Linux Analysis Report
armv6l.elf

Overview

General Information

Sample name: armv6l.elf
Analysis ID: 1580232
MD5: 2817dba7a4b15046147ca60b5d989bcf
SHA1: 65d3dbe9995d9b199103c66a5c3e32800db12749
SHA256: 7ece6b3ea0def41175f59467cc817611f815b1d9997a496435dca089243e2c0e
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings indicative of password brute-forcing capabilities
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: armv6l.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: armv6l.elf ReversingLabs: Detection: 44%
Source: armv6l.elf Virustotal: Detection: 50% Perma Link

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 200.199.61.210 ports 63210,0,1,2,3,6
Source: global traffic TCP traffic: 5.230.251.14 ports 0,1,2,4,27014,995,7
Source: global traffic TCP traffic: 148.143.50.93 ports 63210,0,1,2,3,6
Opens /sys/class/net/* files useful for querying network interface information
Source: /tmp/armv6l.elf (PID: 6231) Opens: /sys/class/net/ Jump to behavior
Source: /tmp/armv6l.elf (PID: 6231) Opens: /sys/class/net/ens160/address Jump to behavior
Source: /tmp/armv6l.elf (PID: 6231) Opens: /sys/class/net/ens160/flags Jump to behavior
Source: /tmp/armv6l.elf (PID: 6231) Opens: /sys/class/net/ens160/carrier Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51160 -> 5.230.251.14:27014
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.27.208.232:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.185.167.10:38622
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 195.233.240.237:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 204.59.106.50:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 155.144.25.238:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.199.61.210:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 110.202.224.171:254
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 176.234.2.215:2030
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 133.22.155.5:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.99.174.23:60009
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 39.217.37.218:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 103.4.143.88:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 205.71.3.144:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 146.185.163.131:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.214.15.25:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 162.212.65.227:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 105.112.90.234:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 146.103.50.153:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 126.177.101.41:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 203.80.112.99:9001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 102.248.69.28:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 148.17.127.75:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 174.177.2.232:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 71.95.188.135:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 89.84.36.188:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 38.19.164.93:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 170.44.47.152:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 142.197.100.49:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 89.148.205.22:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 212.105.37.44:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 90.2.182.201:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 158.4.63.226:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 169.93.79.146:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 60.160.35.103:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.194.92.241:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 221.124.131.204:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 148.143.50.93:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 49.188.227.80:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 13.160.152.49:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 47.86.223.197:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 27.102.5.202:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 27.127.136.135:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 51.180.27.16:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 190.200.229.155:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 210.223.168.62:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 105.182.171.99:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 31.71.66.111:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 82.151.6.189:10001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 107.30.191.230:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 111.0.85.86:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 147.165.214.195:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 120.176.255.240:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 81.100.152.224:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 122.126.203.67:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 111.122.51.137:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 32.40.195.210:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 208.161.158.224:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 213.162.230.172:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 144.9.141.228:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 9.226.125.124:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 155.232.208.225:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 101.43.47.148:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 105.83.158.193:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 108.107.34.235:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 74.105.16.11:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 123.193.145.180:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.98.209.222:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.9.100.91:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 156.59.71.157:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.75.130.155:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 64.41.246.61:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 203.4.91.93:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 61.179.95.59:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 207.102.108.189:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.140.54.96:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 68.117.21.50:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 74.150.221.154:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 161.89.244.243:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 199.175.20.221:2030
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 48.39.87.178:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 129.93.151.198:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.94.71.234:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 77.21.113.4:2223
