Play interactive tour

Edit tour

Linux Analysis Report zD1jpTbFQq

Overview

General Information

Sample Name:	zD1jpTbFQq
Analysis ID:	518915
MD5:	e06f0a88a25db599d47dadb03907ef00
SHA1:	ee8da3d3dffde40ef93700991aa5d472d760fda5
SHA256:	f3f57dc399b0dc7bbe3a019afb7d7402c40274deea75b2cc605ff13e94229c71
Tags:	32elfmiraipowerpc
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara signature match

Sample has stripped symbol table

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	518915
Start date:	10.11.2021
Start time:	04:52:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	zD1jpTbFQq
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal60.troj.lin@0/4@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing network information. TCP Packets have been reduced to 100 VT rate limit hit for: /opt/package/joesandbox/database/analysis/518915/sample/zD1jpTbFQq

Process Tree

system is lnxubuntu20

zD1jpTbFQq (PID: 5245, Parent: 5119, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/zD1jpTbFQq

zD1jpTbFQq New Fork (PID: 5247, Parent: 5245)

zD1jpTbFQq New Fork (PID: 5248, Parent: 5245)

zD1jpTbFQq New Fork (PID: 5251, Parent: 5248)

zD1jpTbFQq New Fork (PID: 5252, Parent: 5248)

zD1jpTbFQq New Fork (PID: 5257, Parent: 5248)

zD1jpTbFQq New Fork (PID: 5258, Parent: 5248)

zD1jpTbFQq New Fork (PID: 5261, Parent: 5248)

zD1jpTbFQq New Fork (PID: 5266, Parent: 5261)

zD1jpTbFQq New Fork (PID: 5262, Parent: 5248)

systemd New Fork (PID: 5268, Parent: 1)

journalctl (PID: 5268, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5280, Parent: 1)

systemd-journald (PID: 5280, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

xfce4-session New Fork (PID: 5283, Parent: 1900)

xfsettingsd (PID: 5283, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5294, Parent: 5283)

xfce4-session New Fork (PID: 5295, Parent: 1900)

xfsettingsd (PID: 5295, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5296, Parent: 5295)

xfce4-session New Fork (PID: 5297, Parent: 1900)

xfsettingsd (PID: 5297, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5302, Parent: 5297)

xfce4-session New Fork (PID: 5303, Parent: 1900)

xfsettingsd (PID: 5303, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5308, Parent: 5303)

xfce4-session New Fork (PID: 5309, Parent: 1900)

xfsettingsd (PID: 5309, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5314, Parent: 5309)

systemd New Fork (PID: 5317, Parent: 1)

journalctl (PID: 5317, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
zD1jpTbFQq	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9

Memory Dumps

Source	Rule	Description	Author	Strings
5251.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5248.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5258.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5258.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5247.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5248.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5251.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5247.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5257.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5257.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5252.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5245.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
5245.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x150e0:$xo1: Dfs`eeh&<'9 0x15158:$xo1: Dfs`eeh&<'9 0x151cc:$xo1: Dfs`eeh&<'9 0x1523c:$xo1: Dfs`eeh&<'9 0x15288:$xo1: Dfs`eeh&<'9
5252.1.00000000d3035e25.00000000c57598df.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x250c:$xo1: Dfs`eeh&<'9 0x2588:$xo1: Dfs`eeh&<'9 0x2600:$xo1: Dfs`eeh&<'9 0x2674:$xo1: Dfs`eeh&<'9 0x26c4:$xo1: Dfs`eeh&<'9
Process Memory Space: zD1jpTbFQq PID: 5245	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0xd29b:$xo1: Dfs`eeh&<'9 0xd311:$xo1: Dfs`eeh&<'9 0xd385:$xo1: Dfs`eeh&<'9 0xd3f4:$xo1: Dfs`eeh&<'9 0xd461:$xo1: Dfs`eeh&<'9 0xd4d6:$xo1: Dfs`eeh&<'9 0xd549:$xo1: Dfs`eeh&<'9 0xd5b7:$xo1: Dfs`eeh&<'9 0xd601:$xo1: Dfs`eeh&<'9 0xd6a9:$xo1: Dfs`eeh&<'9
Click to see the 10 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: zD1jpTbFQq

ReversingLabs: Detection: 59%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 716 INFO TELNET access 109.70.207.246:23 -> 192.168.2.23:44514
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:46984
Source: Traffic	Snort IDS: 2023447 ET TROJAN Possible Linux.Mirai Login Attempt (service) 192.168.2.23:48216 -> 114.147.117.8:23
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47020
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47166
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47186
Source: Traffic	Snort IDS: 716 INFO TELNET access 109.70.207.246:23 -> 192.168.2.23:44862
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47258
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42472
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42536
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47420
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42566
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 197.210.158.54:23 -> 192.168.2.23:51614
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 197.210.158.54:23 -> 192.168.2.23:51614
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42622
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47516
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42678
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42802
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.84.55.158:23 -> 192.168.2.23:47702
Source: Traffic	Snort IDS: 716 INFO TELNET access 94.247.88.97:23 -> 192.168.2.23:42882
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 197.210.158.54:23 -> 192.168.2.23:51904
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 197.210.158.54:23 -> 192.168.2.23:51904

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42810
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42814
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42828
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42844
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42858
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42872
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42886
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42922
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42938
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42954
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42962
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42970
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42980
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42988
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42996
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43008
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43018
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43032
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43042
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43048
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43056
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43062
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43066
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43072

