226
Source: unknown TCP traffic detected without corresponding DNS query: 54.54.33.47
Source: unknown TCP traffic detected without corresponding DNS query: 164.56.112.203
Source: unknown TCP traffic detected without corresponding DNS query: 152.106.143.20
Source: unknown TCP traffic detected without corresponding DNS query: 47.214.123.73
Source: unknown TCP traffic detected without corresponding DNS query: 206.239.24.204
Source: unknown TCP traffic detected without corresponding DNS query: 139.21.71.3
Source: unknown TCP traffic detected without corresponding DNS query: 90.14.172.149
Source: unknown TCP traffic detected without corresponding DNS query: 84.160.18.178
Source: unknown TCP traffic detected without corresponding DNS query: 92.8.200.23
Source: unknown TCP traffic detected without corresponding DNS query: 136.149.225.77
Source: unknown TCP traffic detected without corresponding DNS query: 135.206.245.133
Source: unknown TCP traffic detected without corresponding DNS query: 124.176.109.96
Source: unknown TCP traffic detected without corresponding DNS query: 131.232.90.110
Source: unknown TCP traffic detected without corresponding DNS query: 198.130.119.52
Source: unknown TCP traffic detected without corresponding DNS query: 152.45.145.185
Source: unknown TCP traffic detected without corresponding DNS query: 167.159.2.24
Source: unknown TCP traffic detected without corresponding DNS query: 153.30.155.18
Source: unknown TCP traffic detected without corresponding DNS query: 200.85.27.129
Source: unknown TCP traffic detected without corresponding DNS query: 161.92.99.78
Source: unknown TCP traffic detected without corresponding DNS query: 117.58.95.203
Source: unknown TCP traffic detected without corresponding DNS query: 27.107.64.216
Source: unknown TCP traffic detected without corresponding DNS query: 121.249.103.223
Source: unknown TCP traffic detected without corresponding DNS query: 43.241.178.178
Source: unknown TCP traffic detected without corresponding DNS query: 20.227.55.165
Source: unknown TCP traffic detected without corresponding DNS query: 65.236.40.125
Source: unknown TCP traffic detected without corresponding DNS query: 92.68.129.226
Source: unknown TCP traffic detected without corresponding DNS query: 87.174.34.172
Source: unknown TCP traffic detected without corresponding DNS query: 155.159.218.42
Source: unknown TCP traffic detected without corresponding DNS query: 36.131.116.132
Source: unknown TCP traffic detected without corresponding DNS query: 57.37.41.144
Source: unknown TCP traffic detected without corresponding DNS query: 216.150.106.34
Source: unknown TCP traffic detected without corresponding DNS query: 117.45.63.194
Source: unknown TCP traffic detected without corresponding DNS query: 70.11.124.184
Source: unknown TCP traffic detected without corresponding DNS query: 128.84.89.164
Source: unknown TCP traffic detected without corresponding DNS query: 69.115.154.178
Source: unknown TCP traffic detected without corresponding DNS query: 89.203.75.5
Source: global traffic DNS traffic detected: DNS query: pool.rentcheapcars.sbs
Source: global traffic DNS traffic detected: DNS query: iranistrash.libre
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -en '
Source: Initial sample String containing 'busybox' found: .d && /bin/busybox echo -e '\x46\x49\x4e'
Source: Initial sample String containing 'busybox' found: /bin/busybox echo '
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod 777 .d; ./.d > .b; /bin/busybox chmod 777 .b; ./.b matrix
