Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528719
MD5: 39f3c5b9fc96e4597819851dfb80f629
SHA1: 4d95ff2230c2a8abfbbc3f37fcd3253ec7dd8cba
SHA256: fe5657999f6e96a1267dd978d539ac1139d4542413588045c43a2d55a330dd4a
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 42%
Source: na.elf Virustotal: Detection: 40% Perma Link
Found strings indicative of a multi-platform dropper
Source: na.elf String: /proc//exewgetinitcurltftp/fdsocketproc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 38.60.249.66 ports 61543,1,3,4,5,6
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 209.113.32.44:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 29.55.63.130:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 92.41.147.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 125.189.230.89:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 56.202.137.22:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 76.176.180.202:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 171.172.141.41:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 24.118.87.46:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 30.162.3.121:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 129.76.215.182:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.189.244.186:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 198.147.245.214:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 205.35.157.155:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 222.183.176.91:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 123.159.232.20:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 195.119.69.108:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 209.188.48.2:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 168.218.125.36:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.200.16.46:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 59.164.86.165:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 82.34.243.44:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 247.53.107.207:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 34.198.132.248:2323
Source: global traffic TCP traffic: 192.168.2.13:39562 -> 38.60.249.66:61543
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 202.12.54.82:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.48.204.10:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 51.198.220.119:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 133.50.149.41:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 116.111.39.242:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 191.48.20.121:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 26.166.76.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 148.155.89.157:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 196.68.33.43:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 204.6.77.101:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 249.46.195.105:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 60.52.59.135:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 220.62.230.254:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 208.68.106.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 58.18.0.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 75.174.127.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 142.95.16.77:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.21.103.9:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 143.204.216.6:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 82.64.78.197:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 146.240.123.192:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 155.132.159.171:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 48.134.46.0:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 165.201.171.131:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 147.10.238.134:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 36.3.210.4:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 20.58.90.111:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 28.170.234.26:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 249.250.184.253:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 155.212.131.112:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 153.166.21.156:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 132.217.116.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 137.124.199.142:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.214.208.38:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 19.7.238.15:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 44.92.168.191:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.0.81.16:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 167.178.20.30:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 97.97.53.254:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 68.171.233.99:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 67.104.164.158:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 199.125.244.65:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 181.155.162.81:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 202.213.221.112:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 151.13.120.5:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 133.140.218.177:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 251.98.199.243:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 199.46.161.186:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 195.84.193.114:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 50.60.126.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 195.53.215.210:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 29.129.76.139:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 175.41.37.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 126.241.51.161:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 195.194.206.236:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 144.118.51.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 33.97.73.196:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 72.112.119.207:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 94.61.112.202:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 43.130.222.185:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 247.229.35.135:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 66.124.109.235:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 12.182.27.65:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 113.77.139.229:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 126.90.39.37:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 30.99.252.241:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 75.228.154.19:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 72.11.53.254:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 87.227.6.45:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 76.157.254.63:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 141.225.124.86:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 96.243.75.88:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 132.45.212.96:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 201.47.113.53:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 212.169.91.100:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 116.112.169.214:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 163.113.156.208:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 84.236.118.236:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 206.173.107.