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic	TCP traffic: 192.168.2.23:49932 -> 107.174.241.209:60420
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 140.204.138.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 179.124.194.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 124.112.15.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 184.185.11.5:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 174.196.205.61:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 71.3.40.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 124.189.180.29:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 17.244.131.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 201.239.18.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 79.25.107.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 223.221.192.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 75.180.33.85:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 161.167.136.173:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 142.136.217.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 195.115.116.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 61.113.89.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 98.22.34.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 2.58.12.23:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 45.7.52.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 201.38.152.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 98.233.56.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 164.142.37.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 183.76.189.23:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 112.245.185.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 92.85.112.89:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 111.222.104.178:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 13.169.227.98:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 169.38.151.29:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 182.206.36.179:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 167.157.126.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 20.164.28.161:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 222.17.85.85:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 185.213.3.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 219.175.5.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 24.248.39.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 113.14.31.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 105.43.11.201:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 218.171.96.214:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 34.84.145.218:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 147.229.86.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 92.4.60.158:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 212.53.10.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 2.224.26.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 12.103.144.191:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 155.127.113.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 58.195.36.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 183.157.174.95:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 151.245.254.198:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 17.253.148.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 178.89.58.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 60.30.250.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 223.50.180.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 76.108.180.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 121.230.33.250:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 20.138.27.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 91.163.197.36:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 84.223.148.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 181.123.158.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 19.101.115.85:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 144.83.81.169:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 93.98.10.181:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 178.255.65.107:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 68.171.170.198:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 216.189.249.145:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 83.147.112.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 118.66.68.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 191.99.144.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 104.8.51.79:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 67.61.48.13:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 114.68.152.137:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 147.179.71.243:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 81.244.202.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 37.127.242.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 160.102.197.16:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 46.34.16.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 170.250.60.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 86.22.235.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 45.157.241.42:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 59.215.98.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 9.85.79.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 199.26.170.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 40.214.194.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 37.237.134.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 77.251.252.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 162.185.248.1:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 63.185.94.107:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 154.206.112.16:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 181.123.252.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 189.16.18.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 108.190.36.4:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 85.255.151.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 208.208.20.95:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 63.150.10.254:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 84.202.88.66:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 58.118.110.168:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 97.8.117.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 82.138.207.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 103.167.137.215:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 145.19.248.7:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 219.157.114.227:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 91.207.237.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 92.148.184.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 70.115.8.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 207.116.165.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 168.161.165.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 114.212.48.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 68.64.68.105:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 186.76.13.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 68.48.215.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 175.116.102.221:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 1.134.11.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 156.225.83.91:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 42.161.156.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 110.50.10.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 142.4.71.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 27.119.156.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 59.88.158.207:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 177.255.136.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 149.3.181.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 31.200.237.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 61.91.163.47:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 67.96.230.145:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 58.185.109.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 12.56.29.178:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 158.227.151.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 200.94.71.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 31.65.226.177:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 13.103.67.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 87.56.67.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 197.96.129.139:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 104.190.119.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 223.51.201.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 98.180.89.228:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 36.182.82.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 211.12.14.123:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 37.222.242.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 99.172.30.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 12.116.252.245:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 200.182.246.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 43.95.5.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 126.138.121.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 156.233.230.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 190.67.100.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 185.168.187.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 210.200.175.152:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 221.0.15.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 90.52.230.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 53.156.170.5:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 97.208.198.80:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 220.74.170.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 45.173.7.248:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 100.242.9.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 74.37.25.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 195.44.186.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 96.122.151.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 99.94.22.95:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 80.122.69.166:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 18.225.220.231:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 88.150.96.57:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 112.254.134.19:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 121.87.64.166:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 47.131.247.182:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 162.164.6.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 12.165.196.235:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 74.73.29.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 31.255.84.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 144.80.194.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 70.187.171.218:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 32.211.243.217:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 90.85.98.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 158.199.173.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 152.74.69.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 148.141.236.192:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 119.91.63.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 202.86.181.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 92.9.186.166:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 103.190.227.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 193.125.17.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 220.66.227.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 68.166.31.54:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 106.173.190.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 222.37.229.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 177.30.147.1:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 78.40.115.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 112.191.22.63:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 80.185.204.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 85.11.100.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 196.45.123.235:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 181.60.122.219:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 13.15.215.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 223.103.174.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 177.46.121.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 4.62.120.232:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 101.82.135.158:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 113.102.185.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 153.161.140.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 200.30.235.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 217.120.77.221:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 175.182.153.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 142.62.215.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 165.120.149.113:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 191.93.170.151:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 155.73.113.228:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 193.38.227.231:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 71.96.80.254:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 37.14.182.123:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 88.131.181.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 86.147.111.203:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 220.71.251.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 176.13.207.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 67.131.41.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 146.117.164.79:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 62.34.194.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 54.255.77.172:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 46.25.183.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 43.170.32.24:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 210.14.72.108:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 113.17.59.191:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 209.66.176.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 182.15.3.105:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 104.203.22.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 221.56.47.72:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 98.246.175.220:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 63.73.32.98:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 27.250.125.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 203.26.7.223:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 183.47.184.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 14.62.61.53:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 67.39.97.75:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 133.134.85.72:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 14.24.164.78:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 122.166.210.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 73.90.166.90:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 124.181.162.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 167.85.174.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 162.103.197.195:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 81.250.145.91:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 212.243.79.163:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 115.208.18.124:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 194.30.202.184:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 182.200.238.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 170.158.84.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 213.106.76.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 115.157.90.203:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 203.113.113.66:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 157.137.61.107:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 69.92.18.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 112.182.216.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 126.132.118.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 57.6.177.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 166.219.26.232:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 44.173.239.51:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 110.49.212.92:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 40.248.107.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 152.41.163.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 75.2.188.24:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 222.8.91.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 1.222.235.212:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 42.178.29.182:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 165.253.206.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 180.172.60.16:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 155.255.11.63:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 95.121.191.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 208.250.99.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 74.206.149.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 81.134.109.214:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 89.232.81.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 34.149.102.205:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 222.202.102.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 44.23.82.179:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 102.37.143.141:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 5.109.226.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 92.150.114.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 209.184.230.231:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 77.115.41.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 47.127.9.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 135.165.238.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 103.152.5.94:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 211.99.205.223:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 169.41.65.243:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 75.8.15.82:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 71.25.117.203:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 57.115.3.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 177.62.129.37:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 190.45.171.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 58.23.58.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 221.217.33.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 110.217.128.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 115.205.81.181:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 190.137.151.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 193.59.232.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 82.99.131.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 188.17.64.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 101.190.43.233:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 106.44.69.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 198.160.68.175:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 201.115.69.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 111.136.106.170:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 125.207.121.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 158.145.190.59:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 166.82.99.176:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 191.104.98.208:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 59.41.115.170:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 170.35.11.59:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 89.38.36.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 157.47.176.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 20.245.75.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 124.110.206.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 165.136.250.141:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 197.130.116.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 156.30.143.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 37.248.36.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 202.249.102.184:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 180.78.207.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 31.124.132.89:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 32.14.81.0:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 46.30.152.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 174.252.107.207:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 135.157.127.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 24.64.83.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 115.184.153.66:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 211.2.250.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 37.139.115.128:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 212.253.177.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 103.21.33.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 174.47.63.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 103.27.206.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 48.223.125.74:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 124.107.126.248:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 100.23.126.61:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 185.164.171.66:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 62.122.159.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 159.61.223.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 41.144.105.207:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 150.72.167.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 114.153.37.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 223.46.134.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 99.172.251.218:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 202.231.109.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 71.39.101.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 196.233.103.30:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 163.130.26.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 77.177.42.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 88.55.67.173:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 105.105.56.90:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 103.190.194.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 9.135.61.174:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 63.100.17.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 211.97.174.128:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 181.104.247.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 207.58.104.27:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 162.39.35.107:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 207.63.83.254:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 223.252.10.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 8.43.157.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 82.188.248.214:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 32.158.70.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 77.210.119.36:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 222.69.6.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 146.88.250.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 179.213.126.235:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 2.160.56.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 180.20.66.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 182.16.243.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 168.30.119.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 84.92.129.252:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 223.165.175.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 154.200.117.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 179.16.203.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 142.145.75.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 146.179.129.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 211.4.57.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 184.66.142.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 65.224.93.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 222.81.240.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 61.56.41.179:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 191.212.233.198:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 37.226.5.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 204.232.211.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 35.154.31.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 92.121.160.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 189.16.243.204:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 53.44.8.167:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 2.89.170.59:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 206.226.163.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 211.8.213.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 82.118.210.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 122.182.123.143:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 44.248.118.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 179.119.67.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 155.128.157.169:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 53.31.141.137:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 179.232.45.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 13.202.125.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 1.239.0.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 60.17.117.246:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 27.250.178.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 24.40.155.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 14.134.76.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 74.179.208.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 107.47.6.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 74.78.42.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 63.185.197.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 147.117.36.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 139.144.100.121:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 53.234.214.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 37.43.0.140:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 108.103.232.148:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 86.8.159.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 14.220.115.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 133.252.65.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 161.72.25.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 138.222.253.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 168.37.183.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 79.60.94.10:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 94.223.138.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 24.36.203.227:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 96.93.145.46:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 102.22.242.124:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 200.235.49.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 54.61.97.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 145.56.59.80:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 45.239.86.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 78.7.230.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 197.228.109.40:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 128.239.177.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 190.132.137.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 87.186.106.201:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 188.9.169.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 122.19.228.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 47.172.6.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 41.118.147.10:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 164.73.84.123:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 179.30.220.82:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 71.200.64.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 57.104.160.98:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 167.95.203.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 67.229.33.210:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 65.242.218.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 158.197.64.80:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 79.136.225.207:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 44.2.91.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 153.15.129.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 115.0.89.35:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 62.59.249.54:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 40.255.223.98:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 149.77.183.222:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 157.251.221.18:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 73.166.126.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 142.210.210.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 161.47.206.10:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 35.136.90.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 158.129.141.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 176.161.95.231:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 122.126.239.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 185.90.100.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 170.196.235.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 149.131.55.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 177.201.198.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 178.140.58.92:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 162.88.16.208:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 36.122.200.143:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 181.245.205.178:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 211.162.104.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 27.168.157.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 103.215.29.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 87.92.235.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 142.24.171.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 148.50.176.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 40.214.156.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 112.86.43.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 4.164.86.214:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 217.239.36.11:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 148.211.118.221:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 91.161.60.88:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 70.170.206.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 180.113.63.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 72.58.51.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 142.119.35.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 144.1.215.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 146.19.81.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 27.234.230.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 5.181.39.168:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 108.90.177.118:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 181.185.26.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 213.203.196.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 223.109.49.176:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 202.22.191.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:53991 -> 71.112.124.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 41.27.76.140:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 211.174.210.57:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 143.236.238.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 202.109.226.173:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 213.15.15.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 111.83.248.143:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 175.250.58.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 187.188.77.16:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 59.210.131.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:54006 -> 104.156.181.73:2323