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 118.109.46.65:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 125.74.96.49:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 37.215.186.66:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.51.7.199:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 221.189.190.51:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.5.32.121:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 44.2.120.182:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 156.63.48.91:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 159.210.235.141:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 185.237.40.115:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 109.42.251.67:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 168.99.168.60:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 103.28.129.25:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 5.246.93.57:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 103.9.82.210:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 205.135.90.233:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.152.70.39:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 8.122.3.90:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 152.234.66.109:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 213.150.221.222:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 66.129.134.57:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.88.175.209:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 92.43.217.93:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 122.246.22.38:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.6.245.126:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 114.87.133.198:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 196.165.14.62:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 37.231.43.136:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 102.94.220.139:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 175.252.49.244:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 108.226.38.124:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 123.57.116.38:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 136.130.156.236:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 72.148.76.103:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 109.69.85.35:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 48.98.32.239:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 94.44.199.87:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 80.239.187.9:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 217.240.157.134:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.150.157.239:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 14.68.49.168:38622
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 84.85.45.42:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 49.119.90.122:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.2.218.255:38622
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 104.161.193.185:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 107.153.215.25:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 140.191.163.67:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 187.218.135.185:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 159.62.155.109:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 126.162.125.116:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 141.170.208.19:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 176.33.28.93:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 178.1.32.11:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 62.76.233.90:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 211.167.107.127:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 136.157.241.53:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 108.19.3.80:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 207.180.211.32:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 23.143.215.12:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 14.253.129.132:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 169.23.101.244:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 69.102.55.229:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 53.143.148.180:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 112.98.33.127:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 96.116.99.118:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 186.11.218.81:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 92.202.162.64:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 205.65.209.15:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 47.59.191.89:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 62.224.39.202:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 112.170.72.127:2223
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 171.97.133.114:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 88.49.19.209:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 96.35.175.204:523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 132.61.118.128:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 143.236.168.45:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 92.25.111.115:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 87.224.213.58:523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 69.253.207.21:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 149.136.108.154:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.245.160.90:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 178.187.48.100:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 68.183.80.229:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 34.172.178.226:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 201.4.4.115:5523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 164.242.191.188:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 72.180.231.152:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 59.1.96.63:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 9.168.158.218:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 93.10.14.241:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 146.53.118.96:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 103.42.88.244:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 13.152.71.37:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 204.191.129.123:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 107.129.100.237:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 32.232.146.36:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 44.188.245.173:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 120.226.188.24:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 181.163.30.171:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.88.102.16:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 95.80.202.18:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 128.212.253.95:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 31.239.21.207:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 13.114.151.61:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 39.249.214.166:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 133.35.26.241:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.174.205.247:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 179.43.95.94:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 171.100.42.192:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 209.127.48.227:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 184.255.46.43:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 79.60.122.65:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 98.225.169.56:17000