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 110.173.72.127:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 104.203.110.250:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 87.80.100.233:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 216.12.93.180:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 45.191.41.63:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 43.238.100.233:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 166.110.70.44:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 177.53.246.244:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 163.76.27.81:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 29.200.77.78:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 240.202.9.111:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 209.119.93.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 255.27.71.153:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 74.163.138.246:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 15.19.15.64:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 244.245.167.175:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 86.186.93.124:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 73.122.74.146:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 145.2.26.146:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 142.101.117.149:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 84.84.237.188:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 20.11.19.217:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.1.19.7:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 220.75.67.224:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 204.77.194.184:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 117.2.197.188:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 255.67.227.194:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 35.251.22.143:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 111.88.47.51:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 113.93.228.232:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 94.103.182.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 50.166.73.195:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 2.111.84.194:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 109.1.19.135:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 194.27.244.250:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.191.56.167:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 123.126.94.112:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 138.34.38.65:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 44.100.118.247:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 86.181.19.223:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 48.35.8.24:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 21.13.190.101:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 109.235.100.163:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 124.42.11.217:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.152.219.107:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.222.240.251:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 4.89.218.213:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 132.40.230.140:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 242.129.2.125:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 130.65.79.163:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 91.1.86.68:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 35.118.112.6:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 47.112.180.204:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 93.14.242.49:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.17.60.38:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 108.98.146.81:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 206.77.122.123:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 177.157.1.208:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 109.150.240.72:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 21.118.89.145:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 212.85.87.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.194.99.60:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 144.185.120.115:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 169.66.162.190:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 82.198.145.246:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 211.94.172.108:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 18.177.94.73:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 253.239.104.112:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 33.247.27.15:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 165.209.33.229:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 111.72.126.242:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.38.97.35:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 7.68.74.107:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 95.100.23.56:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 151.45.169.114:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.18.127.193:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 55.217.197.75:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 148.103.57.211:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 88.53.29.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 42.88.163.196:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 89.31.47.252:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 56.23.73.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 22.51.212.184:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 22.69.125.67:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 203.103.115.232:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 57.135.233.139:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 161.184.25.107:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 26.78.79.45:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 67.151.238.137:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 40.27.10.11:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.116.252.142:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 253.63.67.107:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 95.240.172.24:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 162.245.235.239:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 29.218.187.223:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 213.54.134.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 74.72.80.129:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 76.189.7.140:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 18.77.152.111:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 204.119.171.123:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 81.137.78.224:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 93.6.215.73:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 182.172.0.208:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 35.42.97.35:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 110.120.124.193:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 140.57.249.245:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 29.25.155.28:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 181.49.118.198:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 12.236.72.143:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 187.9.200.212:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 249.238.110.253:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 84.55.91.31:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.199.61.239:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 143.172.210.178:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 210.8.98.252:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 112.152.9.170:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 244.25.15.175:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 35.103.42.39:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 46.135.82.87:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 37.146.66.4:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 156.207.223.237:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 9.251.94.