Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1532157
MD5: a77a0c4cae045164ddcae466b1943cd1
SHA1: f8c9ce658693ff2e86ac7ea5a64bb0adcc45eb02
SHA256: 86232d7ac334760fce0ed107b063bc2c69b2c16d9dc5b23e3797436c01464b44
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf Virustotal: Detection: 61% Perma Link
Machine Learning detection for sample
Source: na.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.12.108.114:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.190.239.32:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.124.40.117:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.171.221.247:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.72.71.121:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.139.215.172:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.242.85.139:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.187.194.68:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.135.223.132:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.78.18.171:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.132.73.40:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.202.171.97:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.251.248.47:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.117.72.235:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.16.97.195:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.158.120.191:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.215.48.233:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.50.116.122:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.4.153.66:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.210.134.179:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.204.222.252:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.21.226.179:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.190.244.12:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.210.69.169:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.36.237.83:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.173.233.167:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.3.239.190:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.136.205.145:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.71.201.143:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.64.69.45:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.55.23.61:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.118.55.207:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.243.222.238:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.127.16.250:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.132.249.70:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.248.162.59:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.237.115.169:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.253.184.235:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.3.250.224:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.39.10.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.28.11.4:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.163.134.192:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.187.154.30:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.233.175.56:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.243.242.10:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.32.249.87:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.145.96.130:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.161.215.245:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.83.65.79:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.117.18.118:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.49.27.16:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.98.135.124:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.116.113.100:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.179.190.84:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.130.3.55:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.251.93.61:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.42.10.75:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.175.1.48:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.237.70.155:2323
Source: global traffic TCP traffic: 192.168.2.14:41658 -> 194.120.116.148:5555
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.166.57.149:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.49.170.18:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.40.184.217:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.231.201.160:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.12.67.43:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.150.248.69:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.124.145.34:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.175.76.179:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.236.47.216:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.192.11.16:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.202.142.196:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.83.179.77:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.112.23.30:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.187.74.211:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.219.34.134:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.39.68.79:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.167.56.35:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.81.49.252:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.141.86.131:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.163.55.251:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.196.134.224:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.252.232.73:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.190.57.227:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.162.71.15:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.168.58.201:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.3.187.77:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.161.162.204:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.68.25.230:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.110.201.10:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.92.221.176:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.181.124.133:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.196.172.188:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.71.206.156:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.254.63.249:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.227.149.81:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.215.175.15:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.239.241.126:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.28.147.226:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.32.241.99:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.166.60.130:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.173.217.219:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.22.53.101:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.5.238.134:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.20.91.83:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.182.103.99:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.239.118.167:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.209.44.68:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.62.119.63:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.147.255.216:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.202.176.64:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.199.21.168:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.65.44.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.39.238.81:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.226.87.201:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.145.72.219:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.5.231.226:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.143.181.117:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.20.211.47:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.187.237.192:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.135.168.22:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.235.164.146:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.9.64.252:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.47.218.91:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.60.141.113:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.174.214.66:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.165.251.168:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.44.196.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.182.112.102:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.171.197.155:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.236.44.224:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.197.194.130:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.237.53.36:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.8.63.141:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.163.33.181:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.231.194.249:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.190.65.186:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.83.67.30:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.106.83.170:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.95.66.225:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.237.199.229:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.133.240.33:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.73.178.144:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.159.91.210:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.141.253.152:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.16.218.216:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.101.105.111:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.251.80.