Source: /tmp/zD1jpTbFQq (PID: 5245)	Socket: 127.0.0.1::63841
Source: /tmp/zD1jpTbFQq (PID: 5248)	Socket: 0.0.0.0::23
Source: /lib/systemd/systemd-journald (PID: 5280)	Socket: <unknown socket type>:unknown

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 42.176.196.90
Source: unknown	TCP traffic detected without corresponding DNS query: 107.174.241.209
Source: unknown	TCP traffic detected without corresponding DNS query: 140.204.138.56
Source: unknown	TCP traffic detected without corresponding DNS query: 179.201.126.161
Source: unknown	TCP traffic detected without corresponding DNS query: 217.72.134.141
Source: unknown	TCP traffic detected without corresponding DNS query: 201.16.161.191
Source: unknown	TCP traffic detected without corresponding DNS query: 8.142.241.84
Source: unknown	TCP traffic detected without corresponding DNS query: 80.4.232.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.124.77.109
Source: unknown	TCP traffic detected without corresponding DNS query: 117.18.185.97
Source: unknown	TCP traffic detected without corresponding DNS query: 84.26.231.127
Source: unknown	TCP traffic detected without corresponding DNS query: 124.12.9.90
Source: unknown	TCP traffic detected without corresponding DNS query: 179.124.194.239
Source: unknown	TCP traffic detected without corresponding DNS query: 85.30.212.209
Source: unknown	TCP traffic detected without corresponding DNS query: 117.14.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 88.248.212.7
Source: unknown	TCP traffic detected without corresponding DNS query: 121.35.185.167
Source: unknown	TCP traffic detected without corresponding DNS query: 18.190.45.139
Source: unknown	TCP traffic detected without corresponding DNS query: 113.14.148.22
Source: unknown	TCP traffic detected without corresponding DNS query: 161.249.147.26
Source: unknown	TCP traffic detected without corresponding DNS query: 184.47.171.85
Source: unknown	TCP traffic detected without corresponding DNS query: 139.197.172.95
Source: unknown	TCP traffic detected without corresponding DNS query: 124.112.15.58
Source: unknown	TCP traffic detected without corresponding DNS query: 59.105.172.231
Source: unknown	TCP traffic detected without corresponding DNS query: 75.48.15.22
Source: unknown	TCP traffic detected without corresponding DNS query: 176.179.133.176
Source: unknown	TCP traffic detected without corresponding DNS query: 196.112.209.153
Source: unknown	TCP traffic detected without corresponding DNS query: 79.97.174.23
Source: unknown	TCP traffic detected without corresponding DNS query: 57.130.235.111
Source: unknown	TCP traffic detected without corresponding DNS query: 13.213.120.61
Source: unknown	TCP traffic detected without corresponding DNS query: 184.185.11.5
Source: unknown	TCP traffic detected without corresponding DNS query: 190.123.66.137
Source: unknown	TCP traffic detected without corresponding DNS query: 111.61.217.245
Source: unknown	TCP traffic detected without corresponding DNS query: 73.245.188.43
Source: unknown	TCP traffic detected without corresponding DNS query: 180.114.17.59
Source: unknown	TCP traffic detected without corresponding DNS query: 82.20.116.141
Source: unknown	TCP traffic detected without corresponding DNS query: 69.29.86.68
Source: unknown	TCP traffic detected without corresponding DNS query: 175.14.215.95
Source: unknown	TCP traffic detected without corresponding DNS query: 120.6.148.99
Source: unknown	TCP traffic detected without corresponding DNS query: 58.223.124.148
Source: unknown	TCP traffic detected without corresponding DNS query: 54.136.141.217
Source: unknown	TCP traffic detected without corresponding DNS query: 174.196.205.61
Source: unknown	TCP traffic detected without corresponding DNS query: 82.153.89.97
Source: unknown	TCP traffic detected without corresponding DNS query: 179.32.188.29
Source: unknown	TCP traffic detected without corresponding DNS query: 150.163.90.148
Source: unknown	TCP traffic detected without corresponding DNS query: 217.199.103.45
Source: unknown	TCP traffic detected without corresponding DNS query: 161.63.95.205
Source: unknown	TCP traffic detected without corresponding DNS query: 177.224.207.249

