Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528723
MD5: 030f71f6d69713d8eea85d914bbe2191
SHA1: 4a1b227a86d58b02066f7fa7bef992ce29f4b1fd
SHA256: 4971e6f3bdf3b82553c54343e24bb3406938f21957836378923b2ce826714bd9
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 36%
Source: na.elf Virustotal: Detection: 28% Perma Link
Found strings indicative of a multi-platform dropper
Source: na.elf String: /dN^Nu/proc/wgetinitcurltftp/fdsocket/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//proc/net/tcpashloginntpdate

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 154.223.21.228 ports 46852,2,4,5,6,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 19.18.171.119:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 37.122.2.156:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 37.145.166.125:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 207.83.70.217:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 181.38.157.79:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 31.123.255.68:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 246.31.122.214:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 123.210.138.38:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 42.221.181.150:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 12.137.225.184:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 244.196.31.46:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 180.245.15.241:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 55.217.86.77:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 104.89.33.158:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 201.46.32.55:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 71.21.192.231:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 49.21.100.221:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 142.232.24.178:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 73.255.215.206:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 190.142.59.205:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 102.87.185.250:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 99.80.74.0:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 90.224.118.168:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 188.34.94.38:2323
Source: global traffic TCP traffic: 192.168.2.13:54782 -> 154.223.21.228:46852
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 103.227.76.120:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 154.52.107.51:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 146.119.253.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 157.57.36.5:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 119.75.91.188:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 166.123.234.61:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 194.151.56.5:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 28.227.112.232:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 188.22.55.206:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 150.124.87.37:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 174.7.130.27:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 91.253.66.173:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 97.185.127.44:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 119.187.111.182:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 202.226.108.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 175.211.69.158:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 31.202.203.209:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 134.207.158.29:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 135.22.154.13:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 77.203.143.16:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 114.136.172.73:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 246.165.84.23:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.168.147.210:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 132.11.189.43:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 51.193.87.170:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 116.45.33.88:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 39.171.181.36:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.195.10.239:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 52.164.224.21:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 163.15.247.140:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 197.100.215.71:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 117.158.239.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 75.132.168.71:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 124.77.130.89:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 49.211.6.183:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.126.72.99:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 128.82.78.126:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 115.104.239.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 17.57.24.54:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 243.9.173.203:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 60.17.202.230:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 211.243.17.122:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 62.31.118.32:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 242.80.192.128:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 27.63.25.74:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 97.15.156.211:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.138.19.148:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 54.247.107.141:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 12.71.190.39:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 244.46.66.239:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 137.40.148.27:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 74.198.62.237:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 106.109.70.118:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 111.241.74.139:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 32.45.7.244:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 48.217.6.157:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 250.115.105.207:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 66.170.233.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 104.126.247.136:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 186.23.112.200:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 255.117.240.30:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 83.142.31.11:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 181.190.17.92:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 165.249.198.36:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 174.44.150.201:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 111.188.235.57:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 181.245.160.97:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 139.66.139.156:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 141.80.27.47:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 64.28.40.57:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 152.115.177.29:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 187.230.71.108:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 109.38.123.51:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 218.149.42.