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.198.2.198:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.156.194.28:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.45.160.186:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.95.117.71:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.213.93.209:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.154.24.189:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.11.21.68:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.70.23.80:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.166.21.154:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.164.240.227:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.105.181.51:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.137.92.114:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.177.225.219:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.251.252.195:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.252.136.255:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.97.238.167:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.150.38.50:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.24.199.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.37.226.251:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.197.122.77:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.164.60.248:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.94.129.223:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.28.255.246:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.239.18.242:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.132.204.128:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.126.55.163:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.113.63.12:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.87.204.173:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.113.104.203:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.120.224.70:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.55.14.57:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.109.244.133:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.22.236.125:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.238.93.107:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.66.215.84:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.28.102.2:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.28.95.55:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.210.234.94:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.91.152.206:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.254.22.34:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.157.80.183:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.232.130.45:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.226.106.186:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.32.132.156:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.83.41.196:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.4.181.0:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.129.78.59:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.143.247.98:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.42.203.249:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.182.84.71:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.46.130.16:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.26.42.240:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.190.225.21:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.205.103.236:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.233.129.36:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.176.157.224:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.177.40.173:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.104.214.45:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.134.45.4:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.50.151.245:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.54.19.249:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.125.41.32:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.209.100.32:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.133.161.50:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.29.201.230:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.54.204.186:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.50.191.153:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.145.227.145:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.147.42.83:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.168.142.238:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.167.21.8:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.70.227.100:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.238.72.231:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.144.10.142:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.209.72.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.15.210.121:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.87.4.206:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.109.224.140:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.152.231.24:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.45.146.231:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.89.52.121:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.174.207.111:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.125.237.58:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.187.161.3:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.58.11.118:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.13.37.123:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.121.78.220:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.64.116.22:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.13.32.51:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.126.127.73:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.187.97.145:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.192.158.141:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.103.73.114:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.214.125.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.3.195.35:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.203.83.232:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.194.236.165:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.209.66.181:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.221.175.96:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.167.87.93:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.43.203.135:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.123.211.177:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.35.42.207:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.59.165.215:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.162.179.41:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.90.8.207:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.185.17.178:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.122.126.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.104.156.133:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.69.179.245:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.10.64.133:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.38.121.102:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.66.125.185:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.226.200.120:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.238.144.243:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.114.106.71:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.207.133.178:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.80.74.233:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.26.27.105:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.252.222.255:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.210.129.196:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.223.114.198:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.30.45.1:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.12.193.221:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.43.251.129:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.203.157.81:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.151.29.129:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.175.175.52:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.241.20.56:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.246.149.155:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.207.130.168:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.26.96.24:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.157.141.124:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.44.240.103:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.183.13.49:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.102.10.36:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.23.245.207:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.232.75.9:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.94.192.204:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.180.237.87:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.70.6.60:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.233.190.251:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.33.91.255:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.176.31.66:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.247.49.208:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.194.249.10:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.208.129.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.196.177.174:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.188.22.197:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.29.128.2:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.42.221.198:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.123.97.68:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.79.242.55:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.226.88.