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 76.254.26.100:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 52.138.26.248:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 207.71.165.161:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 155.28.21.155:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 166.230.96.175:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 185.165.92.26:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 131.60.169.100:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 198.201.2.28:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 184.201.165.52:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 101.181.66.73:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 97.160.213.82:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 141.162.196.253:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 107.197.46.176:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 169.206.217.131:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 205.239.234.116:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 185.238.239.34:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 92.20.167.172:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 255.144.15.181:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 206.116.117.114:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 65.149.27.233:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 112.88.248.105:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 252.150.238.0:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 247.57.66.155:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 45.32.242.21:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 69.124.142.216:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 19.124.180.209:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 79.242.33.242:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 4.121.117.210:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 6.92.68.210:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 107.235.182.209:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 246.52.55.35:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 240.96.23.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 217.48.26.16:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.162.207.237:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 251.30.135.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 183.72.188.108:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 196.241.196.137:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 123.48.249.244:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 152.147.203.145:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 216.111.250.205:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 130.176.129.56:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 169.157.70.236:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 56.13.59.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 198.50.253.244:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 110.7.96.125:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 126.219.67.120:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 22.174.133.232:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 108.0.3.196:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 151.43.66.255:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 222.17.0.178:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 186.6.121.182:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.11.66.112:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 166.65.44.234:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 54.23.104.10:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 46.171.224.238:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 244.230.30.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.2.23.34:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 19.247.154.220:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 188.17.50.144:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 23.51.181.72:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 222.38.145.125:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.76.156.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 53.42.127.251:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 136.77.212.192:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 7.53.177.99:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 123.129.137.228:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 24.195.206.239:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 216.63.218.23:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 82.22.11.13:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 91.40.184.142:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 159.114.222.176:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 167.232.187.89:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 95.0.132.26:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 159.115.107.96:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 91.158.50.253:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 107.199.124.117:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 223.214.2.96:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 59.100.228.180:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 52.83.15.87:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 56.44.235.129:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 22.105.229.7:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 41.210.179.34:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 153.171.163.121:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.95.68.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 110.103.54.166:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 104.51.96.201:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 176.38.200.41:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 77.172.168.36:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 205.4.113.34:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 206.124.117.30:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 66.167.236.63:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 184.254.250.214:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 134.192.44.182:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.254.80.15:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 193.132.20.214:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 202.122.73.6:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 74.182.17.23:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 85.92.143.217:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 63.33.4.