Linux Analysis Report
skid.x86.elf

Overview

General Information

Sample Name: skid.x86.elf
Analysis ID: 841196
MD5: e07f693f129c6bda51877372d702fe49
SHA1: 7f791055245e5daa8478165833c60ef418ce161f
SHA256: ae7aea3669fcb982eee123431fa4f77193394b1b9be1eb9aa964e30e98604f95
Tags: elfmirai
Infos:

Detection

Moobot
Score: 84
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Moobot
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Machine Learning detection for sample
Sets full permissions to files and/or directories
Yara signature match
Sample has stripped symbol table
Executes the "mkdir" command used to create folders
Sample tries to set the executable flag
Executes the "chmod" command used to modify permissions
Executes commands using a shell command-line interpreter
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: skid.x86.elf ReversingLabs: Detection: 62%
Source: skid.x86.elf Virustotal: Detection: 64% Perma Link
Machine Learning detection for sample
Source: skid.x86.elf Joe Sandbox ML: detected

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37162 -> 195.58.39.189:6996
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 195.58.39.189:6996 -> 192.168.2.23:37162
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55644
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55648
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55658
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55664
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55668
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55670
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 97.15.148.203:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 209.222.89.206:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.136.91.240:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 113.105.64.202:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 200.164.235.191:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 85.176.49.101:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 64.27.186.217:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 135.190.45.80:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 180.46.137.87:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 93.73.248.194:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 210.8.13.112:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 111.169.135.24:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 61.184.10.103:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 12.142.93.32:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 210.134.253.191:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 171.64.230.155:2323
Source: global traffic TCP traffic: 192.168.2.23:37162 -> 195.58.39.189:6996
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 185.4.36.102:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 151.62.151.44:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 25.210.213.82:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 157.148.33.165:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 176.157.124.46:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 51.151.62.148:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 151.241.95.144:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 203.112.5.116:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 44.132.158.210:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 181.172.250.162:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.240.177.147:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 40.69.203.146:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 159.187.253.206:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 191.172.227.113:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 89.72.13.152:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 94.137.12.22:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 176.149.26.227:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 189.65.31.82:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.61.23.249:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 12.238.9.144:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 105.184.251.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 102.196.241.35:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 9.29.8.248:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 23.217.127.136:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 40.3.240.107:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 37.242.145.81:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 188.223.240.135:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 88.241.175.175:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 175.134.147.184:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 12.104.227.143:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 49.237.32.142:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 152.158.205.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 131.169.87.91:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 149.214.134.156:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 150.118.163.15:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 122.82.66.142:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.114.23.46:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 105.225.213.89:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.246.37.67:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 139.227.13.227:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 114.190.99.213:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 23.203.232.120:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.59.95.0:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 141.30.182.220:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 181.9.254.60:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 108.198.189.161:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 92.215.207.145:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 116.137.97.71:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 167.155.119.190:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.194.43.227:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 59.202.16.200:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 198.160.68.81:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 159.21.43.195:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 186.106.19.162:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 194.14.134.113:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 75.118.115.207:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 100.185.244.23:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 52.248.197.21:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 196.45.21.103:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.167.102.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 141.163.117.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 115.157.183.222:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 206.135.38.195:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 117.129.248.8:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 113.40.195.82:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 119.129.28.74:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 174.177.16.107:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 31.119.147.58:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 24.169.71.202:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 88.112.239.