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 200.244.58.67:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 78.135.253.195:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 152.229.192.222:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 100.113.72.181:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 244.151.194.189:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 70.10.10.132:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 65.126.156.233:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 16.191.165.112:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 82.155.213.241:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 11.177.200.154:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 5.247.80.229:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 156.179.56.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 173.67.194.38:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 189.156.53.111:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 194.148.54.249:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 18.236.2.43:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 74.153.184.3:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 181.173.202.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 201.196.14.115:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 117.250.181.198:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 86.238.236.180:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 203.127.138.204:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 247.1.7.240:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 4.184.87.84:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 32.198.135.27:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 47.211.146.98:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 206.87.195.214:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 160.27.142.130:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 143.219.248.48:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 250.158.107.194:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 156.238.112.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 78.21.89.201:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 60.131.83.236:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 134.218.9.196:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.166.215.57:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 248.252.173.101:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 188.46.58.11:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.85.192.236:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 203.38.93.234:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 156.104.184.60:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 67.21.18.0:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 6.0.97.116:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 43.67.128.192:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 31.132.195.61:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 38.230.229.2:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 167.219.82.251:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 96.173.210.229:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.151.184.222:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 165.12.53.11:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 183.36.27.244:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 153.102.152.12:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 189.122.147.57:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 12.178.125.105:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 74.67.15.89:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 28.234.177.48:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 155.28.64.183:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 48.81.206.79:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 1.67.160.149:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 190.40.21.114:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 41.107.190.255:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 154.21.84.20:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 176.165.185.39:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 38.176.26.33:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 88.240.48.33:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.220.74.44:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 180.167.45.211:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 138.88.43.76:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 142.69.238.248:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 243.237.183.178:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 219.166.29.49:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 64.246.233.148:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 154.176.72.154:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 15.235.136.95:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 53.92.228.193:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 138.237.246.136:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 41.215.209.75:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 27.70.148.155:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 27.24.56.96:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 9.1.179.34:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 185.30.77.92:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 16.10.219.173:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 41.194.178.158:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 159.88.213.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 107.120.100.2:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 191.143.39.234:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 66.159.69.255:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 153.50.42.121:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 170.92.197.206:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 123.213.35.156:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 148.141.109.33:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.10.187.195:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 64.14.116.178:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 200.178.140.122:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 114.134.84.229:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 91.198.67.176:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 28.161.104.82:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 101.79.90.127:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 223.191.155.42:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 108.25.39.204:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 254.106.247.89:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 150.70.232.119:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 45.192.99.38:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 186.210.174.208:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 106.120.121.228:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 18.34.186.110:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 1.99.220.148:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 144.108.183.67:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 82.181.114.113:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 206.93.121.51:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 187.180.212.156:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 12.100.238.35:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 132.205.217.