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 126.91.232.139:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 145.119.156.86:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 84.29.192.69:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 98.11.181.253:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 69.87.28.158:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 2.124.206.56:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 171.87.97.160:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 26.141.123.155:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 15.77.67.87:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.87.10.250:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.129.29.178:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 18.123.83.46:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 17.9.157.166:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 243.83.115.220:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 146.171.46.161:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 171.35.169.15:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.255.230.224:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 222.146.91.52:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 96.129.251.5:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 27.161.4.51:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 191.137.233.209:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 36.251.174.131:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 148.244.95.205:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 64.209.163.17:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 64.72.103.130:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.85.162.46:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.5.204.67:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 178.92.9.58:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 93.240.201.71:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 188.124.179.241:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 251.201.230.236:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 68.167.14.30:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 89.145.8.227:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 44.203.140.14:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 254.15.161.75:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 139.242.161.45:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 166.212.101.28:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 252.212.16.241:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 175.76.108.54:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 198.150.113.245:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 144.229.215.54:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 87.163.89.212:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 206.9.4.209:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 143.190.165.18:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 190.236.32.46:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 167.62.181.174:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 142.220.57.12:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.226.241.38:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 60.147.123.223:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 188.145.136.40:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 103.212.138.54:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 58.207.205.96:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 132.229.180.124:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 20.159.204.230:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 78.141.55.19:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 98.50.144.138:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 17.207.247.237:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 195.101.8.212:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 57.189.152.226:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 43.24.218.22:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 203.28.168.181:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 184.38.127.192:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 108.4.193.150:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 150.207.96.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 139.91.199.159:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 4.126.167.145:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 70.24.5.224:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 131.42.128.193:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 63.22.195.118:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 207.199.94.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 216.48.133.25:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 212.90.71.197:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 173.154.13.35:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 104.1.94.72:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 109.8.65.167:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 197.205.9.175:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 161.12.24.126:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 25.87.59.199:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 218.7.197.16:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 112.106.93.122:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 9.69.223.231:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 165.161.6.237:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 100.86.239.3:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 186.82.199.163:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 67.201.144.61:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 16.116.71.101:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 99.202.135.218:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 45.178.54.205:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 116.251.207.33:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 253.68.221.183:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 141.11.200.197:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 156.199.72.242:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 51.53.209.85:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 211.96.76.28:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 94.72.45.198:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 47.49.105.164:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 94.29.144.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 38.14.23.251:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 168.119.8.63:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 247.142.34.72:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 34.3.33.3:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 101.51.87.251:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 143.152.161.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 13.183.144.254:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 96.5.29.130:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.177.128.202:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 26.148.19.217:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 142.254.244.197:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 222.203.14.166:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 90.13.48.83:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 144.210.23.70:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 159.177.119.194:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 54.184.15.211:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 85.139.234.136:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 122.11.9.128:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 220.142.158.225:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 197.115.255.8:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.1.22.74:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 252.167.241.247:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 148.59.149.241:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 37.60.48.157:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 1.58.250.113:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 173.225.79.105:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 14.75.223.213:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 196.94.164.158:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 240.102.136.194:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 