Linux Analysis Report novo.arm7.elf

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2500010 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 6 : 141.98.10.116:48920 -> 192.168.2.13:46812

Source: unknown	TCP traffic detected without corresponding DNS query: 91.15.3.140
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.14.141
Source: unknown	TCP traffic detected without corresponding DNS query: 199.18.219.96
Source: unknown	TCP traffic detected without corresponding DNS query: 122.162.15.71
Source: unknown	TCP traffic detected without corresponding DNS query: 95.235.95.117
Source: unknown	TCP traffic detected without corresponding DNS query: 196.86.249.108
Source: unknown	TCP traffic detected without corresponding DNS query: 139.97.51.84
Source: unknown	TCP traffic detected without corresponding DNS query: 199.50.122.196
Source: unknown	TCP traffic detected without corresponding DNS query: 93.181.234.181
Source: unknown	TCP traffic detected without corresponding DNS query: 123.206.46.250
Source: unknown	TCP traffic detected without corresponding DNS query: 112.237.192.54
Source: unknown	TCP traffic detected without corresponding DNS query: 122.31.2.186
Source: unknown	TCP traffic detected without corresponding DNS query: 165.105.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 154.162.35.169
Source: unknown	TCP traffic detected without corresponding DNS query: 59.105.39.234
Source: unknown	TCP traffic detected without corresponding DNS query: 27.180.233.10
Source: unknown	TCP traffic detected without corresponding DNS query: 42.71.213.148
Source: unknown	TCP traffic detected without corresponding DNS query: 122.209.4.176
Source: unknown	TCP traffic detected without corresponding DNS query: 212.227.216.90
Source: unknown	TCP traffic detected without corresponding DNS query: 63.134.225.184
Source: unknown	TCP traffic detected without corresponding DNS query: 145.135.226.210
Source: unknown	TCP traffic detected without corresponding DNS query: 119.2.87.61
Source: unknown	TCP traffic detected without corresponding DNS query: 95.86.155.115
Source: unknown	TCP traffic detected without corresponding DNS query: 121.68.36.116
Source: unknown	TCP traffic detected without corresponding DNS query: 136.197.142.50
Source: unknown	TCP traffic detected without corresponding DNS query: 98.14.68.97
Source: unknown	TCP traffic detected without corresponding DNS query: 223.26.32.167
Source: unknown	TCP traffic detected without corresponding DNS query: 196.67.131.45
Source: unknown	TCP traffic detected without corresponding DNS query: 198.189.26.107
Source: unknown	TCP traffic detected without corresponding DNS query: 20.121.250.75
Source: unknown	TCP traffic detected without corresponding DNS query: 151.45.136.198
Source: unknown	TCP traffic detected without corresponding DNS query: 157.232.8.51
Source: unknown	TCP traffic detected without corresponding DNS query: 121.65.113.146
Source: unknown	TCP traffic detected without corresponding DNS query: 32.132.205.165
Source: unknown	TCP traffic detected without corresponding DNS query: 133.23.238.2
Source: unknown	TCP traffic detected without corresponding DNS query: 62.237.222.208
Source: unknown	TCP traffic detected without corresponding DNS query: 218.91.47.155
Source: unknown	TCP traffic detected without corresponding DNS query: 20.69.23.107
Source: unknown	TCP traffic detected without corresponding DNS query: 220.72.148.175
Source: unknown	TCP traffic detected without corresponding DNS query: 58.214.148.255
Source: unknown	TCP traffic detected without corresponding DNS query: 194.152.32.41
Source: unknown	TCP traffic detected without corresponding DNS query: 140.6.19.118
Source: unknown	TCP traffic detected without corresponding DNS query: 197.153.88.251
Source: unknown	TCP traffic detected without corresponding DNS query: 191.85.15.35
Source: unknown	TCP traffic detected without corresponding DNS query: 143.19.104.7
Source: unknown	TCP traffic detected without corresponding DNS query: 182.172.169.31
Source: unknown	TCP traffic detected without corresponding DNS query: 5.226.114.62
Source: unknown	TCP traffic detected without corresponding DNS query: 149.133.57.98
Source: unknown	TCP traffic detected without corresponding DNS query: 125.179.22.255
Source: unknown	TCP traffic detected without corresponding DNS query: 106.99.198.86

Source: global traffic

DNS traffic detected: DNS query: novo.doxbin.top

System Summary

Malicious sample detected (through community Yara rule)

Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_tcp.c

Sample and/or dropped files contains symbols with suspicious names

Source: novo.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebserv/bin/busybox/bin/watchdog/bin/systemd

Yara signature match

Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@22/0

Creates hidden files and/or directories

Source: /bin/sh (PID: 5443)

Directory: /tmp/.