Source: zD1jpTbFQq, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5251.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5248.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5258.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5258.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5247.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5248.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5251.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5247.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5257.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5257.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5252.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5245.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5245.1.00000000675bcb72.00000000cfa8fb02.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5252.1.00000000d3035e25.00000000c57598df.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: Process Memory Space: zD1jpTbFQq PID: 5245, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 491, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 2062, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 2637, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 5248, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 5252, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 5257, result: successful
Source: /tmp/zD1jpTbFQq (PID: 5258)	SIGKILL sent: pid: 5258, result: unknown

Source: classification engine

Classification label: mal60.troj.lin@0/4@0/0

Source: zD1jpTbFQq

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: /lib/systemd/systemd-journald (PID: 5280)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2033/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2033/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1582/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1582/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2275/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2275/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1612/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1612/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1579/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1579/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1699/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1699/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1335/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1335/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1698/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1698/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2028/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2028/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1334/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1334/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1576/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1576/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2302/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2302/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/3236/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/3236/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2025/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2025/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2146/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2146/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/912/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/912/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/759/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/759/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2307/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2307/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/918/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/918/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1594/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1594/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2285/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2285/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2281/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2281/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1349/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1349/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1623/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1623/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/761/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/761/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1622/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1622/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/884/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/884/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1983/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1983/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2038/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2038/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1586/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1586/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1465/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1465/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1344/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1344/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1860/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1860/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1463/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1463/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2156/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2156/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/800/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/800/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/801/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/801/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1629/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1629/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1627/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1627/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1900/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1900/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/491/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/491/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2294/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2294/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2050/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/2050/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1877/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1877/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/772/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/772/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1633/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1633/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1599/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1599/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1632/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1632/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1477/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1477/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/774/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/774/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1476/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1476/numa_maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1872/maps
Source: /tmp/zD1jpTbFQq (PID: 5258)	File opened: /proc/1872/numa_maps

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42810
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42814
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42828
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42844
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42858
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42872
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42886
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42922
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42938
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42954
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42962
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42970
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42980
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42988
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42996
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43008
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43018
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43032
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43042
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43048
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43056
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43062
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43066
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43072

Source: /tmp/zD1jpTbFQq (PID: 5245)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5280)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5294)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5296)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5302)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5308)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5314)	Queries kernel information via 'uname':

Source: zD1jpTbFQq, 5245.1.00000000bd7700cf.00000000651ef148.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: zD1jpTbFQq, 5247.1.00000000bd7700cf.00000000651ef148.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: zD1jpTbFQq, 5245.1.00000000bd7700cf.00000000651ef148.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: zD1jpTbFQq, 5245.1.00000000f8a03f89.000000008d251a34.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: zD1jpTbFQq, 5245.1.00000000f8a03f89.000000008d251a34.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/zD1jpTbFQqSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zD1jpTbFQq