62.254.244.162:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 245.182.72.135:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 223.39.166.151:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 9.227.86.90:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 240.8.103.190:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 169.90.204.14:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 18.245.10.142:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 246.34.191.203:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 181.137.173.37:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 51.101.140.235:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 96.41.132.223:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 100.218.49.26:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 44.151.41.109:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.29.86.215:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 191.98.71.242:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 186.38.219.89:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 79.55.32.159:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 244.16.142.132:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 241.53.251.3:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 101.122.134.206:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 199.156.13.160:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 186.105.210.115:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 22.41.197.91:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 76.197.192.76:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 58.149.154.56:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 7.108.212.98:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 44.104.206.243:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 197.218.6.184:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 184.83.33.230:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 255.159.13.50:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 115.88.96.216:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.228.13.231:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 166.99.24.199:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 248.112.201.48:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 163.153.100.205:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 12.0.76.35:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 159.170.96.11:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 66.103.173.182:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 116.103.223.50:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 191.96.141.226:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 182.105.222.155:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 85.66.91.182:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 214.109.133.61:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 40.29.237.196:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 174.211.45.232:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 112.215.65.202:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 55.122.59.201:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 33.248.140.58:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 129.23.194.57:2323
Source: global traffic TCP traffic: 192.168.2.13:35211 -> 88.40.96.204:2323
Sample listens on a socket
Source: /tmp/na.elf (PID: 5425) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 209.113.32.44
Source: unknown TCP traffic detected without corresponding DNS query: 69.84.96.44
Source: unknown TCP traffic detected without corresponding DNS query: 211.222.228.111
Source: unknown TCP traffic detected without corresponding DNS query: 89.57.218.210
Source: unknown TCP traffic detected without corresponding DNS query: 217.149.181.151
Source: unknown TCP traffic detected without corresponding DNS query: 117.241.162.10
Source: unknown TCP traffic detected without corresponding DNS query: 174.251.255.47
Source: unknown TCP traffic detected without corresponding DNS query: 124.152.245.65
Source: unknown TCP traffic detected without corresponding DNS query: 139.192.151.30
Source: unknown TCP traffic detected without corresponding DNS query: 142.167.168.203
Source: unknown TCP traffic detected without corresponding DNS query: 29.55.63.130
Source: unknown TCP traffic detected without corresponding DNS query: 218.199.55.187
Source: unknown TCP traffic detected without corresponding DNS query: 83.25.113.41
Source: unknown TCP traffic detected without corresponding DNS query: 115.80.114.176
Source: unknown TCP traffic detected without corresponding DNS query: 4.159.129.106
Source: unknown TCP traffic detected without corresponding DNS query: 80.41.243.30
Source: unknown TCP traffic detected without corresponding DNS query: 253.88.154.15
Source: unknown TCP traffic detected without corresponding DNS query: 92.41.147.90
Source: unknown TCP traffic detected without corresponding DNS query: 87.214.34.83
Source: unknown TCP traffic detected without corresponding DNS query: 252.169.254.118
Source: unknown TCP traffic detected without corresponding DNS query: 162.154.131.114
Source: unknown TCP traffic detected without corresponding DNS query: 50.31.124.141
Source: unknown TCP traffic detected without corresponding DNS query: 247.96.96.103
Source: unknown TCP traffic detected without corresponding DNS query: 182.157.12.207
Source: unknown TCP traffic detected without corresponding DNS query: 197.64.224.243
Source: unknown TCP traffic detected without corresponding DNS query: 178.143.141.115
Source: unknown TCP traffic detected without corresponding DNS query: 41.80.177.251
Source: unknown TCP traffic detected without corresponding DNS query: 15.131.112.98
Source: unknown TCP traffic detected without corresponding DNS query: 2.72.150.226
Source: unknown TCP traffic detected without corresponding DNS query: 132.22.11.154
Source: unknown TCP traffic detected without corresponding DNS query: 223.44.80.8
Source: unknown TCP traffic detected without corresponding DNS query: 112.70.45.70
Source: unknown TCP traffic detected without corresponding DNS query: 105.212.70.62
Source: unknown TCP traffic detected without corresponding DNS query: 248.36.171.178
Source: unknown TCP traffic detected without corresponding DNS query: 44.114.234.209
Source: unknown TCP traffic detected without corresponding DNS query: 141.229.5.137
Source: unknown TCP traffic detected without corresponding DNS query: 179.123.20.16
Source: unknown TCP traffic detected without corresponding DNS query: 60.82.86.80
Source: unknown TCP traffic detected without corresponding DNS query: 125.189.230.89
Source: unknown TCP traffic detected without corresponding DNS query: 149.147.28.143
Source: unknown TCP traffic detected without corresponding DNS query: 249.231.167.190
Source: unknown TCP traffic detected without corresponding DNS query: 105.64.25.79
Source: unknown TCP traffic detected without corresponding DNS query: 56.202.137.22
Source: unknown TCP traffic detected without corresponding DNS query: 14.44.204.121
Source: unknown TCP traffic detected without corresponding DNS query: 7.164.172.90
Source: unknown TCP traffic detected without corresponding DNS query: 43.217.43.229
Source: unknown TCP traffic detected without corresponding DNS query: 222.51.133.152
Source: unknown TCP traffic detected without corresponding DNS query: 17.126.119.198
Source: unknown TCP traffic detected without corresponding DNS query: 83.0.64.97
Source: unknown TCP traffic detected without corresponding DNS query: 254.44.9.17