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 219.152.169.6:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 71.112.59.88:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 41.102.3.115:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 96.52.126.106:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 1.244.18.39:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 185.196.14.69:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 46.222.104.81:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 141.21.250.183:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 86.184.109.244:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 110.173.179.40:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 111.160.142.29:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.64.72.37:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.185.217.194:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 70.138.249.181:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 167.205.82.130:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 207.36.87.185:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 116.77.140.241:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 35.87.83.173:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.157.89.98:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 178.0.53.98:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 86.161.214.156:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 147.181.108.106:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 104.96.202.220:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 101.222.122.189:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 80.37.218.143:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.8.243.96:9001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.4.108.209:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 63.156.252.161:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 149.64.242.28:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 155.181.85.184:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 223.16.23.91:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 193.121.70.224:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 210.190.122.53:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 53.223.103.152:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 149.151.215.61:9001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 201.219.34.119:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 38.192.131.79:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 42.23.183.61:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 170.36.173.64:60009
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 221.181.91.189:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 1.145.24.74:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 112.184.235.60:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 53.122.197.163:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 99.200.194.250:38622
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.131.49.27:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 113.56.175.18:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 59.238.1.85:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 59.35.19.168:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 195.57.28.22:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 181.24.93.163:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 107.175.161.27:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 62.36.129.252:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 27.3.187.183:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 205.140.109.83:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 220.20.199.4:254
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 87.1.177.165:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 178.127.164.8:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.43.227.250:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 210.23.221.124:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 39.3.179.115:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 143.132.229.6:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.86.196.59:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 149.3.25.227:523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.248.55.225:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.233.131.203:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 118.46.244.35:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 186.101.28.71:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 45.159.176.111:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 162.42.82.135:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 120.136.73.68:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 36.138.163.197:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 189.254.133.100:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 84.157.5.66:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 208.185.25.232:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 165.93.25.182:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 24.63.245.81:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 86.77.107.240:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 118.90.114.111:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 148.253.36.159:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.187.18.116:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 45.111.150.4:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 203.186.181.23:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 200.131.171.172:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 34.23.144.152:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 72.128.135.4:17000
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 72.7.59.21:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 124.122.243.91:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 111.180.121.56:2030
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 74.20.4.11:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 160.238.193.100:9001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 138.32.51.125:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 84.111.240.206:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 126.36.186.242:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 190.196.119.196:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 136.44.78.66:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.236.100.244:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 19.25.109.102:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.211.173.116:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 162.26.178.163:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 73.232.199.92:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 108.128.100.27:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.158.254.183:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 175.122.169.152:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 137.114.13.68:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.249.172.30:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 57.244.234.120:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 136.205.124.174:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 202.25.142.236:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.92.196.66:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 51.106.92.96:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 74.176.218.219:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 45.114.136.26:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 218.243.220.195:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 82.166.40.189:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 180.166.148.101:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 23.208.18.0:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 87.99.9.181:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.234.87.41:2223