Executes commands using a shell command-line interpreter

Source: /tmp/novo.arm7.elf (PID: 5443)

Shell command executed: /bin/sh -c "rm -rf /tmp/novo.arm7.elf && rm -rf novo*"

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5449)	Rm executable: /usr/bin/rm -> rm -rf /tmp/novo.arm7.elf			Jump to behavior
Source: /bin/sh (PID: 5450)	Rm executable: /usr/bin/rm -> rm -rf novo*			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /usr/bin/rm (PID: 5449)

File: /tmp/novo.arm7.elf

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/novo.arm7.elf (PID: 5441)

Queries kernel information via 'uname':

Source: novo.arm7.elf, 5441.1.00007ffe4a29b000.00007ffe4a2bc000.rw-.sdmp	Binary or memory string: vx86_64/usr/bin/qemu-arm/tmp/novo.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/novo.arm7.elf
Source: novo.arm7.elf, 5441.1.0000557c8e9cd000.0000557c8eb1d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: novo.arm7.elf, 5441.1.00007ffe4a29b000.00007ffe4a2bc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: novo.arm7.elf, 5441.1.0000557c8e9cd000.0000557c8eb1d000.rw-.sdmp	Binary or memory string: \|U!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
190.116.114.212	unknown	Peru	12252	AmericaMovilPeruSACPE	false
164.134.221.107	unknown	United Kingdom	51551	CAPITA-ASGB	false
24.224.44.74	unknown	United States	11492	CABLEONEUS	false
98.45.207.35	unknown	United States	7922	COMCAST-7922US	false
105.108.225.254	unknown	Algeria	36947	ALGTEL-ASDZ	false
152.187.94.45	unknown	United States	701	UUNETUS	false
167.74.109.3	unknown	Canada	4193	WA-STATE-GOVUS	false
70.165.78.147	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
35.12.231.136	unknown	United States	36375	UMICH-AS-5US	false
114.186.87.212	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
110.170.205.8	unknown	Thailand	7470	TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH	false
119.139.111.7	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
1.216.72.97	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
34.4.107.44	unknown	United States	2686	ATGS-MMD-ASUS	false
148.11.81.36	unknown	United States	394673	9408US	false
222.207.49.136	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
43.144.12.114	unknown	Japan	4249	LILLY-ASUS	false
62.231.242.131	unknown	Oman	28885	OMANTEL-NAP-ASOmanTelNAPOM	false
190.23.228.218	unknown	Paraguay	27866	COPACOPY	false
211.76.34.56	unknown	Taiwan; Republic of China (ROC)	4662	QTCN-ASN1GCNetReachRangeIncTW	false
43.21.125.186	unknown	Japan	4249	LILLY-ASUS	false
161.132.121.202	unknown	Peru	27843	OPTICALTECHNOLOGIESSACPE	false
180.188.25.162	unknown	China	136190	CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince	false
81.249.42.189	unknown	France	3215	FranceTelecom-OrangeFR	false
134.175.9.149	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
34.219.244.21	unknown	United States	16509	AMAZON-02US	false
65.192.241.92	unknown	United States	701	UUNETUS	false
188.88.116.58	unknown	Netherlands	31615	TMO-NL-ASNL	false
34.16.233.49	unknown	United States	2686	ATGS-MMD-ASUS	false
43.150.186.231	unknown	Japan	4249	LILLY-ASUS	false
171.32.56.62	unknown	Sweden	9874	STARHUB-MOBILEStarHubLtdSG	false
179.223.143.216	unknown	Brazil	28573	CLAROSABR	false
205.183.51.7	unknown	United States	3356	LEVEL3US	false
129.186.97.124	unknown	United States	2698	IASTATE-ASUS	false
24.184.3.200	unknown	United States	6128	CABLE-NET-1US	false
90.59.14.57	unknown	France	3215	FranceTelecom-OrangeFR	false
179.129.231.126	unknown	Brazil	26599	TELEFONICABRASILSABR	false
114.88.195.59	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
19.129.220.164	unknown	United States	3	MIT-GATEWAYSUS	false
138.67.84.101	unknown	United States	36704	CSM-ASUS	false
130.199.154.87	unknown	United States	43	BNL-ASUS	false
189.71.121.142	unknown	Brazil	7738	TelemarNorteLesteSABR	false
68.186.122.29	unknown	United States	20115	CHARTER-20115US	false
213.215.133.31	unknown	Italy	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
77.25.4.78	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
108.233.211.97	unknown	United States	7018	ATT-INTERNET4US	false
96.205.241.53	unknown	United States	7922	COMCAST-7922US	false
88.160.143.55	unknown	France	12322	PROXADFR	false
124.179.27.157	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