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 43.202.238.158:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.56.107.16:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 162.100.85.250:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 188.105.5.230:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 136.235.35.194:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 188.128.49.84:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 171.66.68.205:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 21.126.147.34:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 56.204.183.247:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 242.130.170.231:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 37.105.156.120:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 58.205.226.158:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 149.213.35.30:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 94.108.74.174:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 133.14.28.197:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 194.5.110.180:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 4.48.50.25:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 58.173.109.5:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 122.101.125.72:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.235.197.53:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 143.175.234.211:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.80.119.55:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 119.59.124.167:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 168.1.79.176:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 68.250.189.154:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 2.190.15.78:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 3.85.161.54:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 69.121.209.194:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 98.234.211.10:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 211.178.191.178:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 126.15.38.71:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 3.101.136.112:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 208.135.129.160:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 170.18.46.240:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 181.161.35.129:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 106.16.205.153:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 27.205.45.98:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 44.176.140.97:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 52.41.117.159:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.200.146.83:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 186.61.253.41:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 248.189.224.29:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 150.60.115.252:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 196.232.192.132:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 171.142.80.205:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.222.221.98:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 36.202.6.32:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 151.122.69.60:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 99.47.209.82:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 177.225.39.244:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 75.244.115.137:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.130.58.117:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 175.173.25.204:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.177.11.129:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 121.19.7.107:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 78.175.167.120:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 240.160.29.172:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 50.16.140.126:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 215.133.162.251:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 88.71.12.52:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 24.122.128.233:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 92.42.49.37:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.213.135.68:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 97.44.6.59:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 13.248.229.109:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 240.10.219.115:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.106.96.67:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 7.216.5.208:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 26.104.51.15:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 209.70.66.190:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 92.232.100.2:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 251.170.198.144:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 123.174.131.28:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 149.193.36.106:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 74.109.228.171:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 101.124.226.113:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 158.194.74.150:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 84.71.34.222:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 216.150.129.21:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 112.122.68.131:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 66.110.251.114:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 136.172.81.132:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 88.177.81.178:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 40.229.136.203:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 199.137.38.237:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 92.41.87.39:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 11.249.15.218:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 11.87.32.250:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 111.87.77.60:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 121.138.95.87:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 185.64.86.127:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 60.101.59.200:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 47.190.42.36:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 162.82.16.247:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 56.153.53.119:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 177.52.60.200:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 194.170.77.206:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 154.37.148.89:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 131.179.151.125:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 116.80.126.73:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 179.111.27.209:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 13.40.28.139:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.62.93.163:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 149.251.48.164:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 174.38.224.233:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 96.26.144.131:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 118.92.173.236:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 163.162.249.127:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 249.118.124.144:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 77.16.133.147:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 23.106.199.54:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 33.229.176.12:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 202.252.165.242:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 133.123.150.56:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 75.26.125.47:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 49.234.1.91:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 91.188.48.102:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 216.70.47.144:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 40.196.163.31:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 139.41.62.200:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 125.152.217.141:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 254.80.240.232:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 178.76.112.25:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 189.141.204.108:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 110.186.182.143:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 63.17.148.13:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 67.38.216.147:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 128.149.130.9:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 157.44.79.241:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 189.211.230.142:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 146.118.63.205:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 248.213.179.16:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 18.46.109.