Linux Analysis Report novo.arm.elf

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2500010 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 6 : 141.98.10.116:48920 -> 192.168.2.14:57284

Source: unknown	TCP traffic detected without corresponding DNS query: 32.177.221.22
Source: unknown	TCP traffic detected without corresponding DNS query: 60.217.84.151
Source: unknown	TCP traffic detected without corresponding DNS query: 18.228.249.141
Source: unknown	TCP traffic detected without corresponding DNS query: 76.87.43.233
Source: unknown	TCP traffic detected without corresponding DNS query: 98.23.239.149
Source: unknown	TCP traffic detected without corresponding DNS query: 132.136.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 76.21.190.196
Source: unknown	TCP traffic detected without corresponding DNS query: 198.186.89.206
Source: unknown	TCP traffic detected without corresponding DNS query: 64.136.205.245
Source: unknown	TCP traffic detected without corresponding DNS query: 183.97.141.167
Source: unknown	TCP traffic detected without corresponding DNS query: 158.26.198.229
Source: unknown	TCP traffic detected without corresponding DNS query: 18.168.116.226
Source: unknown	TCP traffic detected without corresponding DNS query: 208.231.132.246
Source: unknown	TCP traffic detected without corresponding DNS query: 43.201.29.98
Source: unknown	TCP traffic detected without corresponding DNS query: 128.92.39.35
Source: unknown	TCP traffic detected without corresponding DNS query: 180.157.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 146.34.182.205
Source: unknown	TCP traffic detected without corresponding DNS query: 109.214.64.220
Source: unknown	TCP traffic detected without corresponding DNS query: 102.20.118.196
Source: unknown	TCP traffic detected without corresponding DNS query: 219.120.133.57
Source: unknown	TCP traffic detected without corresponding DNS query: 90.132.167.210
Source: unknown	TCP traffic detected without corresponding DNS query: 152.113.123.2
Source: unknown	TCP traffic detected without corresponding DNS query: 168.209.238.30
Source: unknown	TCP traffic detected without corresponding DNS query: 53.192.119.62
Source: unknown	TCP traffic detected without corresponding DNS query: 197.171.154.5
Source: unknown	TCP traffic detected without corresponding DNS query: 204.254.97.138
Source: unknown	TCP traffic detected without corresponding DNS query: 136.194.112.193
Source: unknown	TCP traffic detected without corresponding DNS query: 123.169.144.79
Source: unknown	TCP traffic detected without corresponding DNS query: 48.122.17.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.179.28.230
Source: unknown	TCP traffic detected without corresponding DNS query: 223.80.79.181
Source: unknown	TCP traffic detected without corresponding DNS query: 205.86.160.118
Source: unknown	TCP traffic detected without corresponding DNS query: 101.114.134.29
Source: unknown	TCP traffic detected without corresponding DNS query: 206.144.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 41.21.181.90
Source: unknown	TCP traffic detected without corresponding DNS query: 136.208.63.254
Source: unknown	TCP traffic detected without corresponding DNS query: 170.65.171.142
Source: unknown	TCP traffic detected without corresponding DNS query: 69.202.234.252
Source: unknown	TCP traffic detected without corresponding DNS query: 37.27.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 136.6.134.147
Source: unknown	TCP traffic detected without corresponding DNS query: 76.199.166.46
Source: unknown	TCP traffic detected without corresponding DNS query: 149.101.59.52
Source: unknown	TCP traffic detected without corresponding DNS query: 72.14.161.247
Source: unknown	TCP traffic detected without corresponding DNS query: 195.224.1.146
Source: unknown	TCP traffic detected without corresponding DNS query: 122.121.187.141
Source: unknown	TCP traffic detected without corresponding DNS query: 159.28.215.161
Source: unknown	TCP traffic detected without corresponding DNS query: 185.130.0.103
Source: unknown	TCP traffic detected without corresponding DNS query: 96.39.92.235
Source: unknown	TCP traffic detected without corresponding DNS query: 166.202.88.79
Source: unknown	TCP traffic detected without corresponding DNS query: 25.50.134.28

Source: global traffic

DNS traffic detected: DNS query: novo.doxbin.top

System Summary

Malicious sample detected (through community Yara rule)

Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: novo.arm.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebserv/bin/busybox/bin/watchdog/bin/systemd@m

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: novo.arm.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@4/0

Creates hidden files and/or directories

Source: /bin/sh (PID: 5659)

Directory: /tmp/.