60.193.208.16	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
133.17.155.70	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
185.187.116.115	unknown	United Kingdom	24931	DEDIPOWERGB	false
83.178.250.86	unknown	Sweden	1257	TELE2EU	false
137.147.88.33	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
202.146.161.45	unknown	China	24212	JASNET-AS-IDPTJASNITATELEKOMINDOID	false
171.189.194.67	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
217.52.42.110	unknown	Egypt	36992	ETISALAT-MISREG	false
155.59.77.113	unknown	New Zealand	12510	SAP_DC_WDFnetworkmailabusetoabusesapcomDE	false
170.96.191.202	unknown	United States	18980	PEACEHEALTHUS	false
211.29.28.173	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
139.188.102.166	unknown	Australia	786	JANETJiscServicesLimitedGB	false
117.73.187.3	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
170.231.64.105	unknown	Brazil	265045	JohanesKlerFelemaComunicacoesMEBR	false
108.156.207.191	unknown	United States	16509	AMAZON-02US	false
133.154.69.85	unknown	Japan	38634	DWANGODWANGOCoLtdJP	false
184.28.163.53	unknown	United States	16625	AKAMAI-ASUS	false
147.25.222.217	unknown	United States	10796	TWC-10796-MIDWESTUS	false
111.178.214.155	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
132.244.254.182	unknown	United Kingdom	5400	BTGB	false
151.90.139.236	unknown	Italy	3269	ASN-IBSNAZIT	false
183.166.60.141	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
185.120.215.3	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
183.64.92.72	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
126.224.184.224	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
217.244.84.187	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
193.147.131.202	unknown	Spain	766	REDIRISRedIRISAutonomousSystemES	false
116.27.224.238	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
205.58.224.181	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
105.1.204.209	unknown	South Africa	37168	CELL-CZA	false
102.113.174.102	unknown	Mauritius	23889	MauritiusTelecomMU	false
111.70.197.243	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
146.138.44.4	unknown	United States	32982	DOE-HQUS	false
78.11.66.225	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
67.2.78.176	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
38.95.109.126	unknown	United States	9009	M247GB	false
202.103.143.87	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
118.226.70.7	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
204.159.216.197	unknown	United States	3354	THENET-AS-3354US	false
83.98.104.180	unknown	United Kingdom	30914	IOKO-ASGB	false
121.117.196.155	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
81.83.122.167	unknown	Belgium	6848	TELENET-ASBE	false
112.20.45.121	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
201.42.14.140	unknown	Brazil	27699	TELEFONICABRASILSABR	false
114.178.123.127	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
153.5.125.122	unknown	Slovenia	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
140.157.93.253	unknown	United States	16928	UTCNETUS	false
152.21.7.5	unknown	United States	81	NCRENUS	false
195.19.76.68	unknown	Russian Federation	47503	NTCITROSA-ASRU	false
101.103.109.151	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
213.177.127.248	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false

Contacted Domains

Name	IP	Active
novo.doxbin.top	141.98.10.116	true

AV Detection

Source: novo.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: novo.arm7.elf

ReversingLabs: Detection: 60%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:46812 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47094 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47110 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47136 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47404 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47406 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47410 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47412 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47510 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47742 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:47744 -> 141.98.10.116:48920

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 141.98.10.116 ports 48920,0,2,4,8,9

