Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528716
MD5: 0e9910bdeb2bb788941fd5a4612f0544
SHA1: 533eab78c217afcc6a75542beec19d91aed9562d
SHA256: 1d63cd64531bca20d430bd42b71e330cd581eac81f231045447ae2e54a5abad9
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 39%
Found strings indicative of a multi-platform dropper
Source: na.elf String: /proc//exewgetinitcurltftp/fd/socketproc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.7.75 ports 0,1,2,4,6,42061
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 20.195.219.255:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 179.189.60.67:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 18.206.91.206:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 83.8.254.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 7.88.138.131:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 32.234.36.201:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 105.223.7.87:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 24.191.236.144:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 47.235.176.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 137.10.53.27:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 2.252.101.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 158.166.137.48:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 146.110.102.125:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 13.168.3.57:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 98.43.82.229:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 25.189.169.61:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 20.215.21.191:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 240.17.138.186:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 183.91.169.238:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 244.109.23.24:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 11.38.195.196:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 166.25.80.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 78.132.105.5:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 115.18.58.45:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 255.98.132.181:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 59.28.189.194:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 214.136.12.116:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 149.60.148.242:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 219.175.104.253:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 95.199.141.171:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 108.180.137.56:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 218.41.57.234:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 145.140.157.56:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 14.104.81.34:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 161.222.215.172:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 99.160.215.134:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 38.179.177.237:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 242.192.250.7:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 193.100.99.91:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 121.255.206.50:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 35.207.54.151:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 109.230.109.227:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 152.245.194.230:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 44.202.39.133:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 74.197.227.252:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 215.25.139.203:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 243.150.155.66:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 78.92.100.126:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 1.193.147.10:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 115.38.45.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 137.64.81.185:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 122.133.241.194:2323
Source: global traffic TCP traffic: 192.168.2.23:33274 -> 156.244.7.75:42061
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 23.48.137.184:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 243.79.223.153:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 98.244.25.122:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 250.181.43.127:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 247.16.98.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 251.40.36.209:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 202.231.35.153:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 160.49.131.93:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 185.31.36.193:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 160.87.138.255:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 72.181.34.143:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 183.223.117.191:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 94.7.227.62:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 105.179.165.18:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 13.187.44.136:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 166.105.117.49:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 60.192.83.249:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 159.38.67.59:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 187.214.226.156:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 36.82.126.53:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.216.214.100:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 84.33.7.5:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 120.206.159.214:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 66.2.29.26:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 21.72.25.27:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 255.131.217.97:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 198.58.133.97:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 74.67.3.107:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 197.214.159.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 247.4.248.127:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.235.15.54:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 87.66.97.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 40.158.136.196:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 250.175.78.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 185.237.72.166:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.180.88.197:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 75.254.120.80:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 38.233.229.5:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 160.68.233.63:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 57.224.112.79:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 249.94.150.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 179.141.150.254:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 223.121.74.135:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.160.90.167:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 215.250.207.23:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 12.164.57.163:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 142.146.235.187:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 147.68.126.13:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 79.243.109.183:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 18.88.162.225:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 45.35.92.136:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 213.218.144.203:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 77.108.232.181:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 163.56.93.192:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 79.136.217.66:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 63.30.71.88:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 136.21.170.115:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 167.104.57.200:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 168.96.190.227:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 96.144.5.104:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.14.117.33:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 143.94.56.122:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 88.89.112.204:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 30.185.182.