Executes commands using a shell command-line interpreter

Source: /tmp/novo.arm.elf (PID: 5659)

Shell command executed: sh -c "rm -rf /tmp/novo.arm.elf && rm -rf novo*"

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5662)	Rm executable: /usr/bin/rm -> rm -rf /tmp/novo.arm.elf			Jump to behavior
Source: /bin/sh (PID: 5663)	Rm executable: /usr/bin/rm -> rm -rf novo*			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /usr/bin/rm (PID: 5662)

File: /tmp/novo.arm.elf

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/novo.arm.elf (PID: 5657)

Queries kernel information via 'uname':

Source: novo.arm.elf, 5657.1.0000564062989000.0000564062ab7000.rw-.sdmp	Binary or memory string: b@V!/etc/qemu-binfmt/arm
Source: novo.arm.elf, 5657.1.0000564062989000.0000564062ab7000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: novo.arm.elf, 5657.1.00007ffc1f74c000.00007ffc1f76d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: novo.arm.elf, 5657.1.00007ffc1f74c000.00007ffc1f76d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/novo.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/novo.arm.elf

Stealing of Sensitive Information

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
115.252.139.156	unknown	India	18101	RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC	false
51.214.62.26	unknown	United States	2686	ATGS-MMD-ASUS	false
184.124.105.207	unknown	United States	7922	COMCAST-7922US	false
158.238.14.3	unknown	United States	1540	DNIC-ASBLK-01534-01546US	false
137.115.175.248	unknown	Malawi	37440	Airtel-MW	false
178.244.97.96	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
118.81.14.255	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
51.86.27.118	unknown	United States	2686	ATGS-MMD-ASUS	false
94.246.164.135	unknown	Poland	33923	ART-COMPL	false
184.49.222.73	unknown	United States	14654	WAYPORTUS	false
113.103.108.117	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
156.84.209.142	unknown	United States	10695	WAL-MARTUS	false
102.5.175.137	unknown	unknown	36926	CKL1-ASNKE	false
105.38.139.87	unknown	Egypt	37069	MOBINILEG	false
159.230.45.172	unknown	United States	4922	SHENTELUS	false
23.204.117.208	unknown	United States	20940	AKAMAI-ASN1EU	false
12.82.43.83	unknown	United States	7018	ATT-INTERNET4US	false
140.234.169.172	unknown	United States	6932	EBSCOPUBUS	false
67.178.219.89	unknown	United States	7922	COMCAST-7922US	false
161.96.160.87	unknown	Japan	7582	UMAC-AS-APUniversityofMacauMO	false
109.11.79.162	unknown	France	15557	LDCOMNETFR	false
175.178.176.152	unknown	China	10139	SMARTBRO-PH-APSmartBroadbandIncPH	false
12.100.240.6	unknown	United States	7018	ATT-INTERNET4US	false
83.112.91.91	unknown	France	3215	FranceTelecom-OrangeFR	false
83.22.128.111	unknown	Poland	5617	TPNETPL	false
109.214.64.220	unknown	France	3215	FranceTelecom-OrangeFR	false
13.194.113.202	unknown	United States	7018	ATT-INTERNET4US	false
40.189.146.126	unknown	United States	4249	LILLY-ASUS	false
48.85.179.242	unknown	United States	2686	ATGS-MMD-ASUS	false
34.26.121.2	unknown	United States	2686	ATGS-MMD-ASUS	false
88.147.196.60	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
124.81.140.49	unknown	Indonesia	4795	INDOSATM2-IDINDOSATM2ASNID	false
204.39.17.6	unknown	United States	237	MERIT-AS-14US	false
114.191.228.23	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
91.251.111.35	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
126.48.119.130	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
219.142.7.83	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
144.5.230.79	unknown	United States	7862	CHEVRONUS	false
102.183.83.236	unknown	Liberia	37611	AfrihostZA	false
216.64.9.240	unknown	United States	7029	WINDSTREAMUS	false
103.136.57.217	unknown	Indonesia	138670	NTL-AS-APNgernTidLorCompanyLimitedTH	false
217.76.171.231	unknown	Austria	8562	LICPLUS-ASAT	false
198.103.177.199	unknown	Canada	2665	CDAGOVNCA	false
206.234.31.29	unknown	United States	174	COGENT-174US	false
72.29.213.118	unknown	United States	3257	GTT-BACKBONEGTTDE	false
144.194.120.155	unknown	Canada	20221	IATACA	false
210.235.166.40	unknown	Japan	7679	QTNETQTnetIncJP	false
101.80.226.8	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