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 120.40.177.176:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 43.172.227.70:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 57.145.146.226:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.37.127.58:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 40.83.55.103:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 138.192.30.126:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 23.121.188.210:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 71.174.180.78:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 136.11.179.156:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.252.168.26:2332
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.32.210.234:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 66.202.30.78:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 217.171.203.124:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 155.171.148.191:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 137.6.147.88:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 196.212.127.241:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 79.119.209.105:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.93.57.103:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 204.19.177.223:10001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 152.51.80.175:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 90.93.5.109:2601
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 175.86.11.205:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 191.187.81.74:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 13.134.67.14:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 94.117.138.35:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 24.29.129.51:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.55.27.92:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 125.57.124.81:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 45.116.51.30:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 184.181.70.138:254
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 43.2.133.95:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 95.70.90.60:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 99.190.254.52:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 207.52.105.10:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 44.174.169.160:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 162.241.153.201:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 88.237.209.31:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 157.219.116.238:5523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 216.162.150.214:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 50.74.45.116:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 147.65.131.241:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 162.152.218.158:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 25.28.237.241:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 193.196.252.255:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 145.37.97.1:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 93.158.137.35:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 152.19.44.84:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 64.118.84.136:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 88.152.161.180:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 91.22.128.201:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.144.59.126:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 143.4.184.211:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 131.234.131.118:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 126.33.152.94:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 111.145.137.110:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 52.89.195.197:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 135.140.52.114:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.157.180.218:523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 147.26.11.181:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 79.162.200.255:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 121.171.227.144:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 156.80.73.170:5523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 144.239.244.55:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 4.33.37.24:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 20.24.171.198:63210
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 220.0.211.150:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 122.35.65.213:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 141.251.236.8:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 95.141.163.237:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 38.166.157.202:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 57.1.102.147:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 68.64.71.57:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 196.60.37.161:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 177.222.53.127:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 85.109.2.210:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 66.162.6.185:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 141.189.107.115:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 112.190.133.3:60009
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 159.166.89.234:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 208.46.222.125:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 199.155.192.206:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 118.106.172.236:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 211.69.129.21:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 61.207.28.49:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 150.8.112.82:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 78.222.223.174:2030
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 216.113.124.140:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.215.15.238:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 134.30.114.195:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 58.220.146.220:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 49.27.142.8:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 184.199.16.100:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 216.120.117.132:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 191.141.110.156:30003