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -en ''>.d && /bin/busybox echo -e '\x46\x49\x4e'
Source: Initial sample String containing 'busybox' found: /bin/busybox echo '\c'>>/bin/busybox chmod 777 .d; ./.d > .b; /bin/busybox chmod 777 .b; ./.b matrix
Source: Initial sample String containing 'busybox' found: rm -rf .d; rm -rf .b; >.d; (chmod 777 .d || /bin/busybox chmod 777 .d || cp /bin/sh .d; >.d); >.b; (chmod 777 .b || /bin/busybox chmod 777 .b || cp /bin/sh .b; >.b)
Source: Initial sample String containing 'busybox' found: /bin/busybox cat /proc/self/exe || cat /bin/echo
Source: Initial sample String containing 'busybox' found: /bin/busybox wget --help; /bin/busybox ftpget --help; /bin/busybox echo -e '\x67\x61\x79\x66\x67\x74';
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -e '\x53\x54\x41\x52\x54'; cat /proc/cpuinfo; /bin/busybox echo -e '\x45\x4e\x44'
Source: Initial sample String containing 'busybox' found: BusyBox on \S+ \wogin
Source: Initial sample String containing 'busybox' found: ELFsage: wgetsage: ftpgetgayfgt/bin/busybox echo -e '\x53\x54\x41\x52\x54'; cat /proc/cpuinfo; /bin/busybox echo -e '\x45\x4e\x44'
Source: Initial sample String containing 'busybox' found: /usr//mnt//var/run//dev/shm//etc//var//tmp//dev//var/home/user/fw/admin1231234666666ubnt888888klv12340000111111111111123451234561234567890admin12601hx4321543216543217ujMko0admin88888888a1sev5y7c39kAdminadmin123AdmiN*123admin1234adminHWadminpassBrAhMoS@15CalVxePV1! cat1029CenturyL1nkchzhdplconexantCTLsupport12cxx4dm1n5591epicrouterGeNeXiS@19gponAdminGPONALC#FGUgw1adminh@32LuyDho4uku6atadministratorAdministratorsupervisormeinsmmicrobusinessnology*/P@55w0rd!passpasswordplumeria0077QwestM0demripcode!roots2@We3%Dc#smcadminstdONU101systemtechTeleCom_1234telnetv2mprtve0RbANGXpon@Olt9417##xTaaA8jzhoneadtecadtecftpbinCMCCAdmine8telnetCUAdmindaemondefaulttluafedvhd1206e8ehome1e8ehomee8ehomeasbhi3518EpuseruserEpfliruser3vligftpvideoguestguest123!!Huawei@HuaweiHgwkeomeolnadminlnadmin0123456mg3500merlinmothernobodyontONTUSERSUGAR2A041rapportr@p8p0r+remotessh5SaP9I26!@#$qwer00000000000000000000059AnkJ070admin11001chin11111111234qwer1.oN%cpi2010vesta2011vesta207B16th23we98oi258025804uvdzKqBkj.jg5up/*6.=_ja7ujMko0vizxvadminp
Sample contains strings indicative of password brute-forcing capabilities
Source: Initial sample String containing potential weak password found: admin
Source: Initial sample String containing potential weak password found: 12345
Source: Initial sample String containing potential weak password found: 123456
Source: Initial sample String containing potential weak password found: 54321
Source: Initial sample String containing potential weak password found: 654321
Source: Initial sample String containing potential weak password found: admin1234
Source: Initial sample String containing potential weak password found: administrator
Source: Initial sample String containing potential weak password found: supervisor
Source: Initial sample String containing potential weak password found: password
Source: Initial sample String containing potential weak password found: default
Source: Initial sample String containing potential weak password found: guest
Source: Initial sample String containing potential weak password found: service
Source: Initial sample String containing potential weak password found: support
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.spyw.evad.linELF@0/0@2/0