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping1	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	System Information Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zD1jpTbFQq	59%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
8.141.217.212	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
66.217.147.40	unknown	United States	7029	WINDSTREAMUS	false
83.220.183.211	unknown	Russian Federation	34456	RIALCOM-ASRU	false
110.76.149.26	unknown	Indonesia	38506	PIKANET-AS-IDPTPikaMediaKomunikaID	false
81.90.6.124	unknown	Russian Federation	12739	NETLINE_ASRU	false
111.122.94.155	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
92.53.31.140	unknown	Macedonia	43612	BLIZOOMK	false
191.12.225.240	unknown	Brazil	26599	TELEFONICABRASILSABR	false
152.41.163.251	unknown	United States	22854	CATAWBA-COLLEGEUS	false
2.222.21.147	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
9.63.59.31	unknown	United States	3356	LEVEL3US	false
138.9.239.14	unknown	United States	18663	UOP-ASUS	false
93.72.89.226	unknown	Ukraine	25229	VOLIA-ASUA	false
108.230.125.248	unknown	United States	7018	ATT-INTERNET4US	false
53.112.177.79	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
116.185.245.133	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
146.249.105.69	unknown	France	12765	TOTAL-CONNECTFR	false
207.111.164.255	unknown	United States	7314	TIS-ASNUS	false
182.49.33.62	unknown	China	9371	SAKURA-CSAKURAInternetIncJP	false
96.205.253.20	unknown	United States	7922	COMCAST-7922US	false
79.82.199.182	unknown	France	15557	LDCOMNETFR	false
149.123.58.227	unknown	United States	174	COGENT-174US	false
133.71.76.162	unknown	Japan	131897	EHIME-UNationalUniversityCorporationEhimeUniversityJ	false
116.123.188.38	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
64.11.109.131	unknown	United States	701	UUNETUS	false
108.90.177.118	unknown	United States	7018	ATT-INTERNET4US	false
182.37.86.132	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
172.209.54.248	unknown	United States	18747	IFX18747US	false
204.66.152.22	unknown	United States	1761	TDIR-CAPNETUS	false
208.61.202.33	unknown	United States	7018	ATT-INTERNET4US	false
117.241.195.11	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
124.97.60.6	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
175.160.7.20	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
169.216.205.14	unknown	Korea Republic of	37611	AfrihostZA	false
117.235.136.149	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
150.216.250.169	unknown	United States	10952	ECU-ASUS	false
168.63.110.245	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.213.127.160	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
140.224.26.182	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
8.195.218.66	unknown	United States	3356	LEVEL3US	false
148.78.186.253	unknown	United States	16811	SAGENET-GTHUS	false
67.214.45.86	unknown	United States	40336	UNISKY-MIAUS	false
198.20.174.5	unknown	Canada	55286	SERVER-MANIACA	false
112.47.206.166	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
181.54.154.55	unknown	Colombia	10620	TelmexColombiaSACO	false
113.185.159.73	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
189.83.123.80	unknown	Brazil	7738	TelemarNorteLesteSABR	false
42.168.40.11	unknown	China	4249	LILLY-ASUS	false
96.235.195.59	unknown	United States	701	UUNETUS	false
75.93.164.89	unknown	United States	7029	WINDSTREAMUS	false
222.107.228.174	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
91.156.144.52	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
88.189.112.244	unknown	France	12322	PROXADFR	false
122.141.120.145	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
122.126.239.230	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
31.9.165.6	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
80.42.168.221	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
165.77.0.253	unknown	United States	4725	ODNSoftBankMobileCorpJP	false
17.35.71.6	unknown	United States	714	APPLE-ENGINEERINGUS	false
205.244.82.224	unknown	United States	3364	CSDCO-ASUS	false
109.56.179.18	unknown	Sweden	44034	HI3GSE	false
178.201.249.3	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
13.8.0.90	unknown	United States	26662	XEROX-WVUS	false
203.51.156.22	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
204.120.171.63	unknown	United States	1239	SPRINTLINKUS	false
207.26.25.171	unknown	United States	701	UUNETUS	false
157.114.152.220	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
169.44.187.157	unknown	United States	36351	SOFTLAYERUS	false
9.146.149.27	unknown	United States	3356	LEVEL3US	false
181.80.17.58	unknown	Argentina	7303	TelecomArgentinaSAAR	false
79.67.235.84	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
83.31.103.192	unknown	Poland	5617	TPNETPL	false
155.199.164.196	unknown	United States	786	JANETJiscServicesLimitedGB	false
86.17.103.193	unknown	United Kingdom	5089	NTLGB	false
101.32.36.49	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
204.244.141.52	unknown	Canada	5071	WESTEL-1CA	false
83.235.207.5	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
159.156.105.82	unknown	Switzerland	34578	BEDAGCH	false
141.230.254.0	unknown	United States	12701	BARCAPLondonGB	false
73.255.137.215	unknown	United States	7922	COMCAST-7922US	false
164.69.149.27	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
79.245.37.67	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
182.28.200.243	unknown	Indonesia	4795	INDOSATM2-IDINDOSATM2ASNID	false
39.97.83.169	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
101.150.83.142	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
2.35.34.170	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
98.139.130.39	unknown	United States	26101	YAHOO-3US	false
39.31.92.119	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
60.174.151.99	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
175.142.100.244	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
190.105.172.168	unknown	Haiti	52297	HAICOMHaitiCommunicationsSAHT	false
203.124.232.238	unknown	India	9238	TATA-ASTATAISPIN	false
136.39.108.37	unknown	United States	16591	GOOGLE-FIBERUS	false
164.141.19.164	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
141.220.243.240	unknown	United States	394769	UMF-7-ASUS	false
86.152.155.233	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
92.93.73.81	unknown	France	15557	LDCOMNETFR	false
109.54.4.240	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
152.136.47.106	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
156.194.156.6	unknown	Egypt	8452	TE-ASTE-ASEG	false

Runtime Messages

Command:	/tmp/zD1jpTbFQq
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	xXxSlicexXxxVEGA.
Standard Error:

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	NMhjdmrpZi	Get hash	malicious	Browse	139.244.36.194
	arm7	Get hash	malicious	Browse	139.245.51.216
	x86-20211110-0150	Get hash	malicious	Browse	121.198.26.158
	sora.x86	Get hash	malicious	Browse	8.168.189.30
	KKveTTgaAAsecNNaaaa.arm7	Get hash	malicious	Browse	47.99.128.220
	arm	Get hash	malicious	Browse	47.99.216.211
	Heri2RE17I	Get hash	malicious	Browse	47.105.100.82
	vbc.exe	Get hash	malicious	Browse	101.132.116.91
	mips	Get hash	malicious	Browse	39.106.158.24
	hsnAV1agq8.exe	Get hash	malicious	Browse	121.89.207.1
	yfOb3wBmub.exe	Get hash	malicious	Browse	121.89.207.1
	qgxgn5fQU1	Get hash	malicious	Browse	59.110.169.4
	BS0Dxmu2go	Get hash	malicious	Browse	8.157.73.157
	GB0O1NUtmJ	Get hash	malicious	Browse	47.113.198.162
	dYgJ72oG4f	Get hash	malicious	Browse	47.105.136.170
	O4aHLhCviL	Get hash	malicious	Browse	47.114.175.36
	RrK5IgZ6gZ	Get hash	malicious	Browse	8.139.27.141
	jyTZMJKPD2	Get hash	malicious	Browse	47.96.183.126
	SQFoFeC1jQ	Get hash	malicious	Browse	139.247.66.94
	byxEpar5Zm	Get hash	malicious	Browse	8.175.9.72
WINDSTREAMUS	fNrSUTMJ8O	Get hash	malicious	Browse	74.8.108.56
	arm7	Get hash	malicious	Browse	63.255.73.32
	x86-20211110-0150	Get hash	malicious	Browse	72.242.215.100
	sora.x86	Get hash	malicious	Browse	173.184.64.70
	sora.arm7	Get hash	malicious	Browse	75.92.93.242
	sora.arm	Get hash	malicious	Browse	98.16.221.213
	fZ9Y8XVXDH	Get hash	malicious	Browse	68.143.234.231
	KKveTTgaAAsecNNaaaa.arm	Get hash	malicious	Browse	166.102.36.218
	QSjpGBd7Gv	Get hash	malicious	Browse	205.187.136.105
	x86_64	Get hash	malicious	Browse	74.9.152.70
	arm	Get hash	malicious	Browse	98.17.135.18
	arm6	Get hash	malicious	Browse	173.184.230.178
	4DrtSJOLjr	Get hash	malicious	Browse	40.134.73.47
	Kz2SeJpaxw	Get hash	malicious	Browse	74.8.121.17
	fMGehkjmPv	Get hash	malicious	Browse	209.253.40.34
	RrK5IgZ6gZ	Get hash	malicious	Browse	165.247.11.247
	OoeA4dABtV	Get hash	malicious	Browse	207.223.236.218
	YG9KkTTAgE	Get hash	malicious	Browse	69.95.185.164
	kkr4DrMz5L	Get hash	malicious	Browse	66.184.133.224
	fCca2FJVXG	Get hash	malicious	Browse	216.73.137.189