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 63.213.233.222:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 175.185.108.214:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 86.108.56.232:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.131.145.108:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.209.22.0:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 110.238.182.245:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.25.212.46:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 216.217.87.33:10001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.201.30.63:10001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 53.217.241.185:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 107.54.106.185:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.21.13.153:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 41.0.165.2:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 177.155.68.115:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 40.130.6.87:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 129.70.72.225:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 92.36.186.23:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 54.113.190.205:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 159.170.140.155:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 188.172.219.103:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 86.9.105.209:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 112.71.7.172:9001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 98.97.204.156:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 63.22.145.252:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 213.123.128.210:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 90.208.243.50:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 144.73.31.9:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 18.250.88.231:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 119.253.223.219:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 78.139.127.195:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 193.142.168.136:17000
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 44.223.101.187:9999
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 140.96.92.82:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 205.125.199.20:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 31.44.238.106:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 70.190.226.4:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 208.57.121.72:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 41.139.243.113:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 75.142.221.107:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 204.105.47.201:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 61.124.149.100:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 52.11.208.175:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 159.173.121.83:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 119.144.150.188:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 167.171.125.84:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 114.121.1.60:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 69.247.15.175:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 71.82.108.12:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 173.228.207.193:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 163.81.128.112:10001
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 78.229.179.4:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 19.82.126.244:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 219.234.222.46:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 193.64.22.134:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 114.9.158.187:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 97.170.55.174:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 65.109.99.80:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 102.20.54.100:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 167.77.76.44:2002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 142.222.181.14:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 95.36.20.215:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 220.161.255.10:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 37.63.134.217:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 105.109.135.101:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 8.157.129.196:63256
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 17.209.208.130:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 132.189.15.171:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 178.14.197.241:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 161.17.46.141:6023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 222.206.170.219:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 212.181.88.169:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 32.112.198.226:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 208.227.156.102:6962
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 78.102.85.19:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 37.23.130.234:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 174.232.103.68:10023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 49.134.243.147:26
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 149.62.66.105:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 54.219.114.36:1023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 191.190.92.247:17000
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 66.67.92.192:7777
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 51.184.240.171:23023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 130.64.130.236:60023
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 40.91.171.67:6002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 52.94.175.43:2323
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 43.20.5.194:5523
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 141.197.178.199:30002
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 170.243.197.96:7218
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 119.19.93.20:38622
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 76.233.54.105:4719
Source: global traffic TCP traffic: 192.168.2.23:23912 -> 20.126.1.60:63256
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 5.230.251.14
Source: unknown TCP traffic detected without corresponding DNS query: 91.34.25.81
Source: unknown TCP traffic detected without corresponding DNS query: 14.2.250.238
Source: unknown TCP traffic detected without corresponding DNS query: 68.242.224.177
Source: unknown TCP traffic detected without corresponding DNS query: 187.180.214.16
Source: unknown TCP traffic detected without corresponding DNS query: 80.134.33.48
Source: unknown TCP traffic detected without corresponding DNS query: 19.142.14.236
Source: unknown TCP traffic detected without corresponding DNS query: 197.14.52.194
Source: unknown TCP traffic detected without corresponding DNS query: 137.250.215.8
Source: unknown TCP traffic detected without corresponding DNS query: 174.187.247.230
Source: unknown TCP traffic detected without corresponding DNS query: 60.9.149.107
Source: unknown TCP traffic detected without corresponding DNS query: 102.92.112.193
Source: unknown TCP traffic detected without corresponding DNS query: 200.27.208.232