69.194.247.242	unknown	United States	6336	TURN-US-ASNUS	false
145.47.116.35	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
173.145.78.198	unknown	United States	10507	SPCSUS	false
123.64.223.11	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
171.232.69.98	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
81.47.152.245	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
14.50.149.201	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
74.202.48.179	unknown	United States	32899	BRESCOBROADBANDUS	false
51.138.179.129	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
181.24.24.148	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
123.137.193.75	unknown	China	136188	CHINATELECOM-ZHEJIANG-NINGBO-IDCNINGBOZHEJIANGProvince	false
101.129.249.224	unknown	China	45075	CCTVNETChinaCentralTelevisionCN	false
212.9.202.39	unknown	United Kingdom	8942	LondonOfficeGB	false
167.255.136.133	unknown	United States	16831	FUJITSUUS	false
202.228.168.56	unknown	Japan	4678	FINECanonITSolutionsIncJP	false
210.96.127.129	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false
145.204.187.145	unknown	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
34.157.218.225	unknown	United States	2686	ATGS-MMD-ASUS	false
108.196.66.28	unknown	United States	7018	ATT-INTERNET4US	false
118.174.171.60	unknown	Thailand	23969	TOT-NETTOTPublicCompanyLimitedTH	false
175.46.11.212	unknown	China	17968	DQTNETDaqingzhongjipetroleumtelecommunicationconstructi	false
223.237.249.27	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
171.232.94.90	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
113.227.162.183	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
71.187.181.157	unknown	United States	701	UUNETUS	false
63.78.130.243	unknown	United States	701	UUNETUS	false
82.32.124.24	unknown	United Kingdom	5089	NTLGB	false
139.81.226.130	unknown	United States	38305	OTAGO-UNIVERSITY-AS-NZ-APTheUniversityofOtagoNZ	false
178.115.247.56	unknown	Austria	25255	H3G-AUSTRIA-ASTELE2AUSTRIAAT	false
12.59.52.37	unknown	United States	7018	ATT-INTERNET4US	false
109.173.17.75	unknown	Russian Federation	42610	NCNET-ASRU	false
183.210.192.52	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
212.195.31.178	unknown	France	5410	BOUYGTEL-ISPFR	false
74.223.102.84	unknown	United States	7029	WINDSTREAMUS	false
186.104.87.176	unknown	Chile	7418	TELEFONICACHILESACL	false
68.247.226.69	unknown	United States	10507	SPCSUS	false
182.75.144.17	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	false
167.122.56.66	unknown	United States	19275	INTERVALUS	false
120.94.5.157	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
165.189.241.217	unknown	United States	3136	STATE-OF-WISCONSIN-AS1US	false
158.16.156.21	unknown	United States	1504	DNIC-AS-01504US	false
169.130.80.58	unknown	United States	7029	WINDSTREAMUS	false
52.102.225.74	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
49.110.83.36	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
169.236.1.129	unknown	United States	22323	UNIVERSITY-OF-CALIFORNIA-MERCEDUS	false
128.12.112.155	unknown	United States	32	STANFORDUS	false
36.33.248.19	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
202.239.21.106	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
133.127.55.113	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
77.38.88.5	unknown	Slovenia	3212	TELEMACHBroadbandAccessCarrierServicesSI	false
67.139.152.150	unknown	United States	7385	ALLSTREAMUS	false
180.152.81.209	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false

Contacted Domains

Name	IP	Active
novo.doxbin.top	141.98.10.116	true

AV Detection

Source: novo.arm.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: novo.arm.elf

ReversingLabs: Detection: 68%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.14:57284 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.14:57548 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.14:57562 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.14:57584 -> 141.98.10.116:48920
Source: Network traffic	Suricata IDS: 2030489 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response : 141.98.10.116:48920 -> 192.168.2.14:57584

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 141.98.10.116 ports 48920,0,2,4,8,9