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 242.15.32.177:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 194.113.170.200:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 61.123.51.103:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 38.181.205.126:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 135.236.50.28:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 25.123.196.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 82.231.187.154:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 128.162.123.57:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 134.138.202.87:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 76.74.104.151:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 52.245.139.152:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 134.220.52.188:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 72.60.27.6:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 166.162.177.126:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 88.84.225.241:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 188.70.200.74:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 196.68.174.129:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 52.169.179.154:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 74.65.64.205:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 160.215.126.195:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 177.156.156.45:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 194.79.195.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 25.212.180.154:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 185.59.152.188:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 196.124.5.189:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 212.31.197.206:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 117.153.32.193:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 14.193.11.251:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 39.1.41.214:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 210.162.149.122:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 188.250.19.35:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 246.251.127.238:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 47.106.160.196:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.58.146.87:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 189.0.47.8:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 130.130.46.81:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 147.53.156.122:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 156.7.69.238:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 148.18.32.68:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 56.214.159.2:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 218.215.168.97:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 77.253.169.229:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 186.109.188.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 145.124.130.175:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 145.154.147.116:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 27.9.1.56:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 117.2.2.199:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 50.0.101.25:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 41.112.115.115:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 41.111.80.184:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 247.137.89.65:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 249.117.4.98:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 34.105.235.213:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 219.15.24.34:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 54.247.82.21:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 98.198.247.135:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 171.235.91.114:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.101.216.144:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 185.203.61.217:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 81.43.10.92:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 45.182.5.113:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 21.120.108.249:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 221.243.114.74:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 66.226.187.109:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 124.226.255.202:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 116.202.89.109:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 23.254.214.146:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 208.205.102.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 165.3.132.196:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 37.205.192.233:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 58.22.192.189:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 251.192.228.21:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 62.197.87.223:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 158.103.96.80:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 3.83.205.57:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 31.105.151.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 255.23.236.154:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 33.0.128.237:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 96.188.129.89:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 78.99.80.158:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 218.66.56.219:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 147.61.44.21:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 252.203.104.192:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 54.103.117.9:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 52.247.71.3:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 151.70.58.40:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.173.194.227:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 85.229.161.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 28.56.147.211:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 54.52.213.3:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 204.252.69.180:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 199.184.246.241:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 20.141.61.36:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 48.133.71.106:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 122.95.234.161:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 70.102.113.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 186.57.171.212:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 39.169.223.24:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 185.104.81.