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/na.elf (PID: 5429) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/na.elf (PID: 5429) Directory: /root/.cache Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /root/.ssh Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /root/.config Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /root/.local Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/na.elf (PID: 5429) Directory: /etc/.java Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5412) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.m1PiVf2Ldx /tmp/tmp.fxgTaOidMH /tmp/tmp.IM5rLyZ9fK Jump to behavior
Source: /usr/bin/dash (PID: 5413) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.m1PiVf2Ldx /tmp/tmp.fxgTaOidMH /tmp/tmp.IM5rLyZ9fK Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/na.elf (PID: 5429) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5425) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5425.1.00007ffccf27b000.00007ffccf29c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5425.1.000055da12a0d000.000055da12ab5000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: na.elf, 5425.1.000055da12a0d000.000055da12ab5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: na.elf, 5425.1.00007ffccf27b000.00007ffccf29c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
248.18.69.208
 unknown Reserved
unknown unknown false
26.168.152.86
 unknown United States
7922 COMCAST-7922US false
31.112.34.58
 unknown United Kingdom
12576 EELtdGB false
209.235.30.241
 unknown United States
7381 SRS-6-Z-7381US false
136.46.33.131
 unknown United States
16591 GOOGLE-FIBERUS false
97.138.130.118
 unknown United States
6167 CELLCO-PARTUS false
179.231.210.196
 unknown Brazil
26599 TELEFONICABRASILSABR false
62.4.67.5
 unknown Germany
13237 LAMBDANET-ASEuropeanBackboneofAS13237DE false
250.53.18.54
 unknown Reserved
unknown unknown false
244.86.252.0
 unknown Reserved
unknown unknown false
185.61.250.151
 unknown Netherlands
204627 CROWDXSNL false
119.167.244.60
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
14.71.104.147
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
202.170.233.102
 unknown China
33549 WHIPCORDCA false
78.49.123.232
 unknown Germany
6805 TDDE-ASN1DE false
169.225.245.153
 unknown United States
37611 AfrihostZA false
200.113.239.105
 unknown Haiti
27653 AlphaCommunicationsNetworkHT false
48.178.171.36
 unknown United States
2686 ATGS-MMD-ASUS false
45.32.242.21
 unknown United States
20473 AS-CHOOPAUS false
66.240.188.86
 unknown United States
23136 ONXCA false
98.27.141.234
 unknown United States
10796 TWC-10796-MIDWESTUS false
135.180.152.237
 unknown United States
46375 AS-SONICTELECOMUS false
190.116.77.57
 unknown Peru
12252 AmericaMovilPeruSACPE false
189.55.193.122
 unknown Brazil
28573 CLAROSABR false
90.172.22.225
 unknown Spain
12479 UNI2-ASES false
218.232.105.243
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
217.121.211.57
 unknown Netherlands
33915 TNF-ASNL false
205.102.87.113
 unknown United States
721 DNIC-ASBLK-00721-00726US false
190.111.28.180
 unknown Guatemala
26617 NavegacomSAGT false
73.40.120.33
 unknown United States
7922 COMCAST-7922US false
196.206.229.117
 unknown Morocco
36903 MT-MPLSMA false
112.174.230.240
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
81.136.255.236
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
128.27.12.61
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
43.44.166.252
 unknown Japan 4249 LILLY-ASUS false
214.96.10.70
 unknown United States
721 DNIC-ASBLK-00721-00726US false
130.250.92.65
 unknown United States
394900 VXCHNGE-MN01US false
97.53.160.110
 unknown United States
22394 CELLCOUS false
102.206.236.17
 unknown unknown
36926 CKL1-ASNKE false
117.156.66.150
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
37.212.194.228
 unknown Belarus
6697 BELPAK-ASBELPAKBY false
153.66.141.252
 unknown United States
14962 NCR-252US false
135.71.97.111
 unknown United States
18676 AVAYAUS false
87.89.41.216
 unknown France
5410 BOUYGTEL-ISPFR false
72.56.144.237
 unknown United States
10507 SPCSUS false
139.145.20.60
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
22.52.131.248
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
153.127.220.217
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP false
130.90.225.115
 unknown United States
786 JANETJiscServicesLimitedGB false
43.214.255.202
 unknown Japan 4249 LILLY-ASUS false
52.222.158.90
 unknown United States
16509 AMAZON-02US false
34.139.250.79
 unknown United States
2686 ATGS-MMD-ASUS false
92.185.77.34
 unknown France
12479 UNI2-ASES false
201.34.153.20
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
5.5.125.188
 unknown Germany
6805 TDDE-ASN1DE false
59.108.11.60
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
82.27.226.190
 unknown United Kingdom
5089 NTLGB false
59.62.85.144
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
12.3.93.77
 unknown United States
10998 BAC-MLAMRSUS false
13.49.131.176
 unknown United States
16509 AMAZON-02US false
115.107.248.208
 unknown China
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
206.223.68.183
 unknown United States
10297 ENET-2US false
212.43.148.43
 unknown Switzerland
8801 NETSERVSwitzerlandCH false
193.93.53.208
 unknown Ukraine
42430 HOMELANSeverodonetskUkraineUA false
92.96.218.171
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
57.62.52.66
 unknown Belgium
2686 ATGS-MMD-ASUS false
95.85.37.130
 unknown European Union
14061 DIGITALOCEAN-ASNUS false
46.121.178.119
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
86.143.198.247
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
111.29.130.3
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
52.39.7.67
 unknown United States
16509 AMAZON-02US false
125.141.52.28
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
107.109.246.93
 unknown United States
7018 ATT-INTERNET4US false
79.205.124.35
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
70.13.241.212
 unknown United States
10507 SPCSUS false
175.170.24.35
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
221.121.207.224
 unknown Japan 17698 CCNET-NETCOMMUNITYNETWORKCENTERINCORPORATEDJP false
81.237.106.64
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
71.222.240.195
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
118.245.48.246
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
27.4.89.122
 unknown India
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
109.146.97.56
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
86.209.99.172
 unknown France
3215 FranceTelecom-OrangeFR false
111.142.233.181
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
246.69.126.245
 unknown Reserved
unknown unknown false
169.49.98.105
 unknown Switzerland
36351 SOFTLAYERUS false
30.215.195.240
 unknown United States
7922 COMCAST-7922US false
178.148.207.24
 unknown Serbia
31042 SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze false
84.137.97.16
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
111.221.14.193
 unknown Singapore
38031 OPTIMAX-BD-AS-APOptiMaxCommunicationLtdBD false
120.122.98.40
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
220.108.222.12
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
137.40.85.10
 unknown Japan 721 DNIC-ASBLK-00721-00726US false
78.111.59.235
 unknown Azerbaijan
39232 UNINETAZ false
180.240.26.143
 unknown Indonesia
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
93.177.221.90
 unknown Latvia
20910 BALTKOM-ASLV false
136.150.209.46
 unknown United States
1204 SUNYNET-ASN-ASUS false
64.247.156.229
 unknown Canada
22684 SSIMICROCA false
71.211.10.205
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
159.146.57.107
 unknown Turkey
12735 ASTURKNETTR false

Contacted Domains

Name IP Active
nineteen.libre 38.60.249.66 true
daisy.ubuntu.com 162.213.35.24 true