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/journal/streams/.#9:74252mAQxYs Download File
Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.511422543934028
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5SVjhWGYnS1c+sjsv:SbFuFyLVIg1BG+f+M0FhBQSiTji4s
MD5:	7B73F82546FE8A5EDCC9143DFD3D9623
SHA1:	99F973F289FE56E370C1AB2CB51035C0EDCCC9B9
SHA-256:	9F76085AEE2C9244A13B4C38F719358084169367A993970B2D0E12E89F1BED79
SHA-512:	D14BF70B3D0D09CD24F152BFC33A5FEC396D86AB0CBFA397AB32281C057B6CC3A068CFC8B8EC73CFC3AEB547AB968D49E6BE6734A42E3F0382F7977ECF20599E
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3be6002e7fd64011ac6b184d7bd2f262.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:742562yIbVs Download File
Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.529631514219359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmph4FVHhB1EvAglsjq:SbFuFyLVIg1BG+f+M4FxFEYTji4s
MD5:	D0304411F03172DC7BA1ABD4BBEBB26A
SHA1:	73E6F823ECEA5598A2A70DE05DDACF2C4A261D1E
SHA-256:	2203E7DAA0296132BF000098FAFD3E54A2457E22FF17CFDF53F59569C1BE7212
SHA-512:	AF63A99CF14F446F8469197319418BCCBEC8B9CA36BEF21FF5BB37C8B22BD4E971823CB64D5F1623B1EA90D2ABB6FCCE0074E2756557715D2245A59BC8B87B68
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c50063e8c75c4227a1bfba9c431fd9aa.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal Download File
Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlbMg7fl9Mg7F:F3Vflv
MD5:	C88D104844C9FA10D75CAF83B9078AEC
SHA1:	920D12F6638F08118DB5515FAF9F0EFEACFBD4F3
SHA-256:	FD2E34DE60BD081DF453CD95C7F4808AFC65A1B4AB121531295814495B3B11D9
SHA-512:	D41405C6B2CEAD157B5DE96CE60C3136AB3D3CEA7B716E51AA115FA3ED7790A4174A2D2CB9F028992E00573D6384E9DF0022AA3F10A4915B7B74C5ECE596296B
Malicious:	false
Reputation:	low
Preview:	LPKSHHRH.................=-%.CK....".y.b.................................=-%.CK....".y.b........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal Download File
Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlvXKufXK6lt:F3fdLX
MD5:	9D0990C6C6734BFC3EBBA0B56A3D86B6
SHA1:	4E82380513A3E807E04C73EB2AA4C0314B70FDD0
SHA-256:	180F3932C2F975835DFB4B7BC25F1C6617CA0D4692706BC556E601C1054475E9
SHA-512:	52B6A383CA0F115D25162DECCC200C354E4AE54B42AB0131596D284EB883F4446A0922139FAEAC588AD61F1D8FE0B79B1BBBF81E44F726416C3A08223FF5481D
Malicious:	false
Reputation:	low
Preview:	LPKSHHRH................5.2..]AM.v.%\. .................................5.2..]AM.v.%\. .........................................................................................................................................................