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.127.110.122:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.31.211.246:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.157.110.26:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.195.147.213:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.68.30.120:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.14.74.123:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.134.21.155:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.176.179.123:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.192.26.219:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.195.33.43:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.73.178.42:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.192.202.14:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.232.156.54:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.192.41.177:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.161.247.2:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.123.30.144:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.246.29.195:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.218.85.218:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.209.60.23:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.68.249.140:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.32.6.253:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.35.160.162:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.47.23.169:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.15.135.41:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.109.199.2:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.203.207.232:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.24.137.26:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.135.231.49:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.234.200.115:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.108.81.203:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.52.157.67:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.177.149.108:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.154.238.150:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.218.134.215:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.106.155.57:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.60.125.153:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.136.170.209:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.155.165.103:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.36.55.31:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.53.170.186:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.105.163.158:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.26.98.120:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.41.133.233:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.42.139.30:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.113.64.242:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.219.132.21:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.202.215.34:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.203.151.29:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.62.55.217:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.207.40.160:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.81.157.253:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.77.128.45:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.41.210.107:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.231.236.85:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.112.2.90:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.76.227.157:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.214.204.41:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.252.223.65:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.11.112.201:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.10.181.199:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.61.50.190:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.133.34.117:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.136.205.22:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.24.221.148:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.55.112.160:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.97.92.210:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.172.46.209:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.16.28.190:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.114.145.171:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.215.170.167:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.35.50.139:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.93.64.23:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.162.88.9:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.249.83.73:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.151.90.134:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.81.153.172:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.165.247.30:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.160.203.108:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.213.142.226:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.121.101.115:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.123.192.85:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.35.11.248:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.47.66.255:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.169.159.2:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.205.233.122:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.235.54.39:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.169.226.37:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.4.61.160:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.147.130.137:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.88.122.8:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.179.200.120:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.160.29.100:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.29.205.168:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.36.106.74:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.8.115.63:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.223.70.192:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.75.55.77:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.234.215.25:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.96.20.127:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.203.70.54:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.3.119.126:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.118.87.58:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.72.36.253:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.66.10.181:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.154.242.205:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.66.12.42:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.43.147.104:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.15.129.5:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.231.12.64:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.60.165.52:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.69.104.32:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.121.78.112:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.138.28.192:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.79.170.45:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.17.220.245:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.166.68.222:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.42.122.134:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.86.23.0:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.191.202.181:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.56.192.135:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.114.195.104:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.30.171.29:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.229.71.194:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.219.23.57:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.187.189.149:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.166.144.24:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.168.55.16:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.65.103.128:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.36.107.246:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.94.187.49:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.31.16.48:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.159.134.118:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.153.234.14:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.114.226.152:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.32.29.61:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.68.169.160:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.24.134.174:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.157.35.43:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.96.165.47:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.135.116.148:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.132.171.84:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.17.124.153:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.190.0.179:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.202.99.217:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.51.159.144:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.42.189.142:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.248.216.255:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.13.29.196:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.254.10.236:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.250.164.232:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.23.183.144:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.37.193.79:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.179.25.79:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.185.122.59:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.80.79.155:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.84.173.229:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 