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 91.15.3.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 122.162.15.71:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 27.180.233.10:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 223.26.32.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 194.152.32.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 54.136.191.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 150.122.233.241:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.170.127.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 71.208.74.207:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 62.88.146.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 186.224.246.226:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 71.191.243.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 23.100.243.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 138.203.23.219:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 222.5.216.169:2323
Source: global traffic	TCP traffic: 192.168.2.13:46812 -> 141.98.10.116:48920
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 36.161.129.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 163.92.195.207:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 142.164.52.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 137.65.191.88:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 154.3.28.90:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 221.204.137.142:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 126.169.94.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 208.238.158.44:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 4.25.200.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 69.210.59.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 183.19.188.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 66.131.198.246:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 79.154.227.49:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 203.247.150.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 8.76.205.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 123.20.72.97:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 81.90.25.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 101.225.15.3:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 177.148.108.98:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 20.0.207.153:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 90.212.178.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 110.160.173.222:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 46.157.29.28:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.202.215.39:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 160.140.69.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 5.205.204.25:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 77.192.0.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 35.181.227.231:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 78.133.240.217:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 189.112.76.22:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 199.128.242.77:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 102.213.140.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 197.143.126.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 151.237.213.169:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 152.93.227.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 67.169.142.196:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 193.147.131.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 167.139.94.51:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 110.108.230.2:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 154.180.238.127:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 198.112.38.147:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 85.244.45.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 14.166.202.183:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 129.218.16.210:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.174.2.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 41.189.65.116:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 46.82.53.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 190.26.85.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 175.167.155.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.42.249.155:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 200.161.169.15:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 104.229.101.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 191.147.178.61:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 76.29.244.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.60.53.102:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 88.92.110.0:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 179.188.109.21:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 89.87.250.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 78.69.191.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 146.165.145.185:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 199.156.6.201:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 31.123.82.155:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.14.66.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 102.235.199.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 18.218.93.83:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 121.166.118.20:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 109.146.208.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 77.225.57.188:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 65.41.100.245:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 1.9.185.228:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 209.23.89.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 168.186.248.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 183.48.100.201:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.156.2.236:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 66.25.179.104:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 72.119.133.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 103.174.193.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 49.179.124.26:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 217.237.165.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 19.48.196.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 106.139.90.186:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 161.224.213.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 101.143.247.189:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 199.147.190.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 17.216.7.245:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 187.43.59.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 158.198.8.245:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 222.201.122.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 104.169.80.145:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 157.254.197.229:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 90.139.1.73:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 115.95.91.228:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 119.188.152.66:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 48.96.202.159:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 65.117.141.63:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 162.229.202.112:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 46.103.214.112:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 67.247.38.34:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 203.215.168.47:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 213.75.150.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 116.63.178.89:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 200.113.109.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 116.116.119.252:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 17.176.227.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 129.29.65.201:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 146.21.115.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 103.42.226.116:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 135.235.141.181:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.193.47.39:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 88.176.196.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 102.204.66.196:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 155.238.154.127:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 132.35.40.80:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 73.198.181.60:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.84.35.189:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 184.12.142.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 20.59.149.221:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 125.245.196.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 168.47.195.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.68.194.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 39.85.27.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 200.28.191.206:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 32.230.17.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 37.125.113.175:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 13.231.167.174:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 209.26.172.190:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 116.213.45.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.97.60.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 65.49.64.244:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 130.150.10.128:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 211.7.140.175:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 57.145.179.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 63.203.251.204:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 79.253.41.10:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 49.213.13.241:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 24.237.77.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 221.190.62.229:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 92.175.147.7:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 165.139.252.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 80.233.71.76:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 138.13.92.88:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 148.184.181.255:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 84.60.129.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 53.6.74.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 143.14.69.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 87.117.74.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 35.249.142.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 209.83.162.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 145.54.32.229:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 170.154.30.200:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 5.174.164.