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 187.112.28.232:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 128.148.33.53:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.106.85.25:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 64.121.243.213:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 183.101.191.85:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 195.25.178.23:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 106.232.149.231:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 216.225.220.148:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 148.151.230.21:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 61.104.112.189:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 85.38.5.121:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 166.33.42.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 124.153.250.119:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 246.20.86.43:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 69.205.129.35:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 126.45.139.44:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 212.163.133.0:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 78.59.3.163:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 15.23.195.165:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 87.108.182.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.149.139.146:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 188.144.255.233:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 215.40.76.75:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 144.218.114.33:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 90.179.251.105:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 196.229.8.158:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 48.44.166.217:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 123.162.247.169:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 214.162.195.250:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 87.197.241.16:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 39.236.170.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 135.44.240.226:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 58.45.44.215:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 209.147.163.231:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 16.144.80.48:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 29.61.195.232:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 220.46.221.16:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 137.9.206.228:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 191.96.4.50:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 18.197.221.230:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 140.82.37.124:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 51.156.116.141:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 66.133.188.219:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 34.60.161.52:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 126.111.46.159:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 12.123.99.1:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 220.21.14.22:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 111.45.67.94:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 52.143.71.46:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 213.183.240.255:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 6.151.153.88:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 217.66.88.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 177.235.59.74:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 209.142.141.163:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 188.111.221.101:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 61.106.238.253:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 2.249.225.138:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 215.139.50.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 156.25.231.241:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 138.44.148.76:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 71.158.234.27:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 13.219.22.94:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 191.13.20.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 41.61.254.60:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.235.115.126:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 115.110.107.230:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 170.172.163.169:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 169.243.48.198:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 147.203.140.82:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.1.6.233:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 36.64.65.11:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 168.54.3.7:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 34.117.12.8:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 129.160.225.192:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 110.251.230.235:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 82.41.122.26:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 105.57.144.179:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 112.117.97.180:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 35.212.240.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 50.211.151.187:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 138.239.152.100:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 250.231.81.248:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 149.13.44.169:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 34.238.213.166:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 168.254.213.237:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 161.195.158.110:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 81.7.221.107:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 126.48.204.6:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 53.35.34.84:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 113.215.142.59:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.47.11.121:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 128.40.50.129:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.201.12.255:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 156.146.242.100:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 182.249.19.23:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 193.32.28.221:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 17.43.188.197:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 218.237.214.33:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 7.222.158.230:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 203.171.159.203:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 72.68.215.167:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 194.17.243.239:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 147.189.163.46:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 205.53.39.179:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 196.245.13.213:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 191.23.186.247:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 136.233.154.228:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 3.37.232.225:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 167.217.150.230:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 105.13.22.146:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 112.204.235.44:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 83.62.233.142:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 99.211.9.204:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 41.108.216.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 158.105.2.