8.59.50.206:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.76.229.229:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.6.171.229:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.67.101.79:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.228.192.251:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.212.71.51:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.241.174.193:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.194.113.135:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.125.164.42:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.142.157.177:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.216.136.35:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.123.92.141:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.207.230.248:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.106.150.106:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.47.141.248:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.104.24.38:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.84.91.20:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.176.6.38:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.205.168.75:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.77.222.184:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.31.255.146:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.104.206.10:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 17.220.25.97:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.191.23.112:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 23.6.222.58:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.229.146.217:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.190.125.12:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.167.111.85:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 19.24.157.207:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.74.7.3:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 12.26.9.200:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 22.142.34.223:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 9.86.248.133:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.26.188.182:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.75.244.127:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 1.69.51.164:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 20.59.185.18:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 13.50.210.132:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 14.15.172.131:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 4.53.9.138:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.146.118.1:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 18.64.177.135:2323
Source: global traffic TCP traffic: 192.168.2.14:13731 -> 5.252.236.8:2323
Source: unknown TCP traffic detected without corresponding DNS query: 13.12.108.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.120.61.139
Source: unknown TCP traffic detected without corresponding DNS query: 8.25.66.189
Source: unknown TCP traffic detected without corresponding DNS query: 9.66.103.134
Source: unknown TCP traffic detected without corresponding DNS query: 20.188.75.152
Source: unknown TCP traffic detected without corresponding DNS query: 5.8.70.148
Source: unknown TCP traffic detected without corresponding DNS query: 8.88.244.149
Source: unknown TCP traffic detected without corresponding DNS query: 9.100.66.83
Source: unknown TCP traffic detected without corresponding DNS query: 23.249.58.85
Source: unknown TCP traffic detected without corresponding DNS query: 12.132.211.101
Source: unknown TCP traffic detected without corresponding DNS query: 8.162.51.76
Source: unknown TCP traffic detected without corresponding DNS query: 1.111.93.232
Source: unknown TCP traffic detected without corresponding DNS query: 5.130.158.184
Source: unknown TCP traffic detected without corresponding DNS query: 13.139.46.102
Source: unknown TCP traffic detected without corresponding DNS query: 9.69.216.5
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.239.32
Source: unknown TCP traffic detected without corresponding DNS query: 1.124.40.117
Source: unknown TCP traffic detected without corresponding DNS query: 4.125.98.167
Source: unknown TCP traffic detected without corresponding DNS query: 1.195.55.183
Source: unknown TCP traffic detected without corresponding DNS query: 18.94.199.73
Source: unknown TCP traffic detected without corresponding DNS query: 17.129.6.108
Source: unknown TCP traffic detected without corresponding DNS query: 18.89.253.57
Source: unknown TCP traffic detected without corresponding DNS query: 18.114.147.208
Source: unknown TCP traffic detected without corresponding DNS query: 18.97.17.205
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.51.108
Source: unknown TCP traffic detected without corresponding DNS query: 12.245.81.33
Source: unknown TCP traffic detected without corresponding DNS query: 8.171.221.247
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.163.33
Source: unknown TCP traffic detected without corresponding DNS query: 4.120.218.94
Source: unknown TCP traffic detected without corresponding DNS query: 4.57.115.216
Source: unknown TCP traffic detected without corresponding DNS query: 13.255.123.102
Source: unknown TCP traffic detected without corresponding DNS query: 4.230.204.140
Source: unknown TCP traffic detected without corresponding DNS query: 4.239.84.177
Source: unknown TCP traffic detected without corresponding DNS query: 9.78.73.4
Source: unknown TCP traffic detected without corresponding DNS query: 13.205.27.143
Source: unknown TCP traffic detected without corresponding DNS query: 19.72.71.121
Source: unknown TCP traffic detected without corresponding DNS query: 5.79.44.213
Source: unknown TCP traffic detected without corresponding DNS query: 17.176.122.68
Source: unknown TCP traffic detected without corresponding DNS query: 18.27.35.30
Source: unknown TCP traffic detected without corresponding DNS query: 17.206.249.148
Source: unknown TCP traffic detected without corresponding DNS query: 23.231.215.57
Source: unknown TCP traffic detected without corresponding DNS query: 20.195.138.25
Source: unknown TCP traffic detected without corresponding DNS query: 1.182.29.60
Source: unknown TCP traffic detected without corresponding DNS query: 17.97.120.74
Source: unknown TCP traffic detected without corresponding DNS query: 5.183.22.158
Source: unknown TCP traffic detected without corresponding DNS query: 14.241.43.188
Source: unknown TCP traffic detected without corresponding DNS query: 1.170.109.44
Source: unknown TCP traffic detected without corresponding DNS query: 19.36.155.183
Source: unknown TCP traffic detected without corresponding DNS query: 5.160.45.72
Source: unknown TCP traffic detected without corresponding DNS query: 4.82.7.66

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5488) SIGKILL sent: pid: 853, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5488) SIGKILL sent: pid: 5321, result: successful Jump to behavior
Yara signature match
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal76.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2672/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1583/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3244/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3120/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3361/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3759/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3239/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1577/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1610/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/512/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1299/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3235/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/514/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/519/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3756/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2946/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3757/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/917/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3758/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3134/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1593/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3011/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3094/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2955/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3406/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1589/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3129/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3402/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3125/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3246/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3245/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/767/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/800/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/888/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/801/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/769/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/803/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/5426/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/806/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/807/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/928/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2956/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/5321/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/490/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3142/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