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 132.136.244.141:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.21.190.196:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.157.25.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 205.86.160.118:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 170.65.171.142:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 166.202.88.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 183.241.174.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 50.57.171.40:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 175.199.41.109:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 62.200.0.187:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 27.23.66.145:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 170.191.110.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 58.142.35.175:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 116.75.218.35:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 184.205.25.170:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 156.125.144.226:2323
Source: global traffic	TCP traffic: 192.168.2.14:57284 -> 141.98.10.116:48920
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 128.44.231.29:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 136.106.223.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 154.255.116.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 218.189.187.46:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.9.211.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 194.161.186.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 202.108.194.173:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 31.6.50.165:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 152.106.121.113:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 91.58.80.159:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 207.85.185.168:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 96.239.249.104:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 43.46.69.106:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.149.135.33:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 212.195.82.87:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 112.56.139.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 110.205.178.179:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 140.40.216.12:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 139.66.248.163:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 115.166.4.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 105.105.97.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 144.132.230.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 139.168.50.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 97.232.169.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.254.245.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 202.90.41.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 160.38.178.81:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 92.73.32.241:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 137.179.138.189:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 51.157.203.78:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.28.246.127:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 149.213.214.36:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 112.255.158.44:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 166.70.20.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 191.161.125.209:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 103.58.160.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 159.76.240.35:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 160.203.3.19:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 200.79.31.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.94.211.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 132.129.135.226:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 47.93.162.188:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 178.136.146.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 149.107.166.158:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 72.95.45.45:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 39.13.204.45:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 123.242.131.63:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 150.174.84.24:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.251.44.236:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 156.151.180.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 58.208.174.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 20.142.48.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 208.71.175.144:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 163.250.198.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 125.99.39.201:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.186.38.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 162.180.35.71:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 57.187.2.219:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 134.214.161.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 100.252.254.202:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 176.15.26.210:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 160.103.96.184:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 163.219.127.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 155.59.236.13:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 43.218.77.255:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 146.50.242.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 183.75.131.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 77.128.213.245:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 163.207.249.250:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 23.173.73.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 31.105.197.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 85.51.59.210:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 205.108.45.243:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.138.25.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 150.250.54.234:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 75.104.149.95:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 205.117.168.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 75.189.174.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 213.80.78.144:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 105.71.159.10:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 204.245.101.9:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 142.16.247.17:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 38.217.255.66:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 92.20.202.159:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 198.209.220.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 112.90.33.141:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 170.118.158.240:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 186.216.174.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 223.230.227.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 220.39.163.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 92.35.174.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 173.59.179.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 221.151.128.29:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 133.10.180.102:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 174.219.215.86:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 179.255.186.206:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 206.67.2.18:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 171.165.131.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 158.88.132.237:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 19.156.118.154:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 203.98.130.86:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 122.152.106.206:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 86.146.175.239:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 220.179.38.56:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 139.42.224.71:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 2.94.213.133:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 71.53.125.38:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 183.211.229.85:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 73.80.148.182:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 155.168.105.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 42.84.189.98:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 126.205.40.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 221.186.251.234:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.215.242.210:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 136.181.216.125:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 46.139.90.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 109.156.121.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 142.90.203.173:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.31.139.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 53.105.195.163:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 97.212.232.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 124.97.218.181:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 34.115.77.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 221.149.213.86:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 178.77.191.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 169.158.74.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 182.78.235.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.179.200.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 171.167.197.105:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 80.102.141.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 80.178.2.129:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 153.130.61.57:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 39.24.196.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 117.36.183.171:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 212.135.211.123:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 150.214.223.99:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.236.61.12:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 14.49.229.174:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 144.249.80.14:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 182.14.232.134:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 216.24.252.8:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 96.244.246.5:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 111.105.144.17:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 137.179.124.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 92.109.195.228:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 120.38.62.230:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 195.178.24.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 50.197.77.179:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 46.71.133.