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 250.148.205.82:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 41.117.60.139:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 43.176.205.178:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 101.177.107.251:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 48.59.37.57:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 204.216.148.98:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 223.207.71.23:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 137.14.106.13:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 201.88.122.196:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 40.34.135.151:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 134.178.251.101:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 95.222.115.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 56.43.12.246:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 22.86.95.133:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 106.37.23.135:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 201.212.156.168:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 38.216.245.154:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 168.170.143.70:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 100.148.122.205:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 223.236.90.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 241.86.232.75:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 61.165.246.140:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 73.188.29.203:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 247.45.144.33:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 79.79.9.17:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 87.91.244.2:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 150.77.11.231:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 86.155.148.183:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 50.243.182.191:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 176.249.53.90:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 166.100.132.209:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 45.53.30.195:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 56.134.83.168:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 102.106.250.100:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 88.97.137.7:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 142.70.66.163:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 173.22.252.244:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 129.55.30.49:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 35.110.110.90:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 6.140.127.236:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 65.175.40.234:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.233.201.229:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 141.221.24.131:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 119.227.124.247:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 212.28.137.87:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 99.66.254.127:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 190.196.206.231:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 74.79.233.0:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 67.112.187.143:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 199.10.89.27:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 210.212.67.172:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 15.178.253.10:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 249.190.114.31:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 220.253.10.208:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 75.73.104.163:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 101.128.215.128:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 103.184.194.168:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 169.210.120.98:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 167.85.18.89:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 209.232.59.164:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 21.232.88.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 83.233.183.248:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 243.54.229.116:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 252.3.29.254:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 149.90.184.18:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 177.13.186.93:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 186.194.86.95:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 36.184.88.66:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 171.57.32.228:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 65.239.34.79:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 104.19.93.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 123.193.136.152:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 42.137.189.202:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 81.38.120.70:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 171.146.85.77:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 51.131.21.246:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 62.207.175.54:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 92.164.37.26:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 165.40.95.142:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 6.133.122.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 198.88.63.185:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 205.205.255.137:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 201.138.207.152:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 33.5.97.3:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 169.123.127.53:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 19.210.95.147:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 140.34.248.245:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 215.122.78.138:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 27.212.85.140:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 141.142.252.10:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 69.20.15.64:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 246.232.14.104:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 132.193.220.202:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 83.203.232.105:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 53.191.253.155:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 50.124.107.243:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 175.197.115.125:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 79.26.231.133:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 203.37.142.172:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 24.107.250.246:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 57.168.62.46:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 44.95.65.145:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 247.9.143.85:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 70.90.87.132:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 162.84.22.159:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 78.252.254.232:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 15.74.15.20:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 24.100.67.189:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 177.197.209.94:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 148.38.89.66:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 138.105.101.7:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 30.184.25.134:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 117.115.96.5:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 168.22.35.2:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 13.229.246.194:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 