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.226.177.187:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 35.104.42.123:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 46.180.15.47:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 167.230.141.248:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.219.100.245:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 38.138.16.132:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 184.4.155.229:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 43.185.96.124:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 89.13.158.138:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 18.64.147.250:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 174.126.151.44:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 156.30.204.133:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 31.29.15.224:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 81.77.203.176:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 222.48.139.213:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 126.198.107.218:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 173.224.132.129:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 135.172.143.60:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 196.211.112.128:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 206.237.235.37:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 125.11.69.216:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 80.206.112.156:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 133.16.186.59:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.166.116.92:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 112.77.1.28:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 171.164.58.159:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 206.155.169.186:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 91.184.109.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 1.230.123.71:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 191.74.39.254:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.85.59.160:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 80.199.180.196:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.8.100.159:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 32.234.228.141:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.143.73.239:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 184.181.224.83:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 165.112.75.75:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 25.114.169.195:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 2.207.30.207:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 109.180.223.241:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 98.74.25.8:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 117.51.235.232:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 81.188.98.142:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 125.103.114.230:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 152.91.82.150:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 142.150.229.14:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 93.125.168.7:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 63.92.63.250:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 141.215.212.215:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 163.28.234.119:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 193.109.156.56:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 116.119.173.140:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 65.39.45.177:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 103.214.11.107:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 24.221.92.53:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 13.168.48.106:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 52.36.179.12:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 100.225.232.75:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 69.17.90.31:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 63.6.194.166:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 64.66.196.114:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 221.203.202.141:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 189.11.110.144:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 2.85.38.155:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 35.224.1.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 124.66.32.123:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 34.242.233.127:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 174.6.67.43:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 201.14.120.205:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 58.24.40.159:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 113.250.97.211:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 4.248.121.33:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 174.213.151.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 13.132.153.156:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 18.204.104.146:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 163.76.37.14:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 42.29.132.78:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 120.198.78.164:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 115.200.36.41:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 136.82.173.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 19.163.58.220:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 131.231.147.36:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 135.50.172.62:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 223.215.146.77:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 204.116.250.158:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 137.166.87.70:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 142.20.215.231:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 137.85.168.220:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 181.152.25.166:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 143.209.27.225:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 61.107.187.55:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 80.7.188.53:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 79.27.52.76:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 5.175.204.223:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 218.14.110.19:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 183.141.32.216:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 14.210.113.103:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 65.246.53.235:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 213.145.238.10:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 102.227.233.9:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 8.84.124.141:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 221.26.158.112:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 201.41.231.118:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.180.54.52:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 90.54.2.224:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 19.138.222.179:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.88.171.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 38.189.111.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 90.160.137.89:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 100.43.2.220:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 117.55.29.199:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 100.249.222.230:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 132.153.206.75:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 200.241.237.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.214.15.97:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 186.59.0.23:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 4.55.192.102:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 91.59.21.71:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 43.125.142.173:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 17.183.160.135:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.7.24.198:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 32.73.219.