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 84.255.131.246:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 40.4.100.101:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 67.38.161.132:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 123.27.239.215:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 171.254.174.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 123.86.26.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 86.41.92.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 178.163.138.45:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 206.15.140.86:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 82.139.197.181:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 136.203.186.138:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 83.55.43.16:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 49.21.124.45:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 43.39.190.138:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 73.237.56.8:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 141.201.80.79:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 185.48.209.45:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 134.236.235.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 8.181.136.222:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 20.169.211.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.231.25.127:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 162.71.3.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 155.159.34.110:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 67.82.39.60:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 142.220.95.70:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 143.82.21.241:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 63.74.203.26:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 54.205.128.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 102.225.143.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 19.61.124.81:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.127.105.213:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 151.64.150.95:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 196.239.104.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 167.191.186.57:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 156.96.162.132:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 167.91.127.204:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 17.137.237.230:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 221.180.151.76:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.136.148.222:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 108.41.116.251:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 91.207.69.82:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 58.116.15.60:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 188.7.65.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 183.18.88.186:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 44.244.208.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 151.31.157.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 12.145.247.121:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 175.234.68.57:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 64.27.165.22:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 170.153.113.43:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 189.92.224.238:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 194.91.113.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 223.98.140.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 36.113.246.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 190.25.216.37:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 103.201.250.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 136.188.37.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 52.248.88.231:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 105.22.136.12:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 132.236.190.10:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 48.210.180.166:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.17.8.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 220.217.189.204:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 63.137.155.20:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 113.180.147.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 27.32.129.129:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.83.211.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 154.231.201.200:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 144.172.228.27:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 60.66.211.2:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 79.157.139.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 75.104.154.33:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.74.98.172:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 25.85.243.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 43.11.25.146:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 106.92.109.236:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 223.196.196.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 161.142.205.51:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 48.97.144.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 2.127.250.242:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 216.177.9.94:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 12.114.113.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 196.231.173.216:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.62.145.236:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 152.144.103.97:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 221.24.2.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 67.233.38.125:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 160.66.59.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 24.18.73.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 197.72.108.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 109.224.171.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 88.227.138.19:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 19.214.54.110:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.212.23.181:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 128.30.10.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 62.49.240.51:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 196.162.35.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.41.24.75:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 114.122.127.32:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 41.89.121.170:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 93.231.121.97:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 193.103.180.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 12.145.195.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 65.43.51.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 195.227.253.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 182.42.32.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 152.133.11.148:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 124.191.229.49:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 35.113.208.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 66.239.84.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 68.7.6.98:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 162.187.222.181:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 39.37.221.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 82.145.215.88:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 98.201.181.4:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 194.186.246.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 94.159.115.238:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 106.253.242.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.139.31.142:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 143.5.86.7:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 178.118.181.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 51.62.123.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 43.91.213.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 217.201.121.185:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 116.201.39.198:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 178.240.0.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 147.173.21.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 138.157.146.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 199.112.171.132:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 112.167.161.114:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 83.143.117.206:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 123.177.188.215:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.92.130.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 206.132.110.90:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 96.206.75.8:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 35.53.141.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 111.169.148.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 72.99.121.162:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 139.68.14.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 185.137.224.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 207.188.121.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 154.196.183.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 180.126.235.253:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 163.45.252.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 193.223.222.31:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 180.186.69.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 138.92.237.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 126.129.128.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 44.105.181.191:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 50.238.226.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 110.31.227.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 158.141.248.245:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 72.226.73.62:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 220.49.36.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 182.202.168.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 135.54.178.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 94.97.62.103:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 14.109.152.247:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 45.188.252.46:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 119.129.174.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 158.249.46.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 189.10.21.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 171.164.85.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 61.134.225.55:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 154.111.22.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 220.24.83.83:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.138.18.