251.50.206.47:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 108.137.231.153:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 196.250.234.175:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 90.79.83.244:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 72.67.219.72:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 56.69.144.39:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 255.241.166.136:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 144.76.158.17:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 132.102.88.14:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.167.60.251:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 193.242.122.168:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 80.56.71.65:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 117.84.31.70:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 193.228.202.76:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 63.8.178.217:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 113.248.245.168:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 7.166.125.251:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 255.90.91.85:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 133.11.9.79:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 221.188.127.232:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 161.127.53.54:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 243.209.225.211:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 206.242.33.99:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 74.214.236.165:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 125.86.178.93:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 36.51.148.64:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 31.104.178.35:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 20.12.254.55:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 125.31.69.173:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 180.151.178.110:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 111.75.3.93:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 170.84.51.39:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 3.72.50.140:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 90.155.205.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 54.60.157.37:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 118.242.229.36:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 223.90.241.146:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 209.117.26.58:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 72.13.243.174:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 26.96.15.42:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 155.102.200.218:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 107.75.106.135:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 91.146.238.130:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 120.110.235.209:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 116.178.166.182:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 136.202.4.188:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 139.11.242.242:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 110.223.122.78:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 241.78.126.9:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 68.115.251.216:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 14.63.93.215:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 84.158.26.114:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 171.22.250.235:2323
Source: global traffic TCP traffic: 192.168.2.23:60575 -> 148.59.157.110:2323
Sample listens on a socket
Source: /tmp/na.elf (PID: 6257) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknown TCP traffic detected without corresponding DNS query: 20.195.219.255
Source: unknown TCP traffic detected without corresponding DNS query: 199.196.155.255
Source: unknown TCP traffic detected without corresponding DNS query: 14.107.4.252
Source: unknown TCP traffic detected without corresponding DNS query: 152.76.189.97
Source: unknown TCP traffic detected without corresponding DNS query: 194.149.145.200
Source: unknown TCP traffic detected without corresponding DNS query: 209.196.26.11
Source: unknown TCP traffic detected without corresponding DNS query: 38.246.118.78
Source: unknown TCP traffic detected without corresponding DNS query: 249.224.207.152
Source: unknown TCP traffic detected without corresponding DNS query: 13.153.11.136
Source: unknown TCP traffic detected without corresponding DNS query: 69.17.137.129
Source: unknown TCP traffic detected without corresponding DNS query: 179.189.60.67
Source: unknown TCP traffic detected without corresponding DNS query: 59.75.186.18
Source: unknown TCP traffic detected without corresponding DNS query: 217.74.16.215
Source: unknown TCP traffic detected without corresponding DNS query: 102.122.177.204
Source: unknown TCP traffic detected without corresponding DNS query: 137.168.209.39
Source: unknown TCP traffic detected without corresponding DNS query: 25.206.247.178
Source: unknown TCP traffic detected without corresponding DNS query: 203.13.122.161
Source: unknown TCP traffic detected without corresponding DNS query: 149.22.133.207
Source: unknown TCP traffic detected without corresponding DNS query: 253.241.75.158
Source: unknown TCP traffic detected without corresponding DNS query: 18.206.91.206
Source: unknown TCP traffic detected without corresponding DNS query: 182.223.134.149
Source: unknown TCP traffic detected without corresponding DNS query: 139.11.83.198
Source: unknown TCP traffic detected without corresponding DNS query: 25.203.2.41
Source: unknown TCP traffic detected without corresponding DNS query: 68.249.142.226
Source: unknown TCP traffic detected without corresponding DNS query: 77.19.25.129
Source: unknown TCP traffic detected without corresponding DNS query: 124.67.198.85
Source: unknown TCP traffic detected without corresponding DNS query: 214.189.192.64
Source: unknown TCP traffic detected without corresponding DNS query: 255.50.36.89
Source: unknown TCP traffic detected without corresponding DNS query: 199.122.56.71
Source: unknown TCP traffic detected without corresponding DNS query: 83.8.254.243
Source: unknown TCP traffic detected without corresponding DNS query: 105.199.149.239
Source: unknown TCP traffic detected without corresponding DNS query: 200.186.63.204
Source: unknown TCP traffic detected without corresponding DNS query: 72.188.139.29
Source: unknown TCP traffic detected without corresponding DNS query: 176.30.103.231
Source: unknown TCP traffic detected without corresponding DNS query: 181.215.227.223
Source: unknown TCP traffic detected without corresponding DNS query: 180.100.133.46
Source: unknown TCP traffic detected without corresponding DNS query: 166.136.146.34
Source: unknown TCP traffic detected without corresponding DNS query: 66.233.248.149
Source: unknown TCP traffic detected without corresponding DNS query: 73.239.178.173
Source: unknown TCP traffic detected without corresponding DNS query: 7.88.138.131
Source: unknown TCP traffic detected without corresponding DNS query: 198.6.53.62
Source: unknown TCP traffic detected without corresponding DNS query: 133.155.9.110
Source: unknown TCP traffic detected without corresponding DNS query: 139.45.86.207
Source: unknown TCP traffic detected without corresponding DNS query: 218.202.41.199
Source: unknown TCP traffic detected without corresponding DNS query: 159.87.2.240
Source: unknown TCP traffic detected without corresponding DNS query: 136.11.176.105
Source: unknown TCP traffic detected without corresponding DNS query: 244.43.43.83