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 42.37.254.27:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 196.254.114.156:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 109.224.97.133:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 51.149.136.33:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 80.243.251.101:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 133.181.143.18:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 180.89.129.251:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.193.85.114:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 107.183.220.12:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 97.253.190.45:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 86.230.193.48:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 201.136.250.105:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 4.87.164.170:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 42.164.121.232:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 203.203.71.240:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 207.16.26.132:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 60.37.176.11:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 105.51.230.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 94.90.95.185:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 116.15.149.167:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 180.116.190.229:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 147.110.235.111:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 162.148.166.43:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 123.32.222.26:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 73.73.134.232:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 203.97.83.254:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 39.91.208.240:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 61.19.251.113:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.165.43.25:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 117.227.6.231:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 216.3.199.10:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 91.135.56.105:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 203.184.207.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 130.101.20.55:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 66.2.118.100:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 77.194.179.19:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 187.97.70.99:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 97.215.106.187:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.156.181.124:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 202.43.234.70:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 57.144.234.22:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 201.215.233.235:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 193.149.8.223:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 98.196.145.141:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 133.8.97.236:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 49.241.4.24:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 9.176.105.254:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.238.11.118:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 23.39.34.59:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 206.163.38.224:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 150.204.71.220:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 53.26.142.47:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 182.7.29.252:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 125.221.255.181:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 128.205.169.248:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 5.231.33.23:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 222.51.76.67:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 113.66.120.87:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 207.201.115.218:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 126.254.21.174:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 8.171.135.245:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 194.115.136.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.56.24.165:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 151.233.215.214:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 42.136.98.13:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 34.111.75.18:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 210.227.145.12:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 140.81.7.232:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 149.224.205.172:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.240.79.186:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 163.83.174.90:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 155.64.211.201:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 71.213.21.31:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 83.115.52.74:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 108.40.185.136:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 23.90.70.142:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 54.88.108.212:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 69.11.66.36:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 136.150.244.226:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 14.235.225.178:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 180.233.180.108:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 154.9.254.230:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.253.233.98:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 34.115.187.66:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.30.90.77:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 204.117.16.102:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 161.160.93.24:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 213.34.212.76:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 95.81.125.192:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 200.51.103.210:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 165.149.178.133:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 205.22.205.86:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 140.174.53.131:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 107.40.111.85:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 150.175.104.22:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 194.85.89.159:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 188.12.149.200:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.30.207.166:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 9.191.75.8:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 115.0.108.174:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 41.187.48.177:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 63.48.29.177:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 67.40.126.183:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 117.0.61.3:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 208.168.94.118:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 81.192.205.43:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.110.178.124:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.161.153.194:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 32.44.151.82:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 186.180.169.27:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 101.164.223.90:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 112.67.22.210:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 103.220.105.158:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 188.103.82.3:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 216.195.55.250:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 202.254.112.235:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 27.196.81.198:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 73.30.27.20:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 198.66.116.108:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.79.211.160:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 79.74.88.136:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 145.176.21.137:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 119.189.100.92:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 104.5.136.137:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 49.201.89.