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 219.204.54.138:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 46.184.121.0:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 220.23.194.171:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 108.84.143.104:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 13.209.202.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 92.192.67.235:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 187.31.215.5:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.73.199.170:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 198.220.15.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 90.1.128.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 128.246.86.46:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 81.85.95.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 191.86.156.203:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 118.199.135.20:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 183.67.173.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 207.143.30.176:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 12.106.97.21:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 54.136.179.66:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 198.250.99.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 81.218.17.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 109.107.247.252:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 182.119.207.38:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 200.143.118.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 116.14.157.203:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 47.239.168.15:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 202.181.81.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 96.174.191.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 124.184.39.86:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 34.24.235.225:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 193.93.171.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 63.85.78.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 191.147.41.15:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 190.78.83.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 106.10.127.254:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 169.155.80.33:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 91.180.173.112:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 164.162.207.94:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 112.42.158.20:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 111.41.25.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 198.183.219.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 117.61.89.244:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 223.213.224.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 186.69.254.197:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 198.168.232.174:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 185.205.149.148:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 173.174.223.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 146.75.172.160:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 219.232.207.30:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 131.15.195.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 121.4.73.199:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.9.92.179:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 63.106.39.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 218.248.26.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 74.87.127.8:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 164.139.66.240:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 177.154.145.244:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 99.21.77.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 152.142.16.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.139.26.25:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 128.94.123.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 205.178.186.221:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 188.219.167.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 48.0.128.95:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 81.220.107.225:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 57.99.212.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 110.243.71.126:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 81.90.251.5:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 105.24.47.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 150.171.189.75:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 216.45.157.71:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 106.108.120.199:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 167.147.138.112:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 25.37.135.14:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 145.184.76.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 220.194.74.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 24.143.106.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 86.34.167.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 166.249.187.200:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 219.255.80.80:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 59.120.53.123:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 173.136.158.76:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 212.176.131.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 191.129.147.127:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 5.225.123.102:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 52.182.205.104:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 75.6.53.231:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 76.200.162.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 134.16.38.2:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 101.88.243.241:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 216.8.93.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 61.224.113.44:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 146.197.232.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 212.251.248.107:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 122.13.21.114:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 66.128.244.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 32.49.154.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 165.57.96.55:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 94.119.2.92:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 142.172.228.47:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 105.138.96.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 62.120.181.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 195.208.146.53:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 190.185.179.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 34.85.217.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 129.162.116.39:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 13.57.75.135:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 155.27.112.226:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 97.162.61.69:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.201.196.204:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 182.111.169.254:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 219.62.22.132:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 2.121.5.95:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 100.255.22.226:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 54.23.107.81:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 158.104.25.204:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 179.179.5.28:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 221.132.49.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 9.16.175.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 35.144.156.86:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 162.60.97.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 18.250.95.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 42.172.200.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 155.152.193.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 174.100.120.66:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.130.79.137:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 112.15.218.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 187.70.129.32:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 54.82.182.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 181.76.97.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 71.26.212.232:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 41.155.250.67:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 104.243.253.103:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 71.114.197.130:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 109.194.177.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 128.246.166.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 2.100.135.219:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 53.183.104.206:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 183.196.66.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 191.224.231.79:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 130.28.180.83:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 152.80.224.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 157.130.193.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 216.202.174.20:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 89.56.76.33:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 161.74.245.70:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 38.131.15.112:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 166.156.172.50:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 171.161.4.7:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 211.233.150.206:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.87.31.137:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 110.232.240.215:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 101.24.244.72:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 134.7.88.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 164.161.24.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.101.21.159:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 75.165.238.221:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 200.58.112.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 8.104.30.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 213.189.33.146:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 180.38.8.141:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 20.157.232.147:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 159.108.243.213:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 77.114.206.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 45.228.146.222:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 153.244.133.50:2323
Source: global traffic	TCP traffic: 192.168.2.13:56980 -> 173.169.176.53:2323