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 80.103.7.4:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 168.52.123.8:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 120.30.111.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 5.26.61.188:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 206.28.0.201:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 178.82.8.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 174.55.224.56:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 173.144.13.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 203.230.156.186:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 159.219.48.106:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 24.108.159.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 52.102.225.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 131.29.101.208:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 2.108.251.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 198.153.5.26:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 5.240.12.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 146.177.240.54:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 208.140.10.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 138.35.81.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 125.70.238.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.9.31.42:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.69.130.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 222.196.159.242:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 167.113.215.232:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 146.131.249.166:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 207.108.91.117:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 173.218.220.39:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 175.162.252.134:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 199.232.2.141:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 37.243.16.240:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 176.129.185.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 114.200.50.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 80.158.10.252:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 52.236.85.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 181.17.189.184:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 83.129.162.200:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 84.245.247.245:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 61.158.239.145:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 12.170.160.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.222.11.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 140.96.79.117:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 42.177.24.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 185.206.224.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 17.24.29.9:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 77.33.210.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 152.96.67.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 148.168.148.0:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 75.251.21.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 181.2.217.210:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 109.192.215.32:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 44.53.199.110:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 99.205.75.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 162.225.0.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.85.164.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 161.192.40.93:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 114.44.45.164:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 150.224.103.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 113.217.45.42:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 113.100.47.122:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 58.150.180.203:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 121.136.208.222:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 153.209.148.22:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 98.62.167.204:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 111.178.192.120:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 117.68.183.46:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 159.76.73.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 31.6.248.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 195.138.44.95:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 17.19.227.221:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 182.138.122.9:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 116.116.26.186:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 188.98.16.23:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 42.84.130.85:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 208.192.154.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 13.235.209.19:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 175.53.238.204:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 91.234.244.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.131.3.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 221.148.54.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 82.241.5.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 208.138.151.81:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 70.16.166.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 158.22.181.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 77.140.206.120:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.140.57.164:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 96.203.51.193:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 8.24.29.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 73.184.153.20:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 187.12.134.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.205.88.197:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 53.105.56.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 42.222.66.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 17.207.95.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.193.197.151:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 148.160.17.57:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 138.186.181.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 223.227.21.242:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 62.28.72.146:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 121.63.167.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 67.104.176.142:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 163.147.66.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.29.91.111:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 212.242.109.197:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 71.145.27.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 66.33.13.158:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 41.170.20.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 34.110.216.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.144.175.129:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 151.164.219.35:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 40.249.179.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 107.65.57.42:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 167.195.173.118:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 107.17.65.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.75.164.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 83.16.167.169:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 223.104.159.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 161.158.101.165:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 54.148.43.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 154.75.205.187:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 169.195.153.225:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 98.250.248.195:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 198.255.50.163:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 201.157.174.238:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 72.234.226.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 111.181.186.193:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.220.146.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 96.134.167.73:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 199.189.226.123:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.15.34.166:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 81.116.246.52:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 79.249.13.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 13.157.124.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 120.103.203.114:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.3.111.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 17.5.56.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 141.59.171.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 121.87.208.85:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 166.220.126.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 63.209.64.44:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 130.229.81.253:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 217.90.1.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 1.210.102.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 223.231.41.173:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 102.144.8.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 210.36.49.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.251.199.108:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 98.247.176.50:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 1.27.144.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 147.245.44.100:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.169.210.239:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 185.49.74.250:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 142.103.9.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 186.252.228.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 164.40.152.84:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 143.126.36.53:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 139.160.55.184:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 49.209.79.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 115.174.10.104:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.186.190.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 81.105.93.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 88.180.22.46:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 50.119.147.159:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 48.201.155.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 101.111.196.20:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 75.200.136.233:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 223.248.60.149:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 218.139.8.109:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 144.169.177.