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 129.98.245.203:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 58.170.12.121:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 152.105.253.62:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 69.72.202.72:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 211.13.64.48:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 115.109.86.215:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.242.112.202:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 123.182.56.11:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 41.73.168.219:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 121.178.155.31:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.192.36.147:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 146.161.216.208:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 221.160.79.198:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 39.255.203.203:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 46.41.230.45:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 34.110.87.195:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 198.111.73.112:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 222.254.255.90:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 52.140.254.183:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 210.142.222.213:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 49.4.113.92:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 175.52.231.251:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 216.202.212.25:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 177.31.103.83:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 158.198.240.109:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 9.172.14.219:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 5.37.175.151:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 153.190.110.63:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 77.18.105.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 194.30.67.162:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 159.252.208.35:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 76.133.229.253:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 184.129.2.186:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 112.85.223.125:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 60.246.20.86:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 175.49.185.17:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 205.31.154.235:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 23.50.112.164:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 65.225.237.21:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 200.51.201.216:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 136.76.67.105:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 38.86.204.46:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 60.213.146.160:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 191.224.193.24:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 189.37.17.131:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 24.187.142.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 40.244.232.251:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.28.145.184:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 193.140.29.81:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 164.119.138.150:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 20.149.172.86:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 212.119.149.142:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 73.149.121.194:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 14.239.159.254:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 95.234.197.174:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 47.65.63.73:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.175.94.41:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 41.17.199.144:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 149.22.216.167:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 158.230.45.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 193.20.60.169:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 87.242.124.193:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 185.234.110.45:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 63.180.137.102:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 108.170.22.190:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.224.68.129:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 201.3.49.128:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 187.211.255.173:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 132.78.49.95:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 67.47.116.64:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 79.107.87.158:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 175.100.10.157:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 94.214.142.63:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 153.122.8.153:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 37.176.55.141:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 43.238.107.135:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 204.29.48.182:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 167.21.254.207:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.121.183.250:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 189.106.136.131:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 118.215.73.224:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 219.168.222.37:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 101.111.0.110:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 219.182.252.214:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 219.188.135.139:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 126.122.130.145:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.228.3.56:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 176.245.14.87:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 99.117.204.56:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 9.114.122.206:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 99.179.67.80:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 69.90.254.30:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 152.179.170.225:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 147.250.126.94:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 147.103.55.254:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 193.249.48.104:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 35.64.180.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 173.54.200.126:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.82.16.180:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 32.126.160.197:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 204.68.223.88:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 191.177.247.203:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 111.133.64.13:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 97.65.33.80:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 158.233.120.144:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 116.219.218.219:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 125.225.215.84:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 104.11.123.58:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 154.90.137.73:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 118.127.42.152:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 217.114.108.29:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 79.35.75.70:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 70.195.4.0:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 45.87.32.206:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 138.35.188.223:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 90.234.183.75:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 157.200.241.206:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.119.235.100:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 66.31.222.177:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 