Source: unknown TCP traffic detected without corresponding DNS query: 23.92.91.15
Source: unknown TCP traffic detected without corresponding DNS query: 253.206.61.13
Source: unknown TCP traffic detected without corresponding DNS query: 42.44.91.52
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@1/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/na.elf (PID: 6260) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/na.elf (PID: 6260) Directory: /root/.cache Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /root/.ssh Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /root/.config Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /root/.local Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/na.elf (PID: 6260) Directory: /etc/.java Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/na.elf (PID: 6260) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6257) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6257.1.0000561767755000.00005617677de000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: na.elf, 6257.1.0000561767755000.00005617677de000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/sparc
Source: na.elf, 6257.1.00007ffc0f47e000.00007ffc0f49f000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6257.1.00007ffc0f47e000.00007ffc0f49f000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
116.253.59.158
 unknown China
137693 CHINATELECOM-GUANGXI-NANNING-IDCCHINATELECOMGuangxiNannin false
241.198.25.166
 unknown Reserved
unknown unknown false
121.88.7.100
 unknown Korea Republic of
10036 CNM-AS-KRDLIVEKR false
194.87.3.90
 unknown Russian Federation
41082 URALTRANSCOM-ASUA false
242.25.224.194
 unknown Reserved
unknown unknown false
215.169.56.198
 unknown United States
721 DNIC-ASBLK-00721-00726US false
53.98.20.203
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
206.199.19.136
 unknown United States
26844 PACTIVUS false
2.202.172.161
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
209.102.181.56
 unknown United States
22561 CENTURYLINK-LEGACY-LIGHTCOREUS false
40.216.186.173
 unknown United States
4249 LILLY-ASUS false
193.143.88.230
 unknown Finland
16086 DNAFI false
56.197.225.132
 unknown United States
2686 ATGS-MMD-ASUS false
34.56.43.98
 unknown United States
2686 ATGS-MMD-ASUS false
120.194.122.193
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
145.143.210.203
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
90.189.43.175
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
70.37.55.69
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
25.76.53.74
 unknown United Kingdom
7922 COMCAST-7922US false
204.99.240.190
 unknown United States
16403 BOISE-CASCADEUS false
19.101.81.26
 unknown United States
3 MIT-GATEWAYSUS false
74.27.201.105
 unknown United States
7922 COMCAST-7922US false
27.91.141.146
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
39.43.110.243
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
28.96.65.177
 unknown United States
7922 COMCAST-7922US false
88.28.37.96
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
242.40.73.241
 unknown Reserved
unknown unknown false
245.99.138.83
 unknown Reserved
unknown unknown false
121.146.6.55
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
13.166.89.235
 unknown United States
7018 ATT-INTERNET4US false
70.49.15.249
 unknown Canada
577 BACOMCA false
136.197.233.215
 unknown United States
60311 ONEFMCH false
250.116.59.239
 unknown Reserved
unknown unknown false
38.238.79.80
 unknown United States
174 COGENT-174US false
184.50.136.79
 unknown United States
16625 AKAMAI-ASUS false
116.51.140.8
 unknown Singapore
17645 NTT-SG-APASN-NTTSINGAPOREPTELTDSG false
163.151.64.47
 unknown United States
36161 WESTCHESTERCOUNTY-NYUS false
80.44.236.11
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
207.155.236.11
 unknown United States
2828 XO-AS15US false
124.122.178.165
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
149.121.149.190
 unknown United States
174 COGENT-174US false
87.67.148.66
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
94.65.191.82
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
40.210.30.183
 unknown United States
4249 LILLY-ASUS false
182.73.170.127
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
62.197.87.223
 unknown Belgium
12392 ASBRUTELEVOOBE false
132.221.16.224
 unknown Canada
11489 BACICA false
79.133.128.127
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
247.36.242.39
 unknown Reserved
unknown unknown false
20.246.165.66
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
151.29.136.209
 unknown Italy
1267 ASN-WINDTREIUNETEU false
72.3.127.175
 unknown United States
6325 ILLINOIS-CENTURYUS false
218.226.230.115
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
84.16.239.119
 unknown Germany
28753 LEASEWEB-DE-FRA-10DE false
13.156.210.171
 unknown United States
7018 ATT-INTERNET4US false
206.76.178.21
 unknown United States
3354 THENET-AS-3354US false
176.201.231.50
 unknown Italy
16232 ASN-TIMServiceProviderIT false
160.198.98.87
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
148.99.228.221
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
17.172.97.73
 unknown United States
714 APPLE-ENGINEERINGUS false
141.79.108.193
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
88.139.164.80
 unknown France
8228 CEGETEL-ASFR false
254.134.0.66
 unknown Reserved
unknown unknown false
165.98.123.253
 unknown Nicaragua
27742 AmnetTelecomunicacionesSANI false
123.57.239.209
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
84.61.19.241
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
189.47.66.36
 unknown Brazil
27699 TELEFONICABRASILSABR false
57.170.17.107
 unknown Belgium
2686 ATGS-MMD-ASUS false
26.242.227.40
 unknown United States
7922 COMCAST-7922US false
85.89.78.58
 unknown Sweden
34133 NETIT-ASSE false
82.113.125.191
 unknown Germany
39706 O2-GERMANY-ASDE false
84.155.227.33
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
187.112.28.232
 unknown Brazil
18881 TELEFONICABRASILSABR false
41.233.156.14
 unknown Egypt
8452 TE-ASTE-ASEG false
208.2.95.251
 unknown United States
1239 SPRINTLINKUS false
130.43.171.74
 unknown United Kingdom
42689 GLIDEGB false
196.14.36.30
 unknown South Africa
3741 ISZA false
92.134.116.72
 unknown France
3215 FranceTelecom-OrangeFR false
104.197.144.237
 unknown United States
15169 GOOGLEUS false
242.224.211.81
 unknown Reserved
unknown unknown false
48.244.23.198
 unknown United States
2686 ATGS-MMD-ASUS false
252.0.240.39
 unknown Reserved
unknown unknown false
181.21.231.114
 unknown Argentina
22927 TelefonicadeArgentinaAR false
197.141.77.33
 unknown Algeria
36891 ICOSNET-ASDZ false
12.0.118.237
 unknown United States
7018 ATT-INTERNET4US false
81.6.26.104
 unknown Switzerland
1836 GREENgreenchAGAutonomousSystemEU false
42.193.122.153
 unknown China
4249 LILLY-ASUS false
73.162.164.47
 unknown United States
7922 COMCAST-7922US false
23.35.142.17
 unknown United States
16625 AKAMAI-ASUS false
121.98.245.72
 unknown New Zealand
9790 VOCUSGROUPNZVocusGroupNZ false
115.212.93.128
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
102.147.219.4
 unknown Zambia
37287 ZAIN-ZAMBIAZM false
250.0.120.99
 unknown Reserved
unknown unknown false
242.170.16.172
 unknown Reserved
unknown unknown false
61.168.215.248
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
17.41.135.153
 unknown United States
714 APPLE-ENGINEERINGUS false
220.0.129.255
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
30.219.68.50
 unknown United States
7922 COMCAST-7922US false
253.42.246.233
 unknown Reserved
unknown unknown false
177.43.175.204
 unknown Brazil
18881 TELEFONICABRASILSABR false

Contacted Domains

Name IP Active
75cents.libre unknown unknown