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 176.58.224.108:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 170.217.45.163:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 153.197.96.11:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 142.6.89.68:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 91.27.127.146:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 221.60.11.40:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 115.37.10.102:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 178.85.182.55:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 210.8.106.173:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 204.40.104.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 4.98.249.80:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 103.251.133.51:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 220.143.29.15:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 246.189.176.154:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 60.113.134.60:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 126.81.55.14:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 216.225.180.14:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 98.252.21.19:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.186.12.218:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 22.79.1.156:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.50.208.246:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 34.252.122.230:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 99.15.12.78:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 103.172.219.230:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 67.253.241.103:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 161.174.56.227:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.79.26.100:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.164.251.134:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.211.127.206:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 111.62.154.106:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 28.205.101.9:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 103.87.142.125:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 212.220.52.8:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 215.227.103.212:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 98.199.1.63:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 98.104.206.68:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 184.75.106.0:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 247.40.69.165:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 247.236.110.138:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 195.39.181.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 113.236.42.98:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 158.145.51.208:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 73.222.143.169:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 39.248.151.249:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 155.173.113.122:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 175.159.39.92:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.34.1.51:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 133.248.81.193:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 1.33.147.69:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 36.251.244.106:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 124.91.66.130:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 103.169.204.234:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 80.194.161.216:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 32.250.83.85:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 190.230.110.64:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 42.55.104.215:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 49.116.177.113:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 218.132.124.139:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 247.103.149.153:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 6.153.33.147:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 217.218.25.76:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 57.218.174.255:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 78.211.227.222:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 89.31.113.121:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 200.225.83.0:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 84.65.77.169:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 253.97.144.177:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 151.2.251.117:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 138.203.242.35:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 165.75.121.71:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 38.144.255.250:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 148.214.50.13:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 58.84.191.153:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 125.140.191.31:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 20.35.75.237:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 70.131.18.50:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 167.46.4.200:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 193.46.51.46:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 16.84.207.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 185.37.90.116:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 54.183.132.109:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 197.0.18.11:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 51.159.10.3:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 20.4.9.159:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 116.176.131.127:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 2.144.254.207:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 138.25.102.44:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 119.225.160.249:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 75.29.174.253:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 31.129.227.46:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 206.187.106.220:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 142.108.35.171:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 73.225.73.90:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 178.118.238.87:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 73.7.121.17:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 255.55.171.184:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 162.134.156.202:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 100.153.130.17:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 150.37.232.124:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 114.182.64.26:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 244.17.2.216:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 64.185.201.193:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 