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 77.170.192.15:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 203.109.167.40:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.40.107.106:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 47.193.101.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 157.87.192.2:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 31.179.51.62:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 222.139.242.95:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.57.48.158:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 185.18.41.208:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 181.42.93.11:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 138.240.248.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 94.221.39.225:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 119.189.0.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 141.232.127.61:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 62.34.100.169:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.3.69.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 165.244.239.5:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 158.16.160.189:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 154.75.235.161:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 89.205.164.189:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 170.92.118.239:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 210.30.116.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 176.12.18.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 109.224.122.143:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 152.246.135.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 130.116.191.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 124.91.39.123:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 145.232.114.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 49.79.70.161:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 156.167.17.178:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 40.197.110.236:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 47.216.119.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 129.94.12.193:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 132.246.86.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 97.176.107.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 109.164.105.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 128.16.116.221:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 125.71.121.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 2.126.50.71:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 153.81.78.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 220.170.83.190:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 95.154.111.187:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 48.10.238.36:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 147.9.188.175:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 102.225.156.159:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 193.154.188.0:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 202.70.15.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 206.243.27.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 108.69.7.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 13.53.165.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 107.90.166.17:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 177.207.77.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 206.205.199.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 182.145.202.146:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 146.62.55.163:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 62.41.200.116:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 82.69.131.87:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 142.180.232.98:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 75.25.58.132:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 121.8.85.200:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 126.250.214.56:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 78.160.210.250:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 103.101.62.102:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.22.222.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 35.149.68.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 121.54.159.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 153.242.201.137:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 148.160.178.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 203.158.15.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 13.218.166.68:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 178.84.102.191:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 194.216.7.181:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 95.41.116.131:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 168.232.249.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 51.154.150.187:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 199.175.91.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 8.186.83.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 144.25.108.237:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 66.119.4.51:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 171.17.77.133:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 126.97.170.155:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 193.186.29.145:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 164.77.119.123:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 201.38.7.101:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 181.134.13.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 91.4.115.100:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 20.34.73.199:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 181.84.162.160:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 18.65.148.95:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 35.32.46.133:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 171.32.11.242:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 12.89.118.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 174.172.62.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 145.184.247.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 129.26.169.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 14.116.196.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 66.211.208.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 210.114.94.49:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 190.168.189.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 156.217.184.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 94.202.167.121:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 94.74.221.230:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 74.5.13.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 129.190.241.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 130.172.178.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 219.246.141.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 41.219.184.199:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 63.190.193.132:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 71.198.221.31:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 59.40.250.223:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 103.221.107.235:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 97.200.147.219:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 116.42.56.188:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 76.4.104.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 141.21.3.170:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 103.224.202.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 72.58.81.211:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 131.89.241.72:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 92.201.4.172:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 77.91.173.165:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 117.168.247.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 20.60.105.119:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 137.210.246.100:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 183.222.247.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 12.225.225.223:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 123.19.61.81:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 164.213.214.45:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 9.180.222.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 8.19.71.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 145.163.99.23:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 4.211.184.73:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 167.92.37.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 180.158.180.154:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 19.99.4.75:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 9.6.119.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 103.172.93.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.171.32.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 166.200.44.106:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 69.11.84.170:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 105.233.139.141:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 202.148.124.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 73.6.222.200:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 64.201.128.0:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 210.109.17.49:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 156.48.184.190:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 101.113.137.40:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 18.194.228.137:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 51.148.81.233:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 18.67.8.107:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 12.146.28.14:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 185.227.45.130:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 205.89.251.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 137.72.22.37:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 125.56.62.37:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 144.168.126.179:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 65.203.203.161:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 71.230.152.45:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 58.225.108.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 124.82.109.52:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 45.169.50.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 202.117.28.90:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 41.162.246.249:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 42.186.42.78:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 148.201.17.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 83.210.185.146:2323
Source: global traffic	TCP traffic: 192.168.2.14:48629 -> 73.255.254.91:2323