52.131.73.198:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 144.108.0.53:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 118.54.12.189:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 65.201.70.242:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 146.106.207.16:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 190.235.233.102:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 82.187.118.176:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 194.234.221.49:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 197.247.51.96:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 140.234.224.33:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 164.86.218.163:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 83.15.210.225:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 183.116.218.238:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 12.0.130.52:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 168.119.64.66:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 95.101.118.101:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 164.56.12.153:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 173.73.87.66:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 211.115.1.186:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 43.102.101.68:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 78.52.202.139:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 64.34.45.155:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 89.178.71.232:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 119.40.233.122:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 115.14.38.34:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 174.47.148.72:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 67.30.183.23:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 223.165.151.161:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 139.111.13.70:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 134.137.220.148:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 58.79.162.125:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 140.208.133.231:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 152.92.233.14:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 135.46.22.7:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 49.166.89.47:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 182.44.242.224:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 141.85.15.152:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 36.120.25.46:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 221.78.120.65:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 77.33.146.162:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 110.135.204.143:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 35.117.5.194:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 220.119.45.68:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 19.217.103.36:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 186.90.202.113:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 111.106.150.228:2323
Source: global traffic TCP traffic: 192.168.2.23:59755 -> 40.113.85.60:2323
Source: unknown DNS traffic detected: queries for: rocock.gay
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 97.15.148.203
Source: unknown TCP traffic detected without corresponding DNS query: 109.185.82.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.97.123.0
Source: unknown TCP traffic detected without corresponding DNS query: 99.91.121.234
Source: unknown TCP traffic detected without corresponding DNS query: 136.195.80.72
Source: unknown TCP traffic detected without corresponding DNS query: 85.13.1.130
Source: unknown TCP traffic detected without corresponding DNS query: 73.251.130.181
Source: unknown TCP traffic detected without corresponding DNS query: 81.152.49.31
Source: unknown TCP traffic detected without corresponding DNS query: 173.60.70.68
Source: unknown TCP traffic detected without corresponding DNS query: 18.54.146.33
Source: unknown TCP traffic detected without corresponding DNS query: 209.222.89.206
Source: unknown TCP traffic detected without corresponding DNS query: 173.13.91.77
Source: unknown TCP traffic detected without corresponding DNS query: 71.107.166.22
Source: unknown TCP traffic detected without corresponding DNS query: 123.138.115.206
Source: unknown TCP traffic detected without corresponding DNS query: 24.96.247.105
Source: unknown TCP traffic detected without corresponding DNS query: 141.34.66.65
Source: unknown TCP traffic detected without corresponding DNS query: 58.119.62.185
Source: unknown TCP traffic detected without corresponding DNS query: 35.62.19.81
Source: unknown TCP traffic detected without corresponding DNS query: 108.72.218.144
Source: unknown TCP traffic detected without corresponding DNS query: 137.84.107.211
Source: unknown TCP traffic detected without corresponding DNS query: 168.136.91.240
Source: unknown TCP traffic detected without corresponding DNS query: 200.26.152.210
Source: unknown TCP traffic detected without corresponding DNS query: 74.235.199.77
Source: unknown TCP traffic detected without corresponding DNS query: 170.201.194.104
Source: unknown TCP traffic detected without corresponding DNS query: 64.245.252.215
Source: unknown TCP traffic detected without corresponding DNS query: 153.165.250.46
Source: unknown TCP traffic detected without corresponding DNS query: 94.13.238.216
Source: unknown TCP traffic detected without corresponding DNS query: 97.231.142.221
Source: unknown TCP traffic detected without corresponding DNS query: 101.127.65.134
Source: unknown TCP traffic detected without corresponding DNS query: 61.118.81.106
Source: unknown TCP traffic detected without corresponding DNS query: 186.158.84.85
Source: unknown TCP traffic detected without corresponding DNS query: 179.199.149.252
Source: unknown TCP traffic detected without corresponding DNS query: 20.60.223.103
Source: unknown TCP traffic detected without corresponding DNS query: 49.141.34.151
Source: unknown TCP traffic detected without corresponding DNS query: 204.47.172.102
Source: unknown TCP traffic detected without corresponding DNS query: 159.228.116.224
Source: unknown TCP traffic detected without corresponding DNS query: 158.121.35.141
Source: unknown TCP traffic detected without corresponding DNS query: 13.76.163.50
Source: unknown TCP traffic detected without corresponding DNS query: 139.54.20.219
Source: unknown TCP traffic detected without corresponding DNS query: 171.20.50.90
Source: unknown TCP traffic detected without corresponding DNS query: 37.30.186.229
Source: unknown TCP traffic detected without corresponding DNS query: 38.190.22.193
Source: unknown TCP traffic detected without corresponding DNS query: 113.105.64.202
Source: unknown TCP traffic detected without corresponding DNS query: 104.194.175.155
Source: unknown TCP traffic detected without corresponding DNS query: 14.100.122.54
Source: unknown TCP traffic detected without corresponding DNS query: 200.164.235.191
Source: unknown TCP traffic detected without corresponding DNS query: 133.82.212.83
Source: unknown TCP traffic detected without corresponding DNS query: 151.177.145.122

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: skid.x86.elf, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth (Nextron Systems)
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth (Nextron Systems)
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: skid.x86.elf PID: 6224, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: skid.x86.elf, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth (Nextron Systems), description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b, modified = 2023-01-27
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: skid.x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth (Nextron Systems), description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b, modified = 2023-01-27