250.50.159.108:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 184.17.96.167:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 58.4.68.201:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 25.166.97.64:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 176.224.96.52:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 221.156.206.25:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 86.22.144.12:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 79.184.128.165:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 15.90.111.61:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 62.135.131.186:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 86.60.208.80:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 241.94.183.58:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 7.39.105.155:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 97.252.20.140:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 19.153.204.128:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 76.227.97.218:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 169.24.49.184:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 248.27.27.136:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 27.79.14.221:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 102.212.206.84:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 85.145.83.22:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 174.80.54.255:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 113.189.57.142:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 72.163.16.110:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 91.16.108.167:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 251.6.245.25:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 185.250.144.237:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 205.53.57.37:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 59.20.90.17:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 158.153.24.129:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 52.207.126.103:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 163.94.37.235:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 178.39.154.135:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 49.192.132.54:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 110.227.123.2:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 177.86.57.4:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 60.244.224.160:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 41.65.149.230:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 255.173.145.46:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 24.215.23.119:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 79.157.62.79:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 185.240.195.252:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 247.52.46.81:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 134.250.16.240:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 99.183.183.104:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 210.98.231.180:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 120.26.64.60:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 109.250.47.18:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 245.120.99.234:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 141.210.138.97:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 56.6.10.80:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 245.144.42.227:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 221.43.156.105:2323
Source: global traffic TCP traffic: 192.168.2.13:62364 -> 97.63.12.84:2323
Sample listens on a socket
Source: /tmp/na.elf (PID: 5468) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 19.18.171.119
Source: unknown TCP traffic detected without corresponding DNS query: 190.52.235.119
Source: unknown TCP traffic detected without corresponding DNS query: 53.66.122.111
Source: unknown TCP traffic detected without corresponding DNS query: 94.201.102.118
Source: unknown TCP traffic detected without corresponding DNS query: 35.14.52.252
Source: unknown TCP traffic detected without corresponding DNS query: 77.57.117.214
Source: unknown TCP traffic detected without corresponding DNS query: 142.59.229.223
Source: unknown TCP traffic detected without corresponding DNS query: 251.70.148.255
Source: unknown TCP traffic detected without corresponding DNS query: 169.90.1.105
Source: unknown TCP traffic detected without corresponding DNS query: 37.122.2.156
Source: unknown TCP traffic detected without corresponding DNS query: 71.32.73.17
Source: unknown TCP traffic detected without corresponding DNS query: 13.246.42.68
Source: unknown TCP traffic detected without corresponding DNS query: 154.249.116.47
Source: unknown TCP traffic detected without corresponding DNS query: 25.7.113.225
Source: unknown TCP traffic detected without corresponding DNS query: 90.111.121.186
Source: unknown TCP traffic detected without corresponding DNS query: 37.145.166.125
Source: unknown TCP traffic detected without corresponding DNS query: 99.28.219.181
Source: unknown TCP traffic detected without corresponding DNS query: 215.115.74.19
Source: unknown TCP traffic detected without corresponding DNS query: 251.199.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 246.201.117.101
Source: unknown TCP traffic detected without corresponding DNS query: 69.87.87.237
Source: unknown TCP traffic detected without corresponding DNS query: 115.21.222.223
Source: unknown TCP traffic detected without corresponding DNS query: 207.83.70.217
Source: unknown TCP traffic detected without corresponding DNS query: 129.240.38.237
Source: unknown TCP traffic detected without corresponding DNS query: 206.248.209.16
Source: unknown TCP traffic detected without corresponding DNS query: 87.49.172.244
Source: unknown TCP traffic detected without corresponding DNS query: 19.173.195.129
Source: unknown TCP traffic detected without corresponding DNS query: 58.205.34.77
Source: unknown TCP traffic detected without corresponding DNS query: 35.20.112.188
Source: unknown TCP traffic detected without corresponding DNS query: 117.243.50.33
Source: unknown TCP traffic detected without corresponding DNS query: 212.247.40.88
Source: unknown TCP traffic detected without corresponding DNS query: 31.205.195.10
Source: unknown TCP traffic detected without corresponding DNS query: 70.192.24.62
Source: unknown TCP traffic detected without corresponding DNS query: 216.220.125.222
Source: unknown TCP traffic detected without corresponding DNS query: 181.38.157.79
Source: unknown TCP traffic detected without corresponding DNS query: 149.54.76.9
Source: unknown TCP traffic detected without corresponding DNS query: 130.86.222.72
Source: unknown TCP traffic detected without corresponding DNS query: 91.153.20.213
Source: unknown TCP traffic detected without corresponding DNS query: 253.217.74.222
Source: unknown TCP traffic detected without corresponding DNS query: 135.199.202.219
Source: unknown TCP traffic detected without corresponding DNS query: 211.107.49.167
Source: unknown TCP traffic detected without corresponding DNS query: 184.228.217.62
Source: unknown TCP traffic detected without corresponding DNS query: 98.172.15.73
Source: unknown TCP traffic detected without corresponding DNS query: 31.123.255.68
Source: unknown TCP traffic detected without corresponding DNS query: 218.48.17.219
Source: unknown TCP traffic detected without corresponding DNS query: 132.132.189.142
Source: unknown TCP traffic detected without corresponding DNS query: 63.204.14.200
Source: unknown TCP traffic detected without corresponding DNS query: 107.218.104.30
Source: unknown TCP traffic detected without corresponding DNS query: 198.212.126.124