Static File Info

General
File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.361116795039536
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	zD1jpTbFQq
File size:	93144
MD5:	e06f0a88a25db599d47dadb03907ef00
SHA1:	ee8da3d3dffde40ef93700991aa5d472d760fda5
SHA256:	f3f57dc399b0dc7bbe3a019afb7d7402c40274deea75b2cc605ff13e94229c71
SHA512:	49d3b63ad117a26995b8eb12c2c742ab396499b1f388e55e67da7c42ab2de79ea54321743640b09d270d8167c66a26db26ba180a7f067987b13e6279a0b4b280
SSDEEP:	1536:U6PIx2j6HUvZjqEQTq3F+cCRIP3n6wFObVnI98MKsd+:ZP6yZKqV536DnIyMr+
File Content Preview:	.ELF...........................4..i......4. ...(......................f...f...............f...f...f.......(X........dt.Q.............................!..\|......$H...H.G!...$8!. \|...N.. .!..\|.......?.........jP..../...@..\?.....f$.+../...A..$8...})....f$N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	92664
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x14778	0x0	0x6	AX	4
.fini	PROGBITS	0x10014830	0x14830	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x10014850	0x14850	0x1db8	0x0	0x2	A	8
.ctors	PROGBITS	0x1002660c	0x1660c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x10026614	0x16614	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x10026620	0x16620	0x31c	0x0	0x3	WA	8
.sdata	PROGBITS	0x1002693c	0x1693c	0x70	0x0	0x3	WA	4
.sbss	NOBITS	0x100269ac	0x169ac	0xa4	0x0	0x3	WA	4
.bss	NOBITS	0x10026a50	0x169ac	0x2414	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x169ac	0x4b	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x16608	0x16608	4.3134	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1660c	0x1002660c	0x1002660c	0x3a0	0x2858	1.8826	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2021 04:53:03.041838884 CET	42836	443	192.168.2.23	91.189.91.43
Nov 10, 2021 04:53:03.809766054 CET	42516	80	192.168.2.23	109.202.202.202
Nov 10, 2021 04:53:05.646505117 CET	23	59852	42.176.196.90	192.168.2.23
Nov 10, 2021 04:53:05.646600008 CET	59852	23	192.168.2.23	42.176.196.90
Nov 10, 2021 04:53:06.183032990 CET	49932	60420	192.168.2.23	107.174.241.209
Nov 10, 2021 04:53:06.194025993 CET	53991	2323	192.168.2.23	140.204.138.56
Nov 10, 2021 04:53:06.194108963 CET	53991	23	192.168.2.23	179.201.126.161
Nov 10, 2021 04:53:06.194134951 CET	53991	23	192.168.2.23	217.72.134.141
Nov 10, 2021 04:53:06.194144964 CET	53991	23	192.168.2.23	201.16.161.191
Nov 10, 2021 04:53:06.194186926 CET	53991	23	192.168.2.23	8.142.241.84
Nov 10, 2021 04:53:06.194189072 CET	53991	23	192.168.2.23	80.4.232.71
Nov 10, 2021 04:53:06.194224119 CET	53991	23	192.168.2.23	20.124.77.109
Nov 10, 2021 04:53:06.194257975 CET	53991	23	192.168.2.23	117.18.185.97
Nov 10, 2021 04:53:06.194266081 CET	53991	23	192.168.2.23	84.26.231.127
Nov 10, 2021 04:53:06.194274902 CET	53991	23	192.168.2.23	124.12.9.90
Nov 10, 2021 04:53:06.194283009 CET	53991	2323	192.168.2.23	179.124.194.239
Nov 10, 2021 04:53:06.194289923 CET	53991	23	192.168.2.23	85.30.212.209
Nov 10, 2021 04:53:06.194292068 CET	53991	23	192.168.2.23	117.14.254.123
Nov 10, 2021 04:53:06.194295883 CET	53991	23	192.168.2.23	88.248.212.7
Nov 10, 2021 04:53:06.194308996 CET	53991	23	192.168.2.23	121.35.185.167
Nov 10, 2021 04:53:06.194312096 CET	53991	23	192.168.2.23	18.190.45.139
Nov 10, 2021 04:53:06.194322109 CET	53991	23	192.168.2.23	113.14.148.22
Nov 10, 2021 04:53:06.194354057 CET	53991	23	192.168.2.23	161.249.147.26
Nov 10, 2021 04:53:06.194377899 CET	53991	23	192.168.2.23	184.47.171.85
Nov 10, 2021 04:53:06.194411039 CET	53991	23	192.168.2.23	139.197.172.95
Nov 10, 2021 04:53:06.194423914 CET	53991	2323	192.168.2.23	124.112.15.58
Nov 10, 2021 04:53:06.194426060 CET	53991	23	192.168.2.23	59.105.172.231
Nov 10, 2021 04:53:06.194443941 CET	53991	23	192.168.2.23	75.48.15.22
Nov 10, 2021 04:53:06.194470882 CET	53991	23	192.168.2.23	176.179.133.176
Nov 10, 2021 04:53:06.194478035 CET	53991	23	192.168.2.23	196.112.209.153
Nov 10, 2021 04:53:06.194503069 CET	53991	23	192.168.2.23	79.97.174.23
Nov 10, 2021 04:53:06.194519043 CET	53991	23	192.168.2.23	194.110.251.210
Nov 10, 2021 04:53:06.194539070 CET	53991	23	192.168.2.23	57.130.235.111
Nov 10, 2021 04:53:06.194561958 CET	53991	23	192.168.2.23	13.213.120.61
Nov 10, 2021 04:53:06.194583893 CET	53991	2323	192.168.2.23	184.185.11.5
Nov 10, 2021 04:53:06.194583893 CET	53991	23	192.168.2.23	190.123.66.137
Nov 10, 2021 04:53:06.194591999 CET	53991	23	192.168.2.23	111.61.217.245
Nov 10, 2021 04:53:06.194597960 CET	53991	23	192.168.2.23	73.245.188.43
Nov 10, 2021 04:53:06.194601059 CET	53991	23	192.168.2.23	180.114.17.59
Nov 10, 2021 04:53:06.194629908 CET	53991	23	192.168.2.23	82.20.116.141
Nov 10, 2021 04:53:06.194631100 CET	53991	23	192.168.2.23	69.29.86.68
Nov 10, 2021 04:53:06.194652081 CET	53991	23	192.168.2.23	175.14.215.95
Nov 10, 2021 04:53:06.194669008 CET	53991	23	192.168.2.23	120.6.148.99
Nov 10, 2021 04:53:06.194693089 CET	53991	23	192.168.2.23	58.223.124.148
Nov 10, 2021 04:53:06.194732904 CET	53991	23	192.168.2.23	54.136.141.217
Nov 10, 2021 04:53:06.194736958 CET	53991	2323	192.168.2.23	174.196.205.61
Nov 10, 2021 04:53:06.194750071 CET	53991	23	192.168.2.23	82.153.89.97
Nov 10, 2021 04:53:06.194757938 CET	53991	23	192.168.2.23	179.32.188.29
Nov 10, 2021 04:53:06.194866896 CET	53991	23	192.168.2.23	150.163.90.148
Nov 10, 2021 04:53:06.194875002 CET	53991	23	192.168.2.23	110.137.203.103
Nov 10, 2021 04:53:06.194879055 CET	53991	23	192.168.2.23	217.199.103.45
Nov 10, 2021 04:53:06.194880962 CET	53991	23	192.168.2.23	161.63.95.205
Nov 10, 2021 04:53:06.194889069 CET	53991	23	192.168.2.23	177.224.207.249
Nov 10, 2021 04:53:06.194899082 CET	53991	23	192.168.2.23	40.169.4.2
Nov 10, 2021 04:53:06.194916964 CET	53991	23	192.168.2.23	182.58.115.130
Nov 10, 2021 04:53:06.194916964 CET	53991	2323	192.168.2.23	71.3.40.67
Nov 10, 2021 04:53:06.194922924 CET	53991	23	192.168.2.23	175.247.21.160
Nov 10, 2021 04:53:06.194932938 CET	53991	23	192.168.2.23	120.24.125.47
Nov 10, 2021 04:53:06.194943905 CET	53991	23	192.168.2.23	125.216.133.224
Nov 10, 2021 04:53:06.194971085 CET	53991	23	192.168.2.23	209.44.117.83
Nov 10, 2021 04:53:06.195039034 CET	53991	23	192.168.2.23	207.207.158.95
Nov 10, 2021 04:53:06.195059061 CET	53991	23	192.168.2.23	150.201.3.108
Nov 10, 2021 04:53:06.195060015 CET	53991	23	192.168.2.23	48.147.180.210
Nov 10, 2021 04:53:06.195076942 CET	53991	23	192.168.2.23	206.217.136.73
Nov 10, 2021 04:53:06.195137978 CET	53991	23	192.168.2.23	192.249.69.254
Nov 10, 2021 04:53:06.195137978 CET	53991	2323	192.168.2.23	124.189.180.29
Nov 10, 2021 04:53:06.195173025 CET	53991	23	192.168.2.23	169.191.57.178
Nov 10, 2021 04:53:06.195214987 CET	53991	23	192.168.2.23	172.173.89.242
Nov 10, 2021 04:53:06.195223093 CET	53991	23	192.168.2.23	141.220.243.240
Nov 10, 2021 04:53:06.195234060 CET	53991	23	192.168.2.23	166.204.207.112
Nov 10, 2021 04:53:06.195250034 CET	53991	23	192.168.2.23	133.225.199.214
Nov 10, 2021 04:53:06.195267916 CET	53991	23	192.168.2.23	142.83.113.252
Nov 10, 2021 04:53:06.195297956 CET	53991	23	192.168.2.23	106.63.210.205
Nov 10, 2021 04:53:06.195333004 CET	53991	23	192.168.2.23	153.43.74.79
Nov 10, 2021 04:53:06.195405006 CET	53991	23	192.168.2.23	5.51.230.42
Nov 10, 2021 04:53:06.195417881 CET	53991	23	192.168.2.23	204.177.248.217
Nov 10, 2021 04:53:06.195432901 CET	53991	23	192.168.2.23	126.253.113.125
Nov 10, 2021 04:53:06.195434093 CET	53991	2323	192.168.2.23	17.244.131.213
Nov 10, 2021 04:53:06.195445061 CET	53991	23	192.168.2.23	59.250.145.150
Nov 10, 2021 04:53:06.195462942 CET	53991	23	192.168.2.23	5.37.122.19
Nov 10, 2021 04:53:06.195467949 CET	53991	23	192.168.2.23	93.231.169.7
Nov 10, 2021 04:53:06.195471048 CET	53991	23	192.168.2.23	141.216.45.177
Nov 10, 2021 04:53:06.195507050 CET	53991	23	192.168.2.23	37.200.154.213
Nov 10, 2021 04:53:06.195513010 CET	53991	23	192.168.2.23	179.91.119.149
Nov 10, 2021 04:53:06.195518017 CET	53991	23	192.168.2.23	62.150.26.67
Nov 10, 2021 04:53:06.195523024 CET	53991	2323	192.168.2.23	201.239.18.43
Nov 10, 2021 04:53:06.195523977 CET	53991	23	192.168.2.23	101.134.249.22
Nov 10, 2021 04:53:06.195542097 CET	53991	23	192.168.2.23	174.211.112.103
Nov 10, 2021 04:53:06.195552111 CET	53991	23	192.168.2.23	2.104.107.93
Nov 10, 2021 04:53:06.195557117 CET	53991	23	192.168.2.23	27.191.123.34
Nov 10, 2021 04:53:06.195559025 CET	53991	23	192.168.2.23	207.230.156.57
Nov 10, 2021 04:53:06.195643902 CET	53991	23	192.168.2.23	147.81.147.123
Nov 10, 2021 04:53:06.195761919 CET	53991	23	192.168.2.23	158.22.27.9
Nov 10, 2021 04:53:06.195765972 CET	53991	23	192.168.2.23	4.108.179.77
Nov 10, 2021 04:53:06.195810080 CET	53991	23	192.168.2.23	163.93.24.74
Nov 10, 2021 04:53:06.195825100 CET	53991	23	192.168.2.23	223.88.230.117
Nov 10, 2021 04:53:06.195828915 CET	53991	2323	192.168.2.23	79.25.107.86
Nov 10, 2021 04:53:06.195839882 CET	53991	23	192.168.2.23	170.154.1.234
Nov 10, 2021 04:53:06.195849895 CET	53991	23	192.168.2.23	190.193.94.154
Nov 10, 2021 04:53:06.195883036 CET	53991	23	192.168.2.23	208.22.236.225