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: skid.x86.elf PID: 6224, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: classification engine Classification label: mal84.troj.linELF@0/0@1/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6229) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6227) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6229) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6229) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/skid.x86.elf (PID: 6225) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/skid.x86.elf bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6226) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55640
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55644
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55648
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55658
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55664
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55668
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55670

Stealing of Sensitive Information
barindex
Yara detected Moobot
Source: Yara match File source: skid.x86.elf, type: SAMPLE
Source: Yara match File source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: skid.x86.elf PID: 6224, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Moobot
Source: Yara match File source: skid.x86.elf, type: SAMPLE
Source: Yara match File source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: skid.x86.elf PID: 6224, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
180.131.122.57
 unknown Japan 10013 FBDCFreeBitCoLtdJP false
71.32.94.251
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
199.43.111.158
 unknown Canada
15290 ALLST-15290CA false
86.159.6.8
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
51.110.195.16
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
171.200.199.54
 unknown United States
10794 BANKAMERICAUS false
176.113.241.57
 unknown Ukraine
39728 LUGANETRU false
107.137.104.242
 unknown United States
7018 ATT-INTERNET4US false
37.168.216.60
 unknown France
51207 FREEMFR false
24.67.143.152
 unknown Canada
6327 SHAWCA false
74.89.223.193
 unknown United States
6128 CABLE-NET-1US false
218.203.37.101
 unknown China
132525 CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp false
73.142.83.8
 unknown United States
7922 COMCAST-7922US false
197.119.235.100
 unknown Algeria
36947 ALGTEL-ASDZ false
5.231.243.207
 unknown Germany
12360 KTKKEVAGTelekomGmbHDE false
52.153.82.61
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
57.245.112.73
 unknown Belgium
2686 ATGS-MMD-ASUS false
211.20.174.116
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
219.62.41.165
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
121.96.14.230
 unknown Philippines
6648 BAYAN-TELECOMMUNICATIONSBayanTelecommunicationsIncPH false
153.60.6.170
 unknown United States
14962 NCR-252US false
36.80.95.73
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
165.250.35.191
 unknown United States
2824 DB-NA-1US false
36.67.46.137
 unknown Indonesia
17974 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID false
73.251.100.67
 unknown United States
7922 COMCAST-7922US false
220.106.223.176
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
220.20.57.199
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
220.131.202.80
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
64.146.36.5
 unknown United States
7029 WINDSTREAMUS false
39.220.171.151
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
190.175.112.89
 unknown Argentina
22927 TelefonicadeArgentinaAR false
19.152.171.3
 unknown United States
3 MIT-GATEWAYSUS false
216.3.199.10
 unknown United States
2828 XO-AS15US false
180.103.254.59
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
27.221.114.162
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
25.241.134.27
 unknown United Kingdom
199055 UKCLOUD-ASGB false
114.211.126.208
 unknown China
9595 XEPHIONNTT-MECorporationJP false
153.111.193.177
 unknown New Zealand
5619 EVRY-NO false
188.112.133.108
 unknown Latvia
20910 BALTKOM-ASLV false
223.42.108.112
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
193.230.25.181
 unknown Romania
3233 RNCRomanianNatioanalRDNetworkRO false
123.41.35.80
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
4.20.226.118
 unknown United States
3356 LEVEL3US false
57.70.235.35
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
74.38.238.109
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
115.119.58.33
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
169.236.48.244
 unknown United States
22323 UNIVERSITY-OF-CALIFORNIA-MERCEDUS false
142.172.111.72
 unknown Canada
7122 MTS-ASNCA false
182.77.170.46
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
114.1.222.249
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
174.189.213.29
 unknown United States
7922 COMCAST-7922US false
195.28.184.248
 unknown Romania
33823 GEMENIIGEMENIINETWORKRO false
52.143.38.41
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
155.159.187.140
 unknown South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK false
77.239.139.253
 unknown Italy
30848 IT-TWT-ASIT false
122.102.94.122
 unknown China
138950 CHINATELECOM-JIANGSU-ZHENJIANG-IDCJiangsuZhenJiangIDCnet false
74.141.254.215
 unknown United States
10796 TWC-10796-MIDWESTUS false
187.121.10.199
 unknown Brazil
19182 TELEFONICABRASILSABR false
183.176.233.50
 unknown Japan 7522 STCNSTNetIncorporatedJP false
167.90.85.116
 unknown United States
22093 CCF-NETWORKUS false
120.213.89.148
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
212.243.143.61
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
129.155.248.135
 unknown United States
792 ORACLE-ASNBLOCK-ASNUS false
114.77.240.123
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
93.234.197.105
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
186.249.4.169
 unknown Brazil
28250 TELBRAXLTDABR false
102.116.67.147
 unknown Mauritius
23889 MauritiusTelecomMU false
104.15.61.36
 unknown United States
7018 ATT-INTERNET4US false
132.98.184.206
 unknown United States
306 DNIC-ASBLK-00306-00371US false
194.214.47.84
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
46.147.228.92
 unknown Russian Federation
42116 ERTH-NCHLN-ASRU false
4.180.16.14
 unknown United States
3356 LEVEL3US false
83.173.201.188
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
162.209.78.39
 unknown United States
33070 RMH-14US false
124.122.178.147
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
172.136.63.103
 unknown United States
7018 ATT-INTERNET4US false
96.200.218.3
 unknown United States
7922 COMCAST-7922US false
209.123.177.250
 unknown United States
8001 NET-ACCESS-CORPUS false
217.135.37.161
 unknown United Kingdom
1273 CWVodafoneGroupPLCEU false
179.150.240.43
 unknown Brazil
26599 TELEFONICABRASILSABR false
4.159.206.106
 unknown United States
3356 LEVEL3US false
128.67.50.175
 unknown Italy
24608 WINDTRE-ASIT false
68.80.249.39
 unknown United States
7922 COMCAST-7922US false
180.204.220.118
 unknown Taiwan; Republic of China (ROC)
24158 TAIWANMOBILE-ASTaiwanMobileCoLtdTW false
52.211.38.97
 unknown United States
16509 AMAZON-02US false
130.111.53.162
 unknown United States
557 UMAINE-SYS-ASUS false
71.124.221.186
 unknown United States
701 UUNETUS false
89.85.144.122
 unknown France
5410 BOUYGTEL-ISPFR false
137.23.132.175
 unknown United States
19773 MOTOROLAUS false
136.150.244.226
 unknown United States
1204 SUNYNET-ASN-ASUS false
114.157.91.240
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
74.80.185.110
 unknown United States
12260 CUSTOMDOTNETUS false
210.149.30.70
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
164.65.26.206
 unknown United States
1778 DNIC-AS-01778US false
75.157.74.51
 unknown Canada
852 ASN852CA false
114.156.125.177
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
196.75.27.55
 unknown Morocco
36903 MT-MPLSMA false
108.61.200.50
 unknown United States
20473 AS-CHOOPAUS false
201.111.66.60
 unknown Mexico
8151 UninetSAdeCVMX false
35.243.174.85
 unknown United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
rocock.gay 195.58.39.189 true