Source: unknown TCP traffic detected without corresponding DNS query: 29.56.137.6
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@2/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/na.elf (PID: 5471) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/na.elf (PID: 5471) Directory: /root/.cache Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /root/.ssh Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /root/.config Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /root/.local Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/na.elf (PID: 5471) Directory: /etc/.java Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/na.elf (PID: 5471) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5468) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5468.1.0000557fd068f000.0000557fd0714000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: na.elf, 5468.1.00007ffda14ad000.00007ffda14ce000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: na.elf, 5468.1.00007ffda14ad000.00007ffda14ce000.rw-.sdmp Binary or memory string: ,j[Yx86_64/usr/bin/qemu-m68k/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5468.1.0000557fd068f000.0000557fd0714000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
155.31.99.139
 unknown United States
11809 NET-ERAU-PRCUS false
104.80.152.78
 unknown United States
16625 AKAMAI-ASUS false
24.82.158.146
 unknown Canada
6327 SHAWCA false
162.246.17.73
 unknown United States
19318 IS-AS-1US false
64.79.212.245
 unknown United States
29873 BIZLAND-SDUS false
25.35.185.254
 unknown United Kingdom
7922 COMCAST-7922US false
178.80.175.212
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
132.84.99.166
 unknown United States
306 DNIC-ASBLK-00306-00371US false
182.168.138.48
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
242.29.155.139
 unknown Reserved
unknown unknown false
220.228.27.99
 unknown Taiwan; Republic of China (ROC)
9919 NCIC-TWNewCenturyInfoCommTechCoLtdTW false
54.91.235.240
 unknown United States
14618 AMAZON-AESUS false
115.94.110.212
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
186.158.164.134
 unknown Argentina
11664 TechtelLMDSComunicacionesInteractivasSAAR false
207.165.106.218
 unknown United States
6122 ICN-ASUS false
77.167.220.253
 unknown Netherlands
1136 KPNKPNNationalEU false
30.131.166.128
 unknown United States
7922 COMCAST-7922US false
138.146.29.96
 unknown United States
721 DNIC-ASBLK-00721-00726US false
80.82.193.163
 unknown Ukraine
50173 VTESSEGB false
208.40.11.147
 unknown United States
2707 FIRSTCOMM-AS1US false
206.252.154.26
 unknown United States
6650 LOGICWORKS-ASUS false
212.46.75.69
 unknown Italy
47408 MANDARIN-ASIT false
188.160.106.212
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
31.205.252.249
 unknown United Kingdom
41230 ASK4GB false
123.170.135.146
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
101.84.145.89
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
223.109.47.243
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
248.164.132.176
 unknown Reserved
unknown unknown false
164.101.84.189
 unknown United States
4758 NICNET-VSNL-BOARDER-APNationalInformaticsCentreIN false
30.156.127.37
 unknown United States
7922 COMCAST-7922US false
107.98.185.99
 unknown United States
7018 ATT-INTERNET4US false
83.148.103.47
 unknown Bulgaria
8866 BTC-ASBULGARIABG false
195.53.55.217
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
241.95.137.70
 unknown Reserved
unknown unknown false
131.178.80.82
 unknown Mexico
6342 InstitutoTecnologicoydeEstudiosSuperioresdeMonterrey false
139.104.35.185
 unknown United States
3246 TDCSONGTele2BusinessTDCSwedenSE false
153.130.35.54
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
183.97.12.145
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
253.131.238.251
 unknown Reserved
unknown unknown false
219.192.118.122
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
7.114.17.205
 unknown United States
3356 LEVEL3US false
73.129.215.253
 unknown United States
7922 COMCAST-7922US false
26.198.65.15
 unknown United States
7922 COMCAST-7922US false
169.190.5.19
 unknown United States
37611 AfrihostZA false
159.213.50.12
 unknown Italy
6882 RTRT-PEGASOIT false
220.36.125.210
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
165.91.210.48
 unknown United States
3794 TAMUUS false
183.186.45.235
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
139.16.199.224
 unknown Germany
9905 LINKNET-ID-APLinknetASNID false
165.74.1.141
 unknown United States
7018 ATT-INTERNET4US false
240.103.98.185
 unknown Reserved
unknown unknown false
214.7.47.67
 unknown United States
27046 DNIC-ASBLK-27032-27159US false
205.140.17.118
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
96.168.41.31
 unknown United States
7922 COMCAST-7922US false
6.211.58.192
 unknown United States
3356 LEVEL3US false
255.112.250.168
 unknown Reserved
unknown unknown false
31.31.135.199
 unknown Belgium
199095 CITYMESH-ASBE false
183.144.254.114
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
217.121.200.127
 unknown Netherlands
33915 TNF-ASNL false
119.36.189.21
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
85.99.93.212
 unknown Turkey
9121 TTNETTR false
88.0.118.166
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
109.129.32.190
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
133.254.165.248
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
182.33.39.108
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
2.115.171.82
 unknown Italy
3269 ASN-IBSNAZIT false
145.61.143.34
 unknown Netherlands
197949 VMMABE false
106.67.247.2
 unknown India
45271 ICLNET-AS-APIdeaCellularLimitedIN false
61.87.58.170
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
247.0.82.4
 unknown Reserved
unknown unknown false
28.197.219.104
 unknown United States
7922 COMCAST-7922US false
86.40.71.34
 unknown Ireland
5466 EIRCOMInternetHouseIE false
28.135.163.244
 unknown United States
7922 COMCAST-7922US false
142.85.127.1
 unknown Canada
11489 BACICA false
128.190.164.76
 unknown United States
1503 DNIC-AS-01503US false
249.77.64.135
 unknown Reserved
unknown unknown false
215.64.9.158
 unknown United States
721 DNIC-ASBLK-00721-00726US false
146.127.185.91
 unknown United States
6501 SOUTHERNETUS false
221.228.217.92
 unknown China
23650 CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba false
19.28.155.18
 unknown United States
3 MIT-GATEWAYSUS false
31.108.245.48
 unknown United Kingdom
12576 EELtdGB false
13.4.160.225
 unknown United States
33631 PARC-ASNUS false
219.124.248.83
 unknown Japan 4721 JCNJupiterTelecommunicationsCoLtdJP false
245.119.92.144
 unknown Reserved
unknown unknown false
210.212.213.33
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
137.228.58.184
 unknown United States
127 JPL-AS127US false
55.85.163.54
 unknown United States
306 DNIC-ASBLK-00306-00371US false
74.255.66.30
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
59.26.39.63
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
152.0.104.66
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
192.210.142.139
 unknown United States
36352 AS-COLOCROSSINGUS false
161.64.251.120
 unknown Macau
7582 UMAC-AS-APUniversityofMacauMO false
96.53.107.211
 unknown Canada
6327 SHAWCA false
149.113.122.74
 unknown United States
174 COGENT-174US false
197.96.225.153
 unknown South Africa
3741 ISZA false
37.249.229.27
 unknown Poland
8374 PLUSNETPlusnetworkoperatorinPolandPL false
199.118.17.141
 unknown United States
10455 LUCENT-CIOUS false
99.192.177.210
 unknown United States
27589 MOJOHOSTUS false
113.152.61.114
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
115.229.18.214
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true