Source: unknown TCP traffic detected without corresponding DNS query: 12.169.84.249
Source: unknown TCP traffic detected without corresponding DNS query: 42.221.21.142
Source: unknown TCP traffic detected without corresponding DNS query: 134.163.90.237
Source: unknown TCP traffic detected without corresponding DNS query: 185.146.160.205
Source: unknown TCP traffic detected without corresponding DNS query: 94.129.139.93
Source: unknown TCP traffic detected without corresponding DNS query: 172.14.243.81
Source: unknown TCP traffic detected without corresponding DNS query: 188.185.167.10
Source: unknown TCP traffic detected without corresponding DNS query: 142.63.137.109
Source: unknown TCP traffic detected without corresponding DNS query: 113.155.84.156
Source: unknown TCP traffic detected without corresponding DNS query: 150.41.40.54
Source: unknown TCP traffic detected without corresponding DNS query: 100.217.99.36
Source: unknown TCP traffic detected without corresponding DNS query: 108.86.43.105
Source: unknown TCP traffic detected without corresponding DNS query: 173.132.81.206
Source: unknown TCP traffic detected without corresponding DNS query: 195.233.240.237
Source: unknown TCP traffic detected without corresponding DNS query: 42.174.106.28
Source: unknown TCP traffic detected without corresponding DNS query: 138.240.159.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.226.152.112
Source: unknown TCP traffic detected without corresponding DNS query: 67.113.226.5
Source: unknown TCP traffic detected without corresponding DNS query: 97.136.30.218
Source: unknown TCP traffic detected without corresponding DNS query: 133.117.119.16
Source: unknown TCP traffic detected without corresponding DNS query: 58.182.253.143
Source: unknown TCP traffic detected without corresponding DNS query: 208.40.188.149
Source: unknown TCP traffic detected without corresponding DNS query: 96.132.46.38
Source: unknown TCP traffic detected without corresponding DNS query: 123.109.217.77
Source: unknown TCP traffic detected without corresponding DNS query: 83.71.250.87
Source: unknown TCP traffic detected without corresponding DNS query: 204.59.106.50
Source: unknown TCP traffic detected without corresponding DNS query: 78.218.200.34
Source: unknown TCP traffic detected without corresponding DNS query: 27.208.228.191
Source: unknown TCP traffic detected without corresponding DNS query: 146.4.230.232
Source: unknown TCP traffic detected without corresponding DNS query: 49.48.106.109
Source: unknown TCP traffic detected without corresponding DNS query: 133.172.6.199
Source: unknown TCP traffic detected without corresponding DNS query: 112.191.231.38
Source: unknown TCP traffic detected without corresponding DNS query: 31.187.153.149
Source: unknown TCP traffic detected without corresponding DNS query: 61.74.152.235
Source: unknown TCP traffic detected without corresponding DNS query: 208.63.176.17
Source: unknown TCP traffic detected without corresponding DNS query: 155.144.25.238
Source: global traffic DNS traffic detected: DNS query: pool.rentcheapcars.sbs
Source: global traffic DNS traffic detected: DNS query: iranistrash.libre
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -en '
Source: Initial sample String containing 'busybox' found: .d && /bin/busybox echo -e '\x46\x49\x4e'
Source: Initial sample String containing 'busybox' found: /bin/busybox echo '
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod 777 .d; ./.d > .b; /bin/busybox chmod 777 .b; ./.b matrix
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -en ''>.d && /bin/busybox echo -e '\x46\x49\x4e'
Source: Initial sample String containing 'busybox' found: /bin/busybox echo '\c'>>/bin/busybox chmod 777 .d; ./.d > .b; /bin/busybox chmod 777 .b; ./.b matrix
Source: Initial sample String containing 'busybox' found: rm -rf .d; rm -rf .b; >.d; (chmod 777 .d || /bin/busybox chmod 777 .d || cp /bin/sh .d; >.d); >.b; (chmod 777 .b || /bin/busybox chmod 777 .b || cp /bin/sh .b; >.b)
Source: Initial sample String containing 'busybox' found: /bin/busybox cat /proc/self/exe || cat /bin/echo
Source: Initial sample String containing 'busybox' found: /bin/busybox wget --help; /bin/busybox ftpget --help; /bin/busybox echo -e '\x67\x61\x79\x66\x67\x74';
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -e '\x53\x54\x41\x52\x54'; cat /proc/cpuinfo; /bin/busybox echo -e '\x45\x4e\x44'
Source: Initial sample String containing 'busybox' found: BusyBox on \S+ \wogin
Source: Initial sample String containing 'busybox' found: ELFsage: wgetsage: ftpgetgayfgt/bin/busybox echo -e '\x53\x54\x41\x52\x54'; cat /proc/cpuinfo; /bin/busybox echo -e '\x45\x4e\x44'
Source: Initial sample String containing 'busybox' found: /usr//mnt//var/run//dev/shm//etc//var//tmp//dev//var/home/user/fw/admin1231234666666ubnt888888klv12340000111111111111123451234561234567890admin12601hx4321543216543217ujMko0admin88888888a1sev5y7c39kAdminadmin123AdmiN*123admin1234adminHWadminpassBrAhMoS@15CalVxePV1! cat1029CenturyL1nkchzhdplconexantCTLsupport12cxx4dm1n5591epicrouterGeNeXiS@19gponAdminGPONALC#FGUgw1adminh@32LuyDho4uku6atadministratorAdministratorsupervisormeinsmmicrobusinessnology*/P@55w0rd!passpasswordplumeria0077QwestM0demripcode!roots2@We3%Dc#smcadminstdONU101systemtechTeleCom_1234telnetv2mprtve0RbANGXpon@Olt9417##xTaaA8jzhoneadtecadtecftpbinCMCCAdmine8telnetCUAdmindaemondefaulttluafedvhd1206e8ehome1e8ehomee8ehomeasbhi3518EpuseruserEpfliruser3vligftpvideoguestguest123!!Huawei@HuaweiHgwkeomeolnadminlnadmin0123456mg3500merlinmothernobodyontONTUSERSUGAR2A041rapportr@p8p0r+remotessh5SaP9I26!@#$qwer00000000000000000000059AnkJ070admin11001chin11111111234qwer1.oN%cpi2010vesta2011vesta207B16th23we98oi258025804uvdzKqBkj.jg5up/*6.=_ja7ujMko0vizxvadminp
Sample contains strings indicative of password brute-forcing capabilities
Source: Initial sample String containing potential weak password found: admin
Source: Initial sample String containing potential weak password found: 12345
Source: Initial sample String containing potential weak password found: 123456
Source: Initial sample String containing potential weak password found: 54321
Source: Initial sample String containing potential weak password found: 654321
Source: Initial sample String containing potential weak password found: admin1234
Source: Initial sample String containing potential weak password found: administrator
Source: Initial sample String containing potential weak password found: supervisor
Source: Initial sample String containing potential weak password found: password
Source: Initial sample String containing potential weak password found: default
Source: Initial sample String containing potential weak password found: guest
Source: Initial sample String containing potential weak password found: service
Source: Initial sample String containing potential weak password found: support
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal72.troj.spyw.evad.linELF@0/0@2/0

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/armv6l.elf (PID: 6229) File: /tmp/armv6l.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/armv6l.elf (PID: 6229) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/armv6l.elf (PID: 6231) Queries kernel information via 'uname': Jump to behavior