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/armv5l.elf (PID: 6242) File: /tmp/armv5l.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/armv5l.elf (PID: 6242) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/armv5l.elf (PID: 6244) Queries kernel information via 'uname': Jump to behavior
Source: armv5l.elf, 6242.1.0000562f0bfeb000.0000562f0c119000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: armv5l.elf, 6242.1.00007ffd73c04000.00007ffd73c25000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: armv5l.elf, 6242.1.00007ffd73c04000.00007ffd73c25000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv5l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv5l.elf
Source: armv5l.elf, 6242.1.0000562f0bfeb000.0000562f0c119000.rw-.sdmp Binary or memory string: /V!/etc/qemu-binfmt/arm

HIPS / PFW / Operating System Protection Evasion
barindex
Performs DNS TXT record lookups
Source: Traffic DNS traffic detected: queries for: pool.rentcheapcars.sbs
Source: Traffic DNS traffic detected: queries for: iranistrash.libre

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.50.136.46
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
74.165.202.171
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
138.85.228.220
 unknown United States
8147 ASERICYUS false
195.56.40.12
 unknown Hungary
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
125.54.197.26
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
209.133.24.233
 unknown United States
6461 ZAYO-6461US false
124.22.205.235
 unknown China
23771 SXBCTV-APSXBCTVInternetServiceProviderCN false
196.227.197.176
 unknown Tunisia
37492 ORANGE-TN false
221.178.244.241
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
176.51.80.95
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
120.238.226.191
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
19.161.148.20
 unknown United States
3 MIT-GATEWAYSUS false
143.16.117.244
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
89.234.217.43
 unknown Poland
206412 INFO-NET-ASPL false
220.37.133.186
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
90.43.185.4
 unknown France
3215 FranceTelecom-OrangeFR false
66.121.250.52
 unknown United States
7132 SBIS-ASUS false
188.205.218.192
 unknown Netherlands
1136 KPNKPNNationalEU false
163.58.70.45
 unknown Japan 9365 ITSCOMitscommunicationsIncJP false
134.221.84.69
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
164.135.81.95
 unknown Sweden
51551 CAPITA-ASGB false
158.43.25.143
 unknown United Kingdom
702 UUNETUS false
154.151.151.112
 unknown Morocco
6713 IAM-ASMA false
185.152.92.158
 unknown Russian Federation
134121 RAINBOW-HKRainbownetworklimitedHK false
75.246.196.255
 unknown United States
22394 CELLCOUS false
1.112.26.123
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
180.82.152.65
 unknown Korea Republic of
9316 DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR false
133.216.33.136
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
71.161.152.10
 unknown United States
701 UUNETUS false
2.138.166.186
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
35.163.11.216
 unknown United States
16509 AMAZON-02US false
41.8.129.227
 unknown South Africa
29975 VODACOM-ZA false
63.62.191.154
 unknown United States
701 UUNETUS false
144.229.220.108
 unknown United States
1239 SPRINTLINKUS false
112.110.222.245
 unknown India
45271 ICLNET-AS-APIdeaCellularLimitedIN false
199.32.49.112
 unknown United States
1239 SPRINTLINKUS false
108.240.152.6
 unknown United States
7018 ATT-INTERNET4US false
200.205.0.48
 unknown Brazil
10429 TELEFONICABRASILSABR false
173.219.7.123
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
46.111.248.15
 unknown Russian Federation
2854 ROSPRINT-ASRU false
177.160.254.4
 unknown Brazil
26599 TELEFONICABRASILSABR false
91.159.244.179
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
128.225.245.2
 unknown United States
36441 UGA-ASNUS false
135.33.188.36
 unknown United States
54614 CIKTELECOM-CABLECA false
144.211.58.124
 unknown United States
44453 INTERNEX-ASAT false
107.64.120.115
 unknown United States
7018 ATT-INTERNET4US false
126.213.157.56
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
100.220.116.173
 unknown United States
21928 T-MOBILE-AS21928US false
216.138.64.23
 unknown United States
20077 IPNETZONE-ASNUS false
52.227.202.68
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
53.242.129.44
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
187.13.250.102
 unknown Brazil
7738 TelemarNorteLesteSABR false
220.115.66.131
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
170.213.18.131
 unknown United States
2386 INS-ASUS false
60.43.201.127
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
130.137.215.105
 unknown United States
137 ASGARRConsortiumGARREU false
150.165.174.234
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
196.106.219.14
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
48.85.107.21
 unknown United States
2686 ATGS-MMD-ASUS false
58.135.131.51
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
107.228.79.214
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
144.204.53.177
 unknown France
2426 FR-RENATER-RUBISRUBISMetropolitanAreaNetworkEU false
220.102.63.13
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
154.253.8.30
 unknown Algeria
36947 ALGTEL-ASDZ false
9.249.211.244
 unknown United States
3356 LEVEL3US false
44.68.148.123
 unknown United States
7377 UCSDUS false
117.114.129.204
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
66.217.38.132
 unknown United States
7029 WINDSTREAMUS false
62.59.121.44
 unknown Belgium
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
40.94.195.123
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
50.65.247.191
 unknown Canada
6327 SHAWCA false
20.82.46.15
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
47.211.152.173
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
101.242.217.58
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false
155.215.196.188
 unknown United States
1505 DNIC-AS-01505US false
176.136.241.251
 unknown France
5410 BOUYGTEL-ISPFR false
142.132.147.120
 unknown Canada
22686 UNIVERSITYOFWINNIPEG-ASNCA false
170.77.97.163
 unknown United States
27185 DHS-INTERNETUS false
43.153.118.56
 unknown Japan 4249 LILLY-ASUS false
65.255.170.205
 unknown United States
33227 BLUEBRIDGE-NETWORKSUS false
91.223.243.88
 unknown Estonia
9130 HMS-ASRU false
116.49.222.222
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
37.19.194.163
 unknown Ukraine
31343 INTERTELECOMUA false
23.157.236.85
 unknown Reserved
40706 QTOUS false
174.171.235.198
 unknown United States
7922 COMCAST-7922US false
90.116.94.166
 unknown France
3215 FranceTelecom-OrangeFR false
95.85.218.128
 unknown Czech Republic
43708 METRONETCZ false
169.82.196.235
 unknown United States
37611 AfrihostZA false
134.15.163.246
 unknown United States
270 AS270US false
195.11.242.140
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
61.122.63.151
 unknown Japan 9614 OCTOitaCableTelecomColtdJP false
158.166.44.249
 unknown Luxembourg
42848 EC-ASLU false
99.230.146.41
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
107.178.118.71
 unknown United States
53755 IOFLOODUS false
163.218.99.20
 unknown Japan 7502 IP-KYOTOAdvancedSoftwareTechnologyManagementResearch false
216.26.61.34
 unknown United States
7029 WINDSTREAMUS false
47.157.99.253
 unknown United States
5650 FRONTIER-FRTRUS false
84.63.234.98
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
165.70.103.117
 unknown United States
29885 UCHHS-ASUS false
185.147.111.21
 unknown United Kingdom
39875 W3ZGB false

Contacted Domains

Name IP Active
iranistrash.libre unknown unknown
pool.rentcheapcars.sbs unknown unknown