Sample listens on a socket

Source: /tmp/novo.arm.elf (PID: 5657)

Socket: 0.0.0.0:1230

Suricata IDS alerts with low severity for network traffic

Source: Network traffic

Suricata IDS: 2500010 - Severity 2 - ET COMPROMISED Known Compromised or Hostile Host Traffic group 6 : 141.98.10.116:48920 -> 192.168.2.14:57284

Source: unknown	TCP traffic detected without corresponding DNS query: 32.177.221.22
Source: unknown	TCP traffic detected without corresponding DNS query: 60.217.84.151
Source: unknown	TCP traffic detected without corresponding DNS query: 18.228.249.141
Source: unknown	TCP traffic detected without corresponding DNS query: 76.87.43.233
Source: unknown	TCP traffic detected without corresponding DNS query: 98.23.239.149
Source: unknown	TCP traffic detected without corresponding DNS query: 132.136.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 76.21.190.196
Source: unknown	TCP traffic detected without corresponding DNS query: 198.186.89.206
Source: unknown	TCP traffic detected without corresponding DNS query: 64.136.205.245
Source: unknown	TCP traffic detected without corresponding DNS query: 183.97.141.167
Source: unknown	TCP traffic detected without corresponding DNS query: 158.26.198.229
Source: unknown	TCP traffic detected without corresponding DNS query: 18.168.116.226
Source: unknown	TCP traffic detected without corresponding DNS query: 208.231.132.246
Source: unknown	TCP traffic detected without corresponding DNS query: 43.201.29.98
Source: unknown	TCP traffic detected without corresponding DNS query: 128.92.39.35
Source: unknown	TCP traffic detected without corresponding DNS query: 180.157.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 146.34.182.205
Source: unknown	TCP traffic detected without corresponding DNS query: 109.214.64.220
Source: unknown	TCP traffic detected without corresponding DNS query: 102.20.118.196
Source: unknown	TCP traffic detected without corresponding DNS query: 219.120.133.57
Source: unknown	TCP traffic detected without corresponding DNS query: 90.132.167.210
Source: unknown	TCP traffic detected without corresponding DNS query: 152.113.123.2
Source: unknown	TCP traffic detected without corresponding DNS query: 168.209.238.30
Source: unknown	TCP traffic detected without corresponding DNS query: 53.192.119.62
Source: unknown	TCP traffic detected without corresponding DNS query: 197.171.154.5
Source: unknown	TCP traffic detected without corresponding DNS query: 204.254.97.138
Source: unknown	TCP traffic detected without corresponding DNS query: 136.194.112.193
Source: unknown	TCP traffic detected without corresponding DNS query: 123.169.144.79
Source: unknown	TCP traffic detected without corresponding DNS query: 48.122.17.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.179.28.230
Source: unknown	TCP traffic detected without corresponding DNS query: 223.80.79.181
Source: unknown	TCP traffic detected without corresponding DNS query: 205.86.160.118
Source: unknown	TCP traffic detected without corresponding DNS query: 101.114.134.29
Source: unknown	TCP traffic detected without corresponding DNS query: 206.144.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 41.21.181.90
Source: unknown	TCP traffic detected without corresponding DNS query: 136.208.63.254
Source: unknown	TCP traffic detected without corresponding DNS query: 170.65.171.142
Source: unknown	TCP traffic detected without corresponding DNS query: 69.202.234.252
Source: unknown	TCP traffic detected without corresponding DNS query: 37.27.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 136.6.134.147
Source: unknown	TCP traffic detected without corresponding DNS query: 76.199.166.46
Source: unknown	TCP traffic detected without corresponding DNS query: 149.101.59.52
Source: unknown	TCP traffic detected without corresponding DNS query: 72.14.161.247
Source: unknown	TCP traffic detected without corresponding DNS query: 195.224.1.146
Source: unknown	TCP traffic detected without corresponding DNS query: 122.121.187.141
Source: unknown	TCP traffic detected without corresponding DNS query: 159.28.215.161
Source: unknown	TCP traffic detected without corresponding DNS query: 185.130.0.103
Source: unknown	TCP traffic detected without corresponding DNS query: 96.39.92.235
Source: unknown	TCP traffic detected without corresponding DNS query: 166.202.88.79
Source: unknown	TCP traffic detected without corresponding DNS query: 25.50.134.28

Source: global traffic

DNS traffic detected: DNS query: novo.doxbin.top

System Summary

Malicious sample detected (through community Yara rule)

Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: novo.arm.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebserv/bin/busybox/bin/watchdog/bin/systemd@m

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: novo.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: novo.arm.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@4/0

Creates hidden files and/or directories

Source: /bin/sh (PID: 5659)

Directory: /tmp/.

Executes commands using a shell command-line interpreter

Source: /tmp/novo.arm.elf (PID: 5659)

Shell command executed: sh -c "rm -rf /tmp/novo.arm.elf && rm -rf novo*"

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5662)	Rm executable: /usr/bin/rm -> rm -rf /tmp/novo.arm.elf			Jump to behavior
Source: /bin/sh (PID: 5663)	Rm executable: /usr/bin/rm -> rm -rf novo*			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /usr/bin/rm (PID: 5662)

File: /tmp/novo.arm.elf

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/novo.arm.elf (PID: 5657)

Queries kernel information via 'uname':

Source: novo.arm.elf, 5657.1.0000564062989000.0000564062ab7000.rw-.sdmp	Binary or memory string: b@V!/etc/qemu-binfmt/arm
Source: novo.arm.elf, 5657.1.0000564062989000.0000564062ab7000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: novo.arm.elf, 5657.1.00007ffc1f74c000.00007ffc1f76d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: novo.arm.elf, 5657.1.00007ffc1f74c000.00007ffc1f76d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/novo.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/novo.arm.elf

Stealing of Sensitive Information

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response

Source: Yara match	File source: novo.arm.elf, type: SAMPLE
Source: Yara match	File source: 5657.1.00007f0858017000.00007f0858028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: novo.arm.elf PID: 5657, type: MEMORYSTR