Source: armv6l.elf, 6229.1.000055f9a4421000.000055f9a4570000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv6l.elf, 6229.1.000055f9a4421000.000055f9a4570000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: armv6l.elf, 6229.1.00007ffe21625000.00007ffe21646000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: armv6l.elf, 6229.1.00007ffe21625000.00007ffe21646000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv6l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv6l.elf

HIPS / PFW / Operating System Protection Evasion
barindex
Performs DNS TXT record lookups
Source: Traffic DNS traffic detected: queries for: pool.rentcheapcars.sbs
Source: Traffic DNS traffic detected: queries for: iranistrash.libre

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
179.105.229.148
 unknown Brazil
28573 CLAROSABR false
107.157.28.104
 unknown United States
7065 SONOMAUS false
93.175.9.238
 unknown Russian Federation
5467 MIPTMIPT-NETRU false
162.5.213.136
 unknown United States
33348 PIERCE-COUNTYUS false
49.113.196.117
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
118.115.136.105
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
210.23.221.124
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
32.109.229.106
 unknown United States
2688 ATGS-MMD-ASUS false
76.101.7.60
 unknown United States
7922 COMCAST-7922US false
8.136.162.222
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
45.116.51.30
 unknown Australia
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
149.63.128.209
 unknown United States
46746 SECURE-24-DCDUS false
209.138.197.60
 unknown United States
701 UUNETUS false
52.119.126.137
 unknown United States
32329 MONKEYBRAINSUS false
206.203.71.240
 unknown United States
10599 MCKESSONUS false
36.52.242.173
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
163.94.72.185
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
158.202.39.98
 unknown Japan 2522 PPP-EXPJapanNetworkInformationCenterJP false
212.97.214.153
 unknown Denmark
3308 TELIANET-DENMARKDK false
66.135.23.86
 unknown United States
18566 MEGAPATH5-US false
172.61.8.49
 unknown United States
21928 T-MOBILE-AS21928US false
154.119.222.246
 unknown Gabon
16058 Gabon-TelecomGA false
74.112.207.38
 unknown United States
11288 IDMS101US false
39.161.186.244
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
201.147.89.39
 unknown Mexico
8151 UninetSAdeCVMX false
71.251.186.235
 unknown United States
701 UUNETUS false
34.76.42.215
 unknown United States
15169 GOOGLEUS false
203.27.75.170
 unknown Australia
9449 RPI-AS-APRPInternetServicesAU false
157.251.139.58
 unknown United States
32934 FACEBOOKUS false
131.75.36.223
 unknown United States
27046 DNIC-ASBLK-27032-27159US false
93.10.14.241
 unknown France
15557 LDCOMNETFR false
209.27.114.3
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
172.76.164.149
 unknown United States
5650 FRONTIER-FRTRUS false
138.242.144.241
 unknown United States
12980 EMEAHostingAutonomousSystemEU false
87.66.17.115
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
18.207.104.163
 unknown United States
14618 AMAZON-AESUS false
126.40.165.14
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
81.146.57.148
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
103.22.255.81
 unknown China
55966 CNNIC-PSBCNET-APPostSavingsBankofChinaCN false
88.21.61.147
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
107.108.241.254
 unknown United States
7018 ATT-INTERNET4US false
184.127.140.67
 unknown United States
7922 COMCAST-7922US false
169.155.149.8
 unknown United States
3525 ALBERTSONSUS false
118.132.184.40
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
179.247.144.16
 unknown Brazil
27699 TELEFONICABRASILSABR false
112.123.89.33
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
137.41.104.84
 unknown United States
721 DNIC-ASBLK-00721-00726US false
217.221.88.2
 unknown Italy
8968 BT-ITALIAIT false
200.235.176.85
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
216.73.137.194
 unknown United States
7029 WINDSTREAMUS false
198.255.225.67
 unknown United States
11351 TWC-11351-NORTHEASTUS false
168.204.186.101
 unknown United States
27435 OPSOURCE-INCUS false
198.218.13.105
 unknown United States
721 DNIC-ASBLK-00721-00726US false
106.177.27.101
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
154.158.105.3
 unknown Kenya
36926 CKL1-ASNKE false
158.163.60.218
 unknown Canada
1930 RCCNFundacaoparaaCienciaeaTecnologiaIPPT false
95.58.165.121
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
80.80.142.153
 unknown Bulgaria
12829 ANGELSOFTBulgariaBG false
162.64.37.90
 unknown United States
35893 ACPCA false
43.48.41.83
 unknown Japan 4249 LILLY-ASUS false
218.216.177.246
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
164.65.25.50
 unknown United States
1778 DNIC-AS-01778US false
45.1.48.143
 unknown United States
7377 UCSDUS false
185.79.8.146
 unknown Netherlands
43366 OSSONL false
212.92.14.121
 unknown Hungary
8990 AHRT-ASHU false
168.130.175.157
 unknown Australia
27435 OPSOURCE-INCUS false
179.72.65.156
 unknown Brazil
26615 TIMSABR false
97.202.24.207
 unknown United States
6167 CELLCO-PARTUS false
166.161.249.163
 unknown United States
22394 CELLCOUS false
68.30.144.235
 unknown United States
10507 SPCSUS false
121.17.98.128
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
80.142.59.200
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
105.52.166.43
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
118.193.187.249
 unknown China
137443 ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK false
131.211.179.206
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
38.246.65.208
 unknown United States
174 COGENT-174US false
41.24.221.235
 unknown South Africa
36994 Vodacom-VBZA false
138.110.55.83
 unknown United States
396349 FIVE-COLLEGE-DATA-NETWORK-ASUS false
135.101.1.40
 unknown United States
18676 AVAYAUS false
91.225.177.107
 unknown Poland
56544 MARLENAPL false
166.91.116.18
 unknown United States
33084 DC-NETUS false
119.174.245.99
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
40.58.152.80
 unknown United States
4249 LILLY-ASUS false
57.1.102.147
 unknown Belgium
2686 ATGS-MMD-ASUS false
190.162.179.135
 unknown Chile
22047 VTRBANDAANCHASACL false
186.180.36.76
 unknown Colombia
27831 ColombiaMovilCO false
94.98.119.107
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
157.248.204.196
 unknown United States
32934 FACEBOOKUS false
161.173.205.108
 unknown United States
10695 WAL-MARTUS false
116.113.0.59
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
130.82.176.202
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
133.152.127.253
 unknown Japan 38634 DWANGODWANGOCoLtdJP false
134.241.211.238
 unknown United States
1256 MASSNET-ASUS false
216.5.54.227
 unknown United States
394939 NYDJ-APPAREL-LLCUS false
164.220.125.21
 unknown United States
5180 DNIC-ASBLK-05120-05376US false
24.44.243.208
 unknown United States
6128 CABLE-NET-1US false
164.213.165.237
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
177.30.221.35
 unknown Brazil
26615 TIMSABR false
112.59.20.68
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
197.156.10.123
 unknown South Africa
37525 BYTES-CON-1ZA false

Contacted Domains

Name IP Active
iranistrash.libre unknown unknown
pool.rentcheapcars.sbs unknown unknown