1635/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1633/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1599/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3139/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1873/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1630/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3412/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/657/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/658/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/659/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/418/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/419/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1639/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1638/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3398/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1371/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3392/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/780/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/660/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/661/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/782/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1369/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3304/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3425/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/785/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1642/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/940/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/941/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1640/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3147/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3268/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1364/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/548/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3667/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1647/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/5461/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/5462/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2991/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1383/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1382/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1381/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/791/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/671/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/794/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1655/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2986/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/795/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/674/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1653/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/797/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/2983/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3159/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/678/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1650/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3157/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/679/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/1659/maps Jump to behavior
Source: /tmp/na.elf (PID: 5488) File opened: /proc/3319/maps Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5486.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5484.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
4.24.86.209
 unknown United States
3356 LEVEL3US false
13.167.21.235
 unknown United States
7018 ATT-INTERNET4US false
20.98.156.39
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
23.51.209.240
 unknown United States
16625 AKAMAI-ASUS false
8.183.78.54
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
19.117.204.25
 unknown United States
3 MIT-GATEWAYSUS false
4.72.212.59
 unknown United States
3356 LEVEL3US false
23.87.174.36
 unknown United States
395954 LEASEWEB-USA-LAX-11US false
12.182.77.33
 unknown United States
7018 ATT-INTERNET4US false
22.180.178.87
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
5.225.174.100
 unknown Spain
12430 VODAFONE_ESES false
14.15.49.151
 unknown Japan 131959 YOUTVYOUCommunicationsCorporationJP false
23.152.199.154
 unknown Reserved
30025 RICHMOND-IX-TRANSITUS false
5.113.189.215
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
14.175.10.221
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
14.250.10.63
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
8.199.174.199
 unknown United States
3356 LEVEL3US false
22.196.196.158
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
22.159.199.3
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
19.200.192.251
 unknown United States
3 MIT-GATEWAYSUS false
14.93.107.35
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
1.218.3.77
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
1.170.154.197
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
19.216.213.166
 unknown United States
3 MIT-GATEWAYSUS false
17.28.55.255
 unknown United States
714 APPLE-ENGINEERINGUS false
22.114.179.240
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
14.26.130.231
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.163.152.173
 unknown United States
3 MIT-GATEWAYSUS false
4.211.149.41
 unknown United States
3356 LEVEL3US false
18.149.120.9
 unknown United States
16509 AMAZON-02US false
23.203.15.82
 unknown United States
16625 AKAMAI-ASUS false
8.168.141.82
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
13.95.206.232
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
18.221.123.47
 unknown United States
16509 AMAZON-02US false
14.3.168.17
 unknown Japan 4685 ASAHI-NETAsahiNetJP false
1.64.97.221
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
14.126.87.104
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
1.86.212.106
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
8.56.197.181
 unknown United States
3356 LEVEL3US false
23.178.103.24
 unknown Reserved
397347 NORTH-AS1US false
5.91.239.150
 unknown Italy
30722 VODAFONE-IT-ASNIT false
14.215.141.207
 unknown China
4816 CHINANET-IDC-GDChinaTelecomGroupCN false
1.1.200.152
 unknown Thailand
23969 TOT-NETTOTPublicCompanyLimitedTH false
22.111.50.108
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
17.66.33.127
 unknown United States
714 APPLE-ENGINEERINGUS false
18.97.38.99
 unknown United States
3 MIT-GATEWAYSUS false
13.105.225.103
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
14.84.163.190
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
20.41.224.88
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.232.179.6
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
5.14.220.145
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
23.78.234.112
 unknown United States
27986 ENTELCHILESACL false
17.23.29.216
 unknown United States
714 APPLE-ENGINEERINGUS false
18.14.53.203
 unknown United States
3 MIT-GATEWAYSUS false
9.220.201.55
 unknown United States
3356 LEVEL3US false
18.31.110.249
 unknown United States
3 MIT-GATEWAYSUS false
1.255.125.253
 unknown Korea Republic of
9770 SPEEDONSTV-AS-KRLGHelloVisionCorpKR false
22.81.21.72
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.17.40.169
 unknown United States
23089 HOTWIRE-COMMUNICATIONSUS false
5.154.38.34
 unknown Spain
29119 SERVIHOSTING-ASAireNetworksES false
8.135.254.113
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
18.13.184.10
 unknown United States
3 MIT-GATEWAYSUS false
18.59.14.220
 unknown United States
3 MIT-GATEWAYSUS false
14.173.2.244
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
17.38.45.116
 unknown United States
714 APPLE-ENGINEERINGUS false
23.83.167.243
 unknown United States
7203 LEASEWEB-USA-SFO-12US false
20.231.13.85
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
14.155.77.50
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
18.99.183.77
 unknown United States
3 MIT-GATEWAYSUS false
19.69.135.15
 unknown United States
3 MIT-GATEWAYSUS false
17.215.6.230
 unknown United States
714 APPLE-ENGINEERINGUS false
5.118.7.79
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
1.126.210.205
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
17.115.203.110
 unknown United States
714 APPLE-ENGINEERINGUS false
5.21.53.109
 unknown Oman
50010 NAWRAS-ASSultanateofOmanOM false
14.52.72.210
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
1.169.127.70
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
23.203.88.17
 unknown United States
16625 AKAMAI-ASUS false
17.129.6.108
 unknown United States
714 APPLE-ENGINEERINGUS false
8.50.163.235
 unknown United States
3356 LEVEL3US false
22.22.172.73
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
9.52.100.117
 unknown United States
3356 LEVEL3US false
4.42.35.91
 unknown United States
3356 LEVEL3US false
14.58.140.166
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
18.190.165.95
 unknown United States
16509 AMAZON-02US false
22.164.126.17
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
17.162.186.85
 unknown United States
714 APPLE-ENGINEERINGUS false
20.17.17.216
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
17.187.31.149
 unknown United States
714 APPLE-ENGINEERINGUS false
22.134.192.146
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
22.181.169.196
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
12.169.182.227
 unknown United States
7018 ATT-INTERNET4US false
22.146.44.94
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
4.184.87.170
 unknown United States
3356 LEVEL3US false
23.94.151.92
 unknown United States
36352 AS-COLOCROSSINGUS false
9.74.251.134
 unknown United States
3356 LEVEL3US false
20.251.164.109
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
9.255.18.204
 unknown United States
3356 LEVEL3US false
8.111.221.98
 unknown United States
3356 LEVEL3US false
23.250.5.197
 unknown Canada
55286 SERVER-MANIACA false