System Behavior

Analysis Process: zD1jpTbFQq PID: 5245 Parent PID: 5119

General

Start time:	04:53:00
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	/tmp/zD1jpTbFQq
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5247 Parent PID: 5245

General

Start time:	04:53:01
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5248 Parent PID: 5245

General

Start time:	04:53:01
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5251 Parent PID: 5248

General

Start time:	04:53:01
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5252 Parent PID: 5248

General

Start time:	04:53:01
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5257 Parent PID: 5248

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5258 Parent PID: 5248

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5261 Parent PID: 5248

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5266 Parent PID: 5261

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: zD1jpTbFQq PID: 5262 Parent PID: 5248

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/tmp/zD1jpTbFQq
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: systemd PID: 5268 Parent PID: 1

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: journalctl PID: 5268 Parent PID: 1

General

Start time:	04:53:05
Start date:	10/11/2021
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --smart-relinquish-var
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Analysis Process: systemd PID: 5280 Parent PID: 1

General

Start time:	04:53:06
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-journald PID: 5280 Parent PID: 1

General

Start time:	04:53:06
Start date:	10/11/2021
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Analysis Process: xfce4-session PID: 5283 Parent PID: 1900

General

Start time:	04:53:07
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5283 Parent PID: 1900

General

Start time:	04:53:07
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5294 Parent PID: 5283

General

Start time:	04:53:09
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5295 Parent PID: 1900

General

Start time:	04:53:09
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5295 Parent PID: 1900

General

Start time:	04:53:10
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5296 Parent PID: 5295

General

Start time:	04:53:11
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5297 Parent PID: 1900

General

Start time:	04:53:11
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5297 Parent PID: 1900

General

Start time:	04:53:11
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5302 Parent PID: 5297

General

Start time:	04:53:13
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5303 Parent PID: 1900

General

Start time:	04:53:13
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5303 Parent PID: 1900

General

Start time:	04:53:14
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5308 Parent PID: 5303

General

Start time:	04:53:15
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5309 Parent PID: 1900

General

Start time:	04:53:15
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5309 Parent PID: 1900

General

Start time:	04:53:16
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5314 Parent PID: 5309

General

Start time:	04:53:18
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: systemd PID: 5317 Parent PID: 1

General

Start time:	04:53:19
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: journalctl PID: 5317 Parent PID: 1

General

Start time:	04:53:19
Start date:	10/11/2021
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --flush
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report zD1jpTbFQq

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: zD1jpTbFQq PID: 5245 Parent PID: 5119

General

Analysis Process: zD1jpTbFQq PID: 5247 Parent PID: 5245

General

Analysis Process: zD1jpTbFQq PID: 5248 Parent PID: 5245

General

Analysis Process: zD1jpTbFQq PID: 5251 Parent PID: 5248

General

Analysis Process: zD1jpTbFQq PID: 5252 Parent PID: 5248

General

Analysis Process: zD1jpTbFQq PID: 5257 Parent PID: 5248

General

Analysis Process: zD1jpTbFQq PID: 5258 Parent PID: 5248

General

Analysis Process: zD1jpTbFQq PID: 5261 Parent PID: 5248

General

Analysis Process: zD1jpTbFQq PID: 5266 Parent PID: 5261

General

Analysis Process: zD1jpTbFQq PID: 5262 Parent PID: 5248

General

Analysis Process: systemd PID: 5268 Parent PID: 1

General

Analysis Process: journalctl PID: 5268 Parent PID: 1

General