Sample listens on a socket

Source: /tmp/novo.arm7.elf (PID: 5441)

Socket: 0.0.0.0:1230

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2500010 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 6 : 141.98.10.116:48920 -> 192.168.2.13:46812

Source: unknown	TCP traffic detected without corresponding DNS query: 91.15.3.140
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.14.141
Source: unknown	TCP traffic detected without corresponding DNS query: 199.18.219.96
Source: unknown	TCP traffic detected without corresponding DNS query: 122.162.15.71
Source: unknown	TCP traffic detected without corresponding DNS query: 95.235.95.117
Source: unknown	TCP traffic detected without corresponding DNS query: 196.86.249.108
Source: unknown	TCP traffic detected without corresponding DNS query: 139.97.51.84
Source: unknown	TCP traffic detected without corresponding DNS query: 199.50.122.196
Source: unknown	TCP traffic detected without corresponding DNS query: 93.181.234.181
Source: unknown	TCP traffic detected without corresponding DNS query: 123.206.46.250
Source: unknown	TCP traffic detected without corresponding DNS query: 112.237.192.54
Source: unknown	TCP traffic detected without corresponding DNS query: 122.31.2.186
Source: unknown	TCP traffic detected without corresponding DNS query: 165.105.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 154.162.35.169
Source: unknown	TCP traffic detected without corresponding DNS query: 59.105.39.234
Source: unknown	TCP traffic detected without corresponding DNS query: 27.180.233.10
Source: unknown	TCP traffic detected without corresponding DNS query: 42.71.213.148
Source: unknown	TCP traffic detected without corresponding DNS query: 122.209.4.176
Source: unknown	TCP traffic detected without corresponding DNS query: 212.227.216.90
Source: unknown	TCP traffic detected without corresponding DNS query: 63.134.225.184
Source: unknown	TCP traffic detected without corresponding DNS query: 145.135.226.210
Source: unknown	TCP traffic detected without corresponding DNS query: 119.2.87.61
Source: unknown	TCP traffic detected without corresponding DNS query: 95.86.155.115
Source: unknown	TCP traffic detected without corresponding DNS query: 121.68.36.116
Source: unknown	TCP traffic detected without corresponding DNS query: 136.197.142.50
Source: unknown	TCP traffic detected without corresponding DNS query: 98.14.68.97
Source: unknown	TCP traffic detected without corresponding DNS query: 223.26.32.167
Source: unknown	TCP traffic detected without corresponding DNS query: 196.67.131.45
Source: unknown	TCP traffic detected without corresponding DNS query: 198.189.26.107
Source: unknown	TCP traffic detected without corresponding DNS query: 20.121.250.75
Source: unknown	TCP traffic detected without corresponding DNS query: 151.45.136.198
Source: unknown	TCP traffic detected without corresponding DNS query: 157.232.8.51
Source: unknown	TCP traffic detected without corresponding DNS query: 121.65.113.146
Source: unknown	TCP traffic detected without corresponding DNS query: 32.132.205.165
Source: unknown	TCP traffic detected without corresponding DNS query: 133.23.238.2
Source: unknown	TCP traffic detected without corresponding DNS query: 62.237.222.208
Source: unknown	TCP traffic detected without corresponding DNS query: 218.91.47.155
Source: unknown	TCP traffic detected without corresponding DNS query: 20.69.23.107
Source: unknown	TCP traffic detected without corresponding DNS query: 220.72.148.175
Source: unknown	TCP traffic detected without corresponding DNS query: 58.214.148.255
Source: unknown	TCP traffic detected without corresponding DNS query: 194.152.32.41
Source: unknown	TCP traffic detected without corresponding DNS query: 140.6.19.118
Source: unknown	TCP traffic detected without corresponding DNS query: 197.153.88.251
Source: unknown	TCP traffic detected without corresponding DNS query: 191.85.15.35
Source: unknown	TCP traffic detected without corresponding DNS query: 143.19.104.7
Source: unknown	TCP traffic detected without corresponding DNS query: 182.172.169.31
Source: unknown	TCP traffic detected without corresponding DNS query: 5.226.114.62
Source: unknown	TCP traffic detected without corresponding DNS query: 149.133.57.98
Source: unknown	TCP traffic detected without corresponding DNS query: 125.179.22.255
Source: unknown	TCP traffic detected without corresponding DNS query: 106.99.198.86

Source: global traffic

DNS traffic detected: DNS query: novo.doxbin.top

System Summary

Malicious sample detected (through community Yara rule)

Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_tcp.c

Sample and/or dropped files contains symbols with suspicious names

Source: novo.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebserv/bin/busybox/bin/watchdog/bin/systemd

Yara signature match

Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: novo.arm7.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@22/0

Creates hidden files and/or directories

Source: /bin/sh (PID: 5443)

Directory: /tmp/.

Executes commands using a shell command-line interpreter

Source: /tmp/novo.arm7.elf (PID: 5443)

Shell command executed: /bin/sh -c "rm -rf /tmp/novo.arm7.elf && rm -rf novo*"

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5449)	Rm executable: /usr/bin/rm -> rm -rf /tmp/novo.arm7.elf			Jump to behavior
Source: /bin/sh (PID: 5450)	Rm executable: /usr/bin/rm -> rm -rf novo*			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /usr/bin/rm (PID: 5449)

File: /tmp/novo.arm7.elf

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/novo.arm7.elf (PID: 5441)

Queries kernel information via 'uname':

Source: novo.arm7.elf, 5441.1.00007ffe4a29b000.00007ffe4a2bc000.rw-.sdmp	Binary or memory string: vx86_64/usr/bin/qemu-arm/tmp/novo.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/novo.arm7.elf
Source: novo.arm7.elf, 5441.1.0000557c8e9cd000.0000557c8eb1d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: novo.arm7.elf, 5441.1.00007ffe4a29b000.00007ffe4a2bc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: novo.arm7.elf, 5441.1.0000557c8e9cd000.0000557c8eb1d000.rw-.sdmp	Binary or memory string: \|U!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Source: Yara match	File source: novo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007fa1f8017000.00